Personal Data

Personal data is any information that relates to an identified or identifiable natural person. This includes obvious identifiers like names and email addresses, but also things like IP addresses, location data, online identifiers, or any other information that could be used alone or combined with other data to identify someone. Under EU law, personal data is protected to safeguard people's fundamental rights to privacy and data protection.

Legal Basis

"Personal data means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."

— Article 4(1), Regulation (EU) 2016/679 (GDPR)

The GDPR is the primary EU law governing personal data. In the context of political advertising, Regulation (EU) 2024/900 regulates how personal data may be used for targeting and ad-delivery techniques, building on the GDPR's framework.

Why It Matters

Personal data is at the heart of modern political advertising regulation because targeting and ad-delivery techniques rely heavily on processing this information. When political campaigns, platforms, or advertisers use personal data to target voters—whether based on their location, browsing history, political opinions, or demographics—they must comply with strict data protection rules under both the GDPR and the political advertising regulation.

For anyone involved in political advertising, understanding what counts as personal data is essential. Sponsors, publishers, and providers of advertising services must ensure they have a lawful basis (such as consent) before processing personal data for targeting. This is especially important because political targeting often involves sensitive information, such as political opinions, which receives extra protection under EU law.

Voters and citizens benefit from these protections because they limit how their personal information can be used to influence their political choices. The transparency and targeting rules in Regulation 2024/900 ensure that when personal data is used for political advertising, people know about it and can exercise their rights to privacy and data protection.

Key Points

Personal data includes any information that can identify a person, directly or indirectly, including names, email addresses, IP addresses, and online identifiers
Processing personal data for political advertising requires a lawful basis under the GDPR, typically explicit consent when targeting is involved
Special categories of personal data, such as political opinions, health data, or biometric data, have stricter protection and generally cannot be used for targeting in political advertising
Regulation 2024/900 prohibits or severely restricts the use of personal data for targeting and ad-delivery techniques in online political advertising, with narrow exceptions
Data subjects have rights including access, rectification, erasure, and objection to processing of their personal data
Complaints about misuse of personal data in political advertising can be made to data protection authorities

Personal Data vs. Anonymous Data

Personal data can identify someone, while anonymous data cannot. Once data is truly anonymized—meaning it's impossible to re-identify the individual, even by combining it with other information—it's no longer personal data and GDPR protections don't apply. However, pseudonymized data (where identifiers are replaced but re-identification is still possible) still counts as personal data.

In political advertising, this distinction matters because many targeting techniques claim to use "anonymized" or "aggregated" data, but if that data can still be linked back to individuals or used to target specific people, it's personal data and subject to all data protection rules.

Aspect	Personal Data	Anonymous Data
Can identify individuals	Yes, directly or indirectly	No, identification impossible
GDPR applies	Yes	No
Can be used for targeting	Only with lawful basis	Yes, but may not be truly anonymous
Examples	Email, IP address, cookie ID	Aggregate statistics with no identifiers

Related Terms

Targeting techniques
Ad-delivery techniques
Special categories of personal data
Data subject
GDPR
Consent
Political advertising
Provider of political advertising services
Publisher
Data protection authority

Very transparent. Every political ad will be labelled, linked to a transparency notice with detailed information, and online ads will be searchable in a central European repository.

The Network coordinates election-related cooperation between member states. National contact points for TTPA enforcement should be members of this network where possible.

Election campaigns will need to ensure all paid advertising includes proper labels and transparency notices. Sponsors must be prepared to provide required information to all service providers.

Several major platforms currently do not allow paid political advertising, including some large social networks. This limits where political actors can place paid online advertisements.

The TTPA applies from 10 October 2025. Member States had until 10 April 2025 to designate competent authorities, and the Commission must provide label templates by 10 July 2025.

Publishers must ensure completeness and accuracy of certain information but are not required to verify all sponsor claims. They must correct manifestly erroneous information when they become aware of it.

Yes. When a hosting provider and a website both display an ad, both are considered publishers with responsibility for their specific services. Contracts should clarify how they share compliance duties.

If a publisher removes or disables access to a political ad due to illegality or terms violations, they must still provide access to the transparency information for the full seven-year retention period.