The stipulation that will perhaps cause most angst is the new formulation for collecting an individual’s consent to data gathering and processing; GDPR requires that consent be active (as opposed to passive) and represent a genuine and meaningful choice. Digital marketers know that users of internet-based services like Snapchat, Facebook, and Google technically provide consent by agreeing to these companies’ terms of service when they sign up. But does this constitute an active and genuine choice? Does it indicate that the user is willing to have her personal data harvested across the digital and physical worlds, on- and off-platform, and have that data used to create a behavioral profile for digital marketing purposes? Almost certifiably not. Other components of GDPR that will make life more difficult and increase operational uncertainty for digital marketers include the ban on automated decision-making (e.g., applying algorithms to personal data to drive inferences and target ads) in the absence of the individual’s meaningful consent; the new rights afforded to individuals to access, rectify, and erase data about them held by corporations; the prohibition on processing of data pertaining to special protected categories as identified in the regulations; and the stipulation that data collectors must demonstrate compliance with the regulations as a general matter. Get the full story at Harvard Business Review