Data privacy compliance remains a dynamic and evolving challenge for marketing managers. Business objectives, campaign execution, and performance requirements continue irrespective of increasing regulatory demands. In 2024, the Information Commissioner’s Office (ICO) issued 18 monetary penalties and 62 enforcement actions, underscoring the substantial risks inherent in adopting a passive approach to compliance.

A considerable number of these enforcement actions resulted from basic operational deficiencies rather than intentional breaches. Inadequate consent management, improper tool configuration, and insufficient controls over marketing data remain prevalent causes of non-compliance. Non-compliant data compromises reliability, which in turn undermines the integrity of business decision-making.

The following analysis identifies seven principal areas of non-compliance commonly observed within enterprise environments.

1. Treating PECR as Second-Class

Industry attention is frequently directed toward GDPR, often to the detriment of the Privacy and Electronic Communications Regulations (PECR). PECR operates in parallel with GDPR and specifically regulates direct marketing activities, including calls, texts, and emails.

In 2024, the ICO placed increased emphasis on enforcement of PECR violations. Since March 2022, 49 monetary penalty notices related to unsolicited direct marketing under PECR have resulted in financial penalties exceeding £4.6 million for UK organisations.

A persistent issue involves the reuse of legacy databases or acquisition of marketing lists without adequate verification of valid consent for each specific communication channel. Consent obtained for email communications does not automatically confer consent for SMS.

• Consent segmentation: Ensure that both CRM systems and Consent Management Platforms (CMP) record consent at the channel level, rather than relying on a general opt-in.
• List auditing: Where the source and date of consent for a record cannot be demonstrated, such records should be excluded from active marketing lists.
• PECR prioritisation: PECR compliance should be established as a distinct workstream within the analytics tracking framework.

2. Technical Misconfigurations in CMP Implementation

The effectiveness of a Consent Management Platform is contingent upon correct implementation. A frequent issue in CMP integrations is leakage, in which cookies are triggered before user interaction with the consent banner.

This scenario typically arises when organisations utilise default CMP configurations that do not integrate effectively with their Tag Manager. If a Facebook Pixel or LinkedIn Insight Tag is triggered upon page load before the user has provided consent, the implementation is non-compliant with both GDPR and ePrivacy requirements.

• Google Consent Mode v2 implementation: This configuration ensures that tags respond appropriately to user consent choices, including scenarios where consent is declined, thereby enabling basic conversion modelling while maintaining privacy standards.
• Tag sequencing: Configure Google Tag Manager or Tealium iQ to require a ‘consent granted’ event prior to the activation of any non-essential tracking pixels.

3. Over-Reliance on “Legitimate Interests”

Historically, ‘Legitimate Interest’ has been widely adopted as the legal basis for behavioural advertising. However, regulatory scrutiny has intensified. Recent enforcement actions against major platforms, such as the €310 million fine imposed on LinkedIn, indicate that Legitimate Interest is seldom considered a valid legal basis for extensive tracking and audience matching.

A common compliance issue is the default reliance on Legitimate Interest for third-party tracking, often to circumvent the anticipated reduction in data associated with opt-in consent.

• Transition to explicit consent: For all tracking activities related to behavioural advertising or cross-site profiling, explicit consent should be established as the default legal basis.
• Transparency: Clearly specify the purposes of data collection within CMP categories, such as ‘Advertising’ or ‘Personalisation’, to ensure users are fully informed regarding the nature of their consent.

4. Skipping DPIAs for New Marketing Tech

The introduction of new technologies, including Customer Data Platforms (CDPs), AI-driven personalisation engines, and new tracking pixels, frequently results in data processing at a scale that requires a Data Protection Impact Assessment (DPIA).

A recurring weakness is the deployment of tools by marketing teams without timely engagement of privacy stakeholders. This approach, often referred to as ‘shadow IT’, can lead to subsequent compliance failures, increased enforcement risk, and costly remediation.

• Privacy by Design: Incorporate a DPIA as a standard component of the procurement process for all analytics and data quality services.
• Comprehensive documentation: Where a full DPIA is deemed unnecessary, the rationale for this determination should be formally documented.

5. The “Accept All” Dark Pattern Trap

User experience (UX) continues to be a significant factor in conversion performance. However, the use of dark patterns—design elements intended to influence users toward providing consent—has become a primary area of regulatory scrutiny.

A typical example involves a ‘Reject All’ option that is less prominent or more difficult to access than the ‘Accept All’ option. Where the process of providing consent is materially easier than withholding it, such consent is unlikely to satisfy the GDPR requirement of being freely given.

• Equal prominence: Both ‘Accept’ and ‘Reject’ options should be presented with equivalent visual emphasis and accessibility on the initial layer of the CMP banner.
• Responsible A/B testing: Optimisation of banner design for increased opt-in rates should be conducted within the parameters of fairness and transparency.

6. Weak Governance of Marketing Databases

Recent ICO enforcement actions against marketers frequently cite inadequate record-keeping as a contributing factor. When a user opts out, this preference must be reflected across the entire marketing ecosystem, rather than being limited to a single system. A common issue is the existence of siloed opt-out data. For example, a user may unsubscribe from email communications but continue to receive targeted SMS messages due to inadequate synchronisation between relevant systems. Properly synchronised.

• Centralised suppression lists: Establish a single authoritative source for all marketing consent and opt-out requests.
• Automated synchronisation: CMP, CRM, and ESP platforms should be integrated to enable real-time updates. Changes in user cookie preferences must be reflected promptly in ad-tech audience segments.

7. Failing to Audit Third-Party Tags

Most websites deploy a diverse array of third-party tags, including heatmap tools and social media trackers. Over time, the accumulation of tags can present significant governance challenges. Legacy tags that are not removed may continue to operate, potentially collecting data without a valid legal basis.

This issue frequently arises from treating cookie management as a one-time implementation. New tags may be introduced by various teams without proper categorisation in the CMP, resulting in their activation without appropriate consent controls.

• Regular audits: Conduct quarterly technical audits of tag management containers, such as GTM, Tealium, or Adobe Launch.
• Automated scanning: Employ automated quality-assurance tools to identify unclassified cookies and tags that may bypass the CMP.

Turning CMP compliance into a Competitive Advantage

Compliance should be regarded as an enabler rather than a barrier to performance. Organisations that prioritise data privacy consistently achieve higher data quality, enhanced governance, and more durable customer trust. When users have confidence in data handling practices, the resulting data is generally more accurate, defensible, and valuable. Addressing these seven areas facilitates a transition from reactive risk management to a proactive operating model, in which data is recognised as a trusted asset that supports sustainable long-term growth.

If you’d like to hear more on this topic and set up a 1:1 call with us, please use the contact form. Contact a Consultant