Marketing Strategies to Thrive in a GDPR World

Level 9 - Champion Alumni
Level 9 - Champion Alumni

This post is part 2 of a 5-part series on GDPR readiness. In this previous post, I compared GDPR preparedness to a football game and the importance of both a solid offense and defense to win the game. To tackle the processing requirements of GDPR compliance, your defensive strategy involves operational adjustments and a well-documented game plan. Now, it’s time to turn our focus to the offense and strategies to help your marketing practices thrive in a GDPR world.

Many Marketo clients are asking questions about using marketing automation and lead scoring features given GDPR’s strict permission-based requirements to collect and store personal data. My answer is marketing operations and GDPR can coexist, with adjustments to our current methods. I believe GDPR will force us to improve our core marketing skills, and our GDPR playbook should include leveraging the benefits of our offering and easing customer anxiety associated with data collection.

Consent for Data Collection

Scenario: You are offering a free white paper or informational guide and you are collecting the customer’s name, email address, and phone number as a prerequisite to downloading. Behind the scenes, you are appending additional data to the record, including income and location as well as tracking online browsing behavior to score the lead.

Challenge: Under GDPR, brands must now have an individual’s consent before you may track and store personal data. Opt-out or implied consent forms do not comply with GDPR; further, you must also declare how you will use the data and for how long, including if you are appending information or scoring based on it. Therefore, the challenge is being GDPR compliant without introducing too much friction or anxiety with your form.

GDPR adjustment: Strengthen your landing page value proposition and incentive to increase customer motivation. Also add an unchecked opt-in checkbox to the bottom of your data collection form, including a link to your privacy policy. (Note: privacy policies must now be much more robust in detailing data usage.)

To implement: On a recent internet search, I found one suggestion to use this copy in your data collection form:

We’re collecting your name, phone number and email address so that we may follow-up with you further on this topic and provide additional assistance. We may also match profiling data from a third party with your registration information, to learn more about you and measure your product interests. Please check our privacy policy (insert link here) for details on how your information will be protected and managed.” (followed by a checkbox providing consent to collect this information)

This solution appears to be GDPR compliant and covers your bases…but it is lengthy and may “weigh down” your form and we may have also unnecessarily opened the door on customer anxiety. According to The Chartered Institute of Marketing, (September 2016), 57% of Europeans do not trust brands to use their data responsibly. Highlighting their concern will only increase apprehension. Thus, adding this verbiage to your form could reduce your conversion rate.

A common misconception, GDPR doesn’t mandate declaring everything on your form. You can state how you will use data, (including information to be appended and lead scoring practices) in your privacy policy—just don’t forget (or it will cost you big!)

A sample of a GDPR-compliant privacy policy regarding the opt-in checkbox on a form reads like this:

“The information set out in this form is registered in an electronic database for the purpose of [commercial prospection, HR…]. This information is intended to be communicated to [internal service of the company, commercial partners…] and retained for [the relationship, xxx months…]. In accordance with the applicable regulation, your rights to access and update your data, withdraw your consent or lodge complaint where applicable can be exercised by following this link [contact of the service, person or authority in charge…]

Just keep in mind a couple of things with your opt-in checkbox:

  • The opt-in checkbox cannot be a required field. Consent is an independent action from the marketing form action. In other words, if the form in question promotes a white paper, the user can download the white paper without opting in to further communication.

  • Consent language should make it clear that the checkbox is not needed to submit the form. (IE “Want MORE on this topic?) and should definitely link to your privacy policy. To step up your game, add a little note at the bottom of the form reminding them they can download your white paper without it.

Moving legal language to your privacy policy would enable you to use shorter, simpler, GDPR compliant copy on your form:

<Unchecked checkbox> “I’d like to receive more information on this topic, and understand and agree to the privacy policy. <insert link here>”

Short, sweet, to the point…on with the conversion. And the next example.

Cookie Tracking

Scenario: You are using reverse IP lookup and cookies (AKA Munchkin Code) on your site to identify repeat visitors and customize the user’s experience.

GDPR challenge: You must have consent to track visitor behavior. “By using this site, you agree to cookies” messages implying approval upon closure do not meet GDPR compliance. This is a departure from Do Not Track legislation.

GDPR adjustment: Use a banner across the top of your website notifying first-time users of cookie usage, capturing user consent. Then work with your developer to load Munchkin code with the proper settings.

To implement:

Read the full post and view examples of these solutions on the Perkuto Blog.

Level 3

Thanks for the reply, Michelle. Our lawyer, on the other hand, argued as I summarized above. Go figure. Since the giving of personal data and the receiving of content with no monetary value is purely voluntary, as is the withholding of such, there is no sense of a bribe even though a condition is applied. I just didn't want everyone to think that requiring an Opt-in in order to receive free content is unequivocally forbidden by GDPR, and did want to point out that there is plenty of room to interpret that it is not. This may be a case of "pick your lawyer" until things play out.

Level 9 - Champion Alumni

Fair enough. If you haven't seen it already, you may also be interested in this thread:

Requests for consent must be freely given, specific, informed and unambiguous by a statement or by a...

Level 10 - Community Moderator

I agree that some interpretations come bizarrely close to "Information wants to be free" from the radical open-source movement.  Strange to hear it echoed in the totally commercial realm, albeit unintentionally.

When you look at the breadth of contract law, there is a contract being entered into when you download copyrighted information, e.g. the agreement to not redistribute a white paper is a contract. The question would then be whether processing personal data is "necessary for the performance of" that contract. I think it is arguable (like you said, pick your lawyer) that you, as the copyright holder, must be allowed to process personal data in order to know who has just agreed to your licensing agreement.

Event registration could also constitute provision of service under a contract (doesn't mean you're bound to let someone attend the event -- wording like "we reserve the right to cancel the event for any reason at any time" is still setting the terms of a contract!). Again here you could argue that processing personal data is necessary for that contract, rather than that there's no contract.

Level 3

Sandford, this is fascinating stuff...but I'm not so sure in a good way. I do know that a skilled lawyer can effectively argue both sides of a case -- until a judge decides. Many of us are struggling with both the spirit and the letter of the regulation, especially the ambiguous portions. Perhaps Martin Luther's often misinterpreted admonition to "Love God and sin boldly" comes close to capturing our approach. We respect and adhere to each article of the regulation to our best ability and understanding until it is clear that we need to adjust. After that, we change and throw ourselves on the mercy of the court....

By the way, here's a telling example of a company requiring explicit consent before allowing a white paper about GDPR to be downloaded: Get the White Paper : Compliance with the GDPR

Level 10

HI Randy,

It's not the lawyer that matters, it's the Judge


Level 10

HI Sanford,

I think the case on the event is slightly stronger than on the white paper, at least on the storage consent.

But you do not need a email consent for this, just a storage one. If you have the person data, in case you need to confirm the registration or warn that the event is postponed, an operational email, covered by the legitimate interest clause will do a perfect job. No consent needed...

It's not the fact that there is an implicit contract with the WP download that really matters. It is whether or not keeping the data or processing it is required for the execution of the contract. An honestly I do not see how to justify that I need to be able to send you any type of email so that you can donwload the white paper...