Influencer Marketing and GDPR: What Brands Need to Know

This is practical guidance from Make Influence, not legal advice. Use it as a checklist of what to consider — get the specific legal assessment of your own processing from a lawyer, particularly if you handle sensitive data or data about children.

GDPR is not the same thing as ad disclosure

Ad-disclosure rules — covered in their own article — govern whether a post has to be labelled as advertising. GDPR (the General Data Protection Regulation) governs something entirely different: how personal data is collected, stored, used and shared. The two rulebooks apply at the same time and independently of each other. A post can be correctly labelled as an ad and still involve a GDPR breach — for example, if entrant addresses from a giveaway are left unprotected in a spreadsheet with no lawful basis for holding them.

What personal data is actually involved?

An influencer collaboration typically involves several distinct kinds of personal data, often handled by different parties:

The tracking row surprises a lot of people: the regulation's own definition, in Article 4(1), explicitly names an “online identifier” as an example of personal data, and an IP address is exactly that. The same applies to the cookies and click IDs that influencer tracking itself runs on — see how influencer tracking actually works for the mechanics behind the cookie and IP address that Make Influence itself retains for up to 30 days and 3 months respectively after a click.

Who is the controller, and who is the processor?

Denmark's data protection authority, Datatilsynet, puts it this way: the controller decides why (for what purpose) and how (by what means) personal data is processed. A processor processes personal data on the controller's behalf — that is, on the controller's documented instructions — and may not use the data for its own purposes. What matters, per Datatilsynet, is always what is actually agreed and actually happens, not what the parties call each other.

If it's unclear, Datatilsynet points to three things: whether the arrangement actually concerns processing personal data (not just an ordinary service contract), whether the other party acts solely on instruction, and whether both parties can independently use the data for their own purposes — in which case you're unlikely to be in a processor relationship, and more likely joint controllers instead.

Choosing a lawful basis (Article 6)

GDPR requires a lawful basis for any processing of personal data. In practice, three of the six bases in Article 6(1) come up repeatedly in an influencer collaboration:

Worth noting: the tracking link itself — the cookie or click ID the commission calculation depends on — isn't automatically covered just because you have an Article 6 basis. Cookies and similar technologies are governed by a separate consent rule that, in Denmark, sits outside Datatilsynet's own remit and falls under the marketing and cookie rules overseen by the Danish Agency for Digitalisation (Digitaliseringsstyrelsen). In practice you typically need to satisfy two separate rulebooks when a tracking link involves a cookie: the GDPR basis for processing the click data itself, and cookie consent for setting the cookie in the browser in the first place.

The data processing agreement (Article 28)

If the brand uses a platform or tool that processes personal data on its behalf — for tracking, fee payouts or campaign management, for example — Article 28 requires a written data processing agreement (DPA), not just an ordinary vendor contract. The agreement has to fix, among other things:

• The subject-matter, duration, nature and purpose of the processing, and which types of personal data and data subjects it covers
• That the processor may only process data on the brand's documented instructions
• Confidentiality among staff with access to the data
• Appropriate security measures per Article 32
• That the processor must assist the brand in responding to data subject requests (e.g. an influencer asking to see their own data)
• Deletion or return of data once the engagement ends
• That any sub-processor takes on the same obligations in writing

The DPA is a separate legal document — it doesn't replace the collaboration contract with the influencer itself; see what to put in an influencer contract for the 12 terms that contract needs to cover on its own.

Transferring data to the US and other countries outside the EU/EEA

Many of the tools an influencer campaign relies on — tracking platforms, analytics tools, communication tools — are US companies. Since the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework on 10 July 2023, personal data can be transferred to US companies certified under the framework without additional safeguards such as Standard Contractual Clauses (SCCs). If a vendor isn't certified under the framework, the transfer needs to rest on SCCs or another valid transfer mechanism instead. Always check whether a US platform or tool is actually certified before putting personal data into it.

Campaigns aimed at children

GDPR's Article 8 sets 16 as the default age at which a young person can independently consent to an information society service — but member states may lower it, not below 13. According to comparative overviews of how member states have implemented this, Denmark has set the age at 13. Legislation is amended over time, so check the current Danish data protection act if this is decisive for your campaign. If a collaboration targets a younger audience — or the influencer's own following skews heavily under 13 — be especially careful about collecting data directly from children (e.g. via a competition) without parental consent.

A practical checklist before an influencer campaign goes live

• Map exactly which personal data the campaign actually collects — addresses, payment details, tracking data, competition entrants
• Fix a lawful basis for each individual use, not one general basis for the whole campaign
• Work out whether a platform or tool used in the campaign is a processor — and whether a valid data processing agreement is in place
• Check whether a US tool is certified under the EU-U.S. Data Privacy Framework, or whether SCCs are needed
• Set a retention period for each type of data, and don't keep it longer than the purpose requires
• Specifically assess whether the campaign reaches an audience under 13

Worked example: what a breach could theoretically cost (hypothetical)

The figures below are a made-up worked example to illustrate how the fine structure works — not a real case, and not a prediction of what any specific breach would cost.

GDPR's Article 83 sets two tiers of fines. The lower tier (Article 83(4)) goes up to EUR 10 million or 2% of annual global turnover, whichever is higher. The higher tier (Article 83(5)) — for breaches of the basic processing principles and data subjects' rights — goes up to EUR 20 million or 4% of annual global turnover, whichever is higher.

Take a hypothetical Danish brand with DKK 750 million (roughly EUR 100 million) in annual global turnover that commits a higher-tier breach. 4% of that turnover is DKK 30 million. But because the fixed cap of EUR 20 million (roughly DKK 149 million) is higher than DKK 30 million, the statutory ceiling that technically applies is DKK 149 million — not DKK 30 million — because the law uses whichever figure is higher. In practice, a supervisory authority never reaches the statutory ceiling for a first, quickly corrected mistake: Article 83(2) requires it to weigh eleven specific factors, including the gravity and duration of the breach, whether it was intentional or negligent, what steps the brand took to mitigate the harm, and whether the brand reported it voluntarily.

Common mistakes

• Assuming correct ad disclosure also covers GDPR. They're two entirely different rulebooks with different requirements and different regulators.
• Assuming the influencer is automatically a processor. In most collaborations, the influencer is an independent actor for their own content — not a processor for the brand.
• Forgetting that an IP address is personal data. Tracking data often gets treated as if it were anonymous when it isn't.
• Using a US tool without checking the transfer basis. A subscription doesn't automatically resolve the question of a lawful basis for the data transfer.

Make Influence's operational perspective

In our experience, GDPR gets overlooked in influencer campaigns most often because it doesn't feel like “real” data processing — it's “just” a shipping address for a gifted product, or a tracking link. But that's exactly the kind of processing the law covers. Our own approach to tracking — a cookie retained for up to 30 days and an IP address for up to 3 months — is a deliberate choice to hold as little as possible, for only as long as it takes to attribute a sale to the right creator, and no longer.

FAQ

Do we need a data processing agreement with the influencer we're working with?

Usually not. The influencer typically creates their own content and runs their own account — they don't act on the brand's instructions in the GDPR sense. A data processing agreement is usually relevant with platforms and tools, not with the influencer themselves. The exception is if the influencer collects data on the brand's behalf, for example a list of competition entrants they then hand over — in that case, assess the role split on its actual facts.

Can we use an influencer's follower count and demographic data without consent?

Aggregated, non-identifiable figures — like a platform's own demographic insights — generally aren't personal data and fall outside GDPR. See how to verify an influencer's audience before you pay for what data is actually available.

How long can we keep tracking data about a click?

There's no fixed statutory limit — retention has to be proportionate to the purpose (data minimisation and storage limitation). Make Influence's own model retains the cookie for up to 30 days and the IP address for up to 3 months after a click — see how influencer tracking actually works.

Do we need cookie consent banners because of an influencer tracking link?

Yes, if the link sets a cookie or similar technology for anything beyond what's strictly necessary. That's a separate cookie-consent rule — not GDPR Article 6 itself — and in Denmark it falls under the rules overseen by the Danish Agency for Digitalisation. See Consent Mode and influencer tracking in the EU for what that consent actually has to satisfy, and what happens to your tracking data when it's declined.

Does GDPR still apply when we pay an influencer abroad?

Yes — GDPR applies to personal data about anyone, regardless of nationality, as long as the processing happens within the EU/EEA or is directed at EU/EEA residents. See how to pay international influencers for currency, invoicing and tax — a separate question from the data protection of the payment details themselves.