Consent (political ad targeting)
Consent for political ad targeting is your explicit, informed agreement to allow your personal data to be used to show you political advertisements. Under EU law, this consent must be freely given, specific, and as easy to withdraw as it is to give. You cannot be forced or tricked into giving consent for political targeting.
Legal Basis
"Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes..."
— Article 6(1), Regulation 2016/679 (GDPR)
The TTPA Regulation (EU 2024/900) restricts targeting for political advertising beyond general GDPR consent requirements. Consent is one of the few lawful bases permitted for using personal data in political ad targeting, but strict conditions apply.
Why It Matters
Consent is the primary legal basis that allows political campaigns, parties, and platforms to use your personal data for targeted political advertising online. This means before anyone can show you political ads based on your browsing history, location, interests, or other personal information, they must first ask for your clear permission.
The TTPA regulation makes consent for political ad targeting more stringent than for commercial advertising. Platforms and political actors cannot use pre-ticked boxes, assume silence means agreement, or bundle consent for political targeting with consent for other services. You must actively say "yes" to each specific use of your data for political purposes.
If you give consent, you can withdraw it at any time. Platforms and political advertisers must make withdrawal as simple as giving consent originally. Once withdrawn, they must stop using your personal data for targeting immediately, though ads you've already been shown cannot be "unseen."
Key Points
- Explicit and informed: You must understand exactly what data will be used, for what political purpose, and by whom before consenting.
- Freely given: Consent cannot be a condition for accessing a service unless the data processing is strictly necessary for that service (which it rarely is for political ads).
- Easy withdrawal: Withdrawing consent must be as simple as giving it—one click to opt out if it was one click to opt in.
- Purpose-specific: Consent for one political campaign or purpose doesn't automatically apply to others; each use needs separate consent.
- Special category data restrictions: Consent cannot make it lawful to use sensitive data like ethnic origin, religious beliefs, or biometric data for political targeting under TTPA rules.
- Record-keeping: Providers must keep records proving consent was properly obtained and must demonstrate compliance to authorities.
Consent vs. Legitimate Interest
Consent and legitimate interest are two different legal bases for processing personal data under GDPR. Consent requires your active, explicit agreement. Legitimate interest allows processing without consent if the organization has a valid reason and your rights don't override that reason. For political ad targeting online, TTPA regulation severely restricts legitimate interest as a legal basis—consent is almost always required. Legitimate interest cannot be used to justify targeting based on special category data or data you haven't directly provided to the political actor.