Marketing Strategies to Thrive in a GDPR World

Level 6 - Champion Alumni
Level 6 - Champion Alumni

This post is part 2 of a 5-part series on GDPR readiness. In this previous post, I compared GDPR preparedness to a football game and the importance of both a solid offense and defense to win the game. To tackle the processing requirements of GDPR compliance, your defensive strategy involves operational adjustments and a well-documented game plan. Now, it’s time to turn our focus to the offense and strategies to help your marketing practices thrive in a GDPR world.

Many Marketo clients are asking questions about using marketing automation and lead scoring features given GDPR’s strict permission-based requirements to collect and store personal data. My answer is marketing operations and GDPR can coexist, with adjustments to our current methods. I believe GDPR will force us to improve our core marketing skills, and our GDPR playbook should include leveraging the benefits of our offering and easing customer anxiety associated with data collection.

Consent for Data Collection

Scenario: You are offering a free white paper or informational guide and you are collecting the customer’s name, email address, and phone number as a prerequisite to downloading. Behind the scenes, you are appending additional data to the record, including income and location as well as tracking online browsing behavior to score the lead.

Challenge: Under GDPR, brands must now have an individual’s consent before you may track and store personal data. Opt-out or implied consent forms do not comply with GDPR; further, you must also declare how you will use the data and for how long, including if you are appending information or scoring based on it. Therefore, the challenge is being GDPR compliant without introducing too much friction or anxiety with your form.

GDPR adjustment: Strengthen your landing page value proposition and incentive to increase customer motivation. Also add an unchecked opt-in checkbox to the bottom of your data collection form, including a link to your privacy policy. (Note: privacy policies must now be much more robust in detailing data usage.)

To implement: On a recent internet search, I found one suggestion to use this copy in your data collection form:

We’re collecting your name, phone number and email address so that we may follow-up with you further on this topic and provide additional assistance. We may also match profiling data from a third party with your registration information, to learn more about you and measure your product interests. Please check our privacy policy (insert link here) for details on how your information will be protected and managed.” (followed by a checkbox providing consent to collect this information)

This solution appears to be GDPR compliant and covers your bases…but it is lengthy and may “weigh down” your form and we may have also unnecessarily opened the door on customer anxiety. According to The Chartered Institute of Marketing, (September 2016), 57% of Europeans do not trust brands to use their data responsibly. Highlighting their concern will only increase apprehension. Thus, adding this verbiage to your form could reduce your conversion rate.

A common misconception, GDPR doesn’t mandate declaring everything on your form. You can state how you will use data, (including information to be appended and lead scoring practices) in your privacy policy—just don’t forget (or it will cost you big!)

A sample of a GDPR-compliant privacy policy regarding the opt-in checkbox on a form reads like this:

“The information set out in this form is registered in an electronic database for the purpose of [commercial prospection, HR…]. This information is intended to be communicated to [internal service of the company, commercial partners…] and retained for [the relationship, xxx months…]. In accordance with the applicable regulation, your rights to access and update your data, withdraw your consent or lodge complaint where applicable can be exercised by following this link [contact of the service, person or authority in charge…]

Just keep in mind a couple of things with your opt-in checkbox:

  • The opt-in checkbox cannot be a required field. Consent is an independent action from the marketing form action. In other words, if the form in question promotes a white paper, the user can download the white paper without opting in to further communication.

  • Consent language should make it clear that the checkbox is not needed to submit the form. (IE “Want MORE on this topic?) and should definitely link to your privacy policy. To step up your game, add a little note at the bottom of the form reminding them they can download your white paper without it.

Moving legal language to your privacy policy would enable you to use shorter, simpler, GDPR compliant copy on your form:

<Unchecked checkbox> “I’d like to receive more information on this topic, and understand and agree to the privacy policy. <insert link here>”

Short, sweet, to the point…on with the conversion. And the next example.

Cookie Tracking

Scenario: You are using reverse IP lookup and cookies (AKA Munchkin Code) on your site to identify repeat visitors and customize the user’s experience.

GDPR challenge: You must have consent to track visitor behavior. “By using this site, you agree to cookies” messages implying approval upon closure do not meet GDPR compliance. This is a departure from Do Not Track legislation.

GDPR adjustment: Use a banner across the top of your website notifying first-time users of cookie usage, capturing user consent. Then work with your developer to load Munchkin code with the proper settings.

To implement:

Read the full post and view examples of these solutions on the Perkuto Blog.

Level 10 - Champion Alumni

One of the exceptions where you won't delete the lead record is when someone submits a contact-us form, which results in an MQL/potential opportunity (but doesn't opt-in).  I think this would fall within the "legitimate interest" bucket of GDPR.

Level 6 - Champion Alumni

I love seeing all this agreement! I agree with both of your comments on legitimate interest and reporting. I get depressed whenever I think about reporting.

Hi Dan,

I think I would propose my customer to anonymize the records rather than deleting them. If the person is not a CRM contact (supposedly followed up by sales), I would run a smart campaign that replaces the first name, last name and email address with some "anonymous" words. The GDPR perfectly tolerates keeping anonymous data. One limitation is that you cannot delete the cookies in the database, so the person can still be recognized on your side if they have opted-in for cookies. But the ePrivacy will make things simpler on the cookie side.


Level 10 - Champion Alumni

Hi Greg. Interesting. But GDPR considers many additional fields that are contained in the lead record as “personal data”; and also in the activity log (e.g., CDV “real name” to “anonymized name”).  I like the way you’re thinking, though, to allow for some level of reporting of this data.

Hi again Dan,

We can anonymize almost any field we want in fact. The issue remains with Marketo system maintained fields (e.g. IP address) that we can set with a DVC, and the CDV activities, I concur.


Vote here :

Level 10 - Champion Alumni

This is a great idea. So much so, I would create a new discussion topic that promotes it and provides more visibility here in the community (and hopefully with with PMs).

The new data retention policy will solve partitally the issue with regards to DVC, since these will be erased after 90 days....

Level 3

Hi Michelle. I very much enjoyed your comments and insight into GDPR. However I do not agree that consent cannot be required in order to download a whitepaper, register for a webinar, etc. If your comment refers to Article 7,

  • When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

then I argue that it is a misinterpretation of that article, which specifically addresses contracts. Neither downloading content nor registering for an event constitutes entering into a contract, or the provision of a service under contract, and so does not fall under this article. Requiring explcit consent in order to download content is not a bribe but a condition.

If you are referring to another article within GDPR, I would be interested in learning which one it is.

Level 6 - Champion Alumni

Interesting perspective. I am basing this on our legal counsel. There are a lot of gray areas with widely varying interpretation. The advice we have been given from our legal team tends to be more conservative, which I am personally more comfortable with until we see how GDPR will be enforced.