Retargeting and Profiling Limits
Retargeting and profiling are among the most powerful tools in modern digital marketing. They allow brands to reconnect with users who have interacted with their website, app, or social media content, and to build detailed audience segments based on behavioural patterns.
But precisely because these practices rely on tracking, data analysis, and behavioural inference, they fall under strict legal limits worldwide. The law recognises that profiling can shape consumer decisions, influence vulnerable groups, and expose individuals to intrusive surveillance if left unregulated.
This post explains the legal frameworks, consent rules, profiling restrictions, sensitive-data limitations, fairness obligations, and enforcement risks associated with retargeting and consumer profiling.
1. What Are Retargeting and Profiling?
A. Retargeting (Remarketing)
Retargeting is the practice of showing ads to people who have previously:
Examples include:
-
Google Ads remarketing
-
Facebook pixel retargeting
-
TikTok and Pinterest conversion tracking
-
Email retargeting (“You left something in your cart!”)
B. Profiling
Profiling is defined in most global regulations as:
Any automated processing of personal data used to evaluate or predict aspects of a person’s behaviour, interests, location, preferences, or purchasing intentions.
Profiling includes:
-
building audience segments
-
behavioural predictions
-
scoring systems
-
automated interest classification
-
algorithmic ad-personalisation
In legal terms, profiling is considered high-risk data processing because it can influence decision-making and privacy.
2. Core Legal Frameworks Governing Retargeting & Profiling
A. European Union – GDPR & ePrivacy Directive
-
Profiling requires a clear legal basis, usually explicit consent.
-
Website retargeting pixels (Facebook Pixel, GA4) require prior opt-in.
-
Users must be informed about how profiling works, what data is used, and for what purpose.
-
Automated decision-making that significantly affects users requires additional safeguards.
-
Sensitive data profiling is prohibited except under strict exceptions.
B. United Kingdom – UK GDPR & PECR
Same as the EU but enforced separately by the ICO.
Heavy fines have been issued for non-consensual retargeting cookies and opaque tracking practices.
C. United States – FTC + State Privacy Laws (CCPA/CPRA, Colorado, Virginia)
Oversight focuses on:
-
misleading or non-transparent tracking
-
selling or sharing personal data without notice
-
behavioural advertising opt-out rights
-
restricting profiling of minors
The CPRA specifically regulates “cross-context behavioural advertising”.
D. Other Jurisdictions
-
Brazil (LGPD): profiling must be proportionate, transparent, and justified.
-
Canada (PIPEDA): requires meaningful consent for targeted advertising.
-
Australia (Privacy Act): consent and transparency are essential; updates aim to restrict profiling further.
-
Asia-Pacific countries increasingly limit behavioural tracking and require explicit notice.
3. Legal Limits on Retargeting and Profiling
A. Consent Requirements
You cannot retarget users with tracking tools unless:
-
consent is freely given
-
consent is unambiguous
-
users understand exactly what data you collect
-
consent is opt-in (never pre-ticked boxes)
-
withdrawal is as easy as giving consent
Cookies or tracking scripts cannot load before consent.
B. Purpose Limitation
User data collected for one purpose (e.g., analytics) cannot automatically be reused for another (e.g., personalised ads) without:
C. Data Minimization
Marketers may only collect necessary data.
Excessive behavioural tracking (e.g., long-term cross-site tracking without purpose) is unlawful.
D. Sensitive Data Restrictions
Most laws prohibit or severely restrict profiling based on:
Any targeting based on vulnerabilities is considered high-risk and potentially illegal.
E. Automated Decision-Making Limits
If profiling has a significant effect on a person (e.g., credit scoring, insurance premiums), individuals have the right to:
-
human intervention
-
explainability
-
to contest the decision
Marketing profiling is usually “low-impact”, but the boundaries are narrowing.
4. Retargeting-Specific Legal Restrictions
A. Pixel Tracking and Advertising IDs
-
Cannot deploy Facebook Pixel, TikTok Pixel, or similar trackers without consent.
-
Must disclose third-party data sharing.
-
Users must be told if their data leaves the region (e.g., EU → US transfers).
B. Cross-Site and Cross-App Tracking
Platforms like Apple require apps to request permission for:
-
tracking across other apps
-
combining data from different sources
-
device-level identifiers (IDFA, GAID)
Refusal must not degrade the service (anti-dark-patterns principle).
C. Frequency Capping and Fairness
Excessive retargeting may be considered:
-
intrusive
-
manipulative
-
mentally pressuring
Regulators increasingly treat “over-surveillance” as unfair marketing.
D. Lookalike Audiences / Similar Audiences
Strict rules apply to:
Brands must avoid using data in a way that indirectly targets sensitive traits.
5. Transparency Obligations
To legally retarget users, businesses must clearly explain:
-
why data is collected
-
what data is used (e.g., page visits, cart data)
-
for how long it will be stored
-
who receives the data (e.g., Meta, Google, TikTok)
-
how ads will be personalised
-
how users can disable or delete tracking
The explanation must be in plain language—not buried under complex legal jargon.
6. Enforcement Examples
Regulators have taken action against:
-
TikTok for profiling minors without proper consent
-
Meta for unlawful behavioural advertising in Europe
-
Google for misleading privacy controls
-
Retailers using hidden pixels for price discrimination
-
Apps secretly harvesting location data for ad targeting
Penalties include:
7. Best Practices for Compliant Retargeting and Profiling
-
Use a proper Consent Management Platform (CMP).
-
Avoid loading tracking pixels before consent.
-
Limit data to what is strictly necessary.
-
Do not profile minors or vulnerable groups.
-
Provide clear, accessible privacy dashboards.
-
Maintain logs proving consent.
-
Regularly audit third-party ad partners.
-
Do not retarget sensitive behaviour (health visits, mental health pages, crisis content).
-
Limit retargeting duration (e.g., 30–60 days).
-
Offer easy opt-outs (privacy links, Ad Choices mechanisms).
8. Why This Matters
Retargeting and profiling sit at the intersection of:
-
privacy law
-
digital marketing ethics
-
consumer trust
-
platform compliance
-
data protection
Done responsibly, they improve consumer experience.
Done improperly, they trigger fines, reputational damage, and loss of data rights.
Modern advertising is no longer only about persuasion—
it is about respecting the boundaries of personal autonomy.
