# Standards and Regulatory References for Marketing Analytics Privacy

## Primary Legislation
- **GDPR Art. 6(1)(a)**: Consent as lawful basis for marketing processing.
- **GDPR Art. 6(1)(f)**: Legitimate interest for direct marketing (Recital 47).
- **GDPR Art. 21(2)-(3)**: Absolute right to object to direct marketing processing.
- **GDPR Art. 22**: Automated decision-making including profiling.
- **ePrivacy Directive Art. 5(3)**: Consent for cookies and device access.
- **PECR Reg. 6**: UK cookie consent. **Reg. 22**: UK electronic marketing consent.

## EDPB Guidance
- **WP251rev.01 Guidelines on Automated Decision-Making and Profiling**: Profiling for marketing must be transparent; significant effects require Art. 22 safeguards.
- **Guidelines 05/2020 on consent under the GDPR**: Cookie walls generally not compliant; scrolling/continuing to browse not valid consent.
- **Guidelines 2/2023 on dark patterns in social media interfaces**: Identified manipulative consent patterns in marketing contexts.

## Enforcement Decisions
- **CNIL vs Google LLC (SAN-2021-023, 2022)**: EUR 150 million for cookie consent dark patterns.
- **CNIL vs Criteo (SAN-2023-010, 2023)**: EUR 40 million for behavioural advertising without valid consent.
- **Belgian DPA vs IAB Europe (21/2022, 2022)**: TCF consent string is personal data; IAB Europe is joint controller.
- **Norwegian DPA vs Grindr (2021)**: NOK 65 million for sharing data with ad partners without consent.
- **ICO vs TikTok (2023)**: GBP 12.7 million for children's data in targeted advertising.