The safest approach is to treat targeting as a governed processing activity, not a marketing afterthought. Organisations should identify the lawful basis, explain the processing clearly, limit collection to what is necessary, and document joint-controller responsibilities. Consent must be freely given, specific, informed, and unambiguous when required. Where legitimate interests are used, teams need a balancing test and a defensible purpose test.
How consent and transparency shape social media targeting
Social media targeting sits at the point where marketing intent meets privacy law. The practical question is not just whether a campaign can reach a segment, but whether the organisation can explain the logic, source, and purpose of the targeting in a way a user would understand. For personal data processing in Europe, the GDPR principles on fairness, purpose limitation, transparency, and data minimisation set the baseline for that explanation.
That means teams should design targeting from the outside in: start with the user-facing notice, then confirm the lawful basis, then confirm the data actually needed to deliver the campaign. If the targeting uses sensitive or inferred attributes, the bar rises further, because those features can expose users to unexpected profiling and higher regulatory scrutiny.
For a practical privacy baseline, many teams anchor their process in the GDPR’s processing principles and data protection by design requirements, then validate campaign logic against the organisation’s own privacy notice and record of processing activities. The EU General Data Protection Regulation (GDPR) is the clearest external reference point for those checks.
What makes targeting compliant in practice
Compliance usually fails at the seams between consent capture, audience selection, and onward sharing with ad-tech or platform partners. If consent is the chosen lawful basis, it must be freely given, specific, informed, and unambiguous, and users need a real choice that is not bundled with unrelated access or buried in default settings. If legitimate interests is used instead, teams need a documented balancing test and a purpose statement that matches the actual audience segment.
Transparency also has to extend beyond the first-party website or app. Users should be able to understand whether targeting is based on first-party behaviour, platform-provided segments, hashed identifiers, pixel events, lookalike modelling, or shared audience lists. That is where over-collection and vague disclosures become risky, because the legal basis may be defensible while the notice still fails the transparency test.
When targeting depends on personal data retention, consent history, or identity-linked profiles, the privacy control problem becomes more than marketing hygiene. NHIMG’s Identity Data Privacy and Consent Guide is a useful internal reference for minimisation, consent management, and retention discipline in that kind of workflow.
Which targeting patterns create the most compliance friction
The highest-friction patterns are usually the ones that feel convenient to marketers and opaque to users. Cross-platform retargeting, third-party audience enrichment, and inferred-interest segments can all be lawful in the right setup, but they force organisations to be precise about source data, disclosures, and suppression logic. If the user cannot reasonably predict how the segment was built, the transparency burden is usually too low.
Joint-controller and processor arrangements also need attention early, not after launch. If a platform determines part of the targeting purpose or means, teams need to document who is responsible for notices, rights handling, retention, and incident response. If the arrangement is unclear, accountability gaps tend to show up when a user asks for access, deletion, or objection.
That is also why consent governance needs operational controls, not just legal text. The SaaS-to-SaaS and OAuth App Governance Guide is relevant because many modern targeting flows depend on connected platforms, delegated access, and third-party permissions that can widen exposure if not reviewed continuously.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
GDPR and ISO/IEC 27001:2022 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art.5 — Principles relating to processing of personal data | Targets must satisfy fairness, transparency, and minimisation principles. |
| Art.25 — Data protection by design and by default | Targeting design should build transparency and minimisation into the workflow. | |
| Art.35 — Data protection impact assessment | High-risk profiling and large-scale targeting can trigger DPIA review. | |
| Recommendation — Limit targeting data to what is necessary and align the segment logic with a clear lawful purpose. Build notice, consent, and data-minimisation checks into campaign design before launch. Run a DPIA when targeting uses profiling, sensitive attributes, or extensive cross-context data. | ||
| ISO/IEC 27001:2022 | A.5.34 — Privacy and protection of PII | Targeting programs must govern personal data use, disclosure, and protection controls. |
| Recommendation — Apply privacy controls to targeting data, disclosures, and retention limits across the campaign lifecycle. | ||
Practitioner Guidance
What to verify: Confirm that every targeting segment can be explained in plain language, including the data source, lawful basis, retention period, and the user choice available at collection or first use. If the explanation sounds incomplete when read aloud to a non-specialist, the disclosure is not ready.
Decision rule: If the campaign depends on inferred, third-party, or cross-context data, require a stricter review of notice wording, opt-out handling, and partner contracts before launch. If the campaign uses only first-party, low-risk behavioural data, the main control is still minimisation and clear purpose description, not broader data collection.
Common mistake: Treating “consent obtained somewhere” as enough. For targeting, the consent or lawful-basis decision has to match the exact processing step that is happening now, not a generic permission granted months earlier for a different purpose.
Practitioner takeaway: The safest targeting programmes are the ones that can show, end to end, why the segment exists, what data created it, who is responsible for it, and how the user can understand or challenge it.
Related resources from NHI Mgmt Group
- How should security teams make NHI best practices usable across the business?
- What are the best practices for validating email security controls in production without disrupting users?
- What are the best practices for classifying essential cookies under modern consent rules?
- What are the signs that a social media account takeover campaign is targeting creators rather than random users?
