GDPR Privacy FAQs: If a website participates in behavioral advertising, does the GDPR require that it disclose that it is “selling” consumers’ information?

August 7, 2019


The requirement to disclose “sales” of “personal information” to consumers is derived from the California Consumer Privacy Act (the “CCPA”), not European data privacy law.  Of course, the GDPR also requires that controllers make a number of disclosures to data subjects concerning the use and disposition of their personal data, but the concept of disclosing the “selling” of data relates to the CCPA.

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.