Since implementation of the GDPR, more and more countries around the world are adopting personal data protection regulations. In the United States, in the absence of regulations at the federal level, many states, including California, Virginia, Colorado, Connecticut, Iowa, Montana, Florida, Texas and Utah, have enacted personal data protection laws to strengthen requirements on how companies are allowed to use consumers’ personal data. These laws incorporate some of the concepts of the GDPR and introduce new confidentiality protections for consumers and restrictions on the use of their personal data. Other US states are in the process of proposing their own draft laws on personal data protection which, if adopted, will continue to complicate the situation with the fragmentation of the legislative landscape. Furthermore, some US states have introduced new laws governing the processing of sensitive data and the majority of the other US states follow this approach.
Many other countries have enacted personal data protection laws, including Brazil, the People’s Republic of China, India, Australia, the United Arab Emirates and Saudi Arabia.
The European Union also introduced new regulations which affect the advertising and marketing industry, with the ambition of turning the European Union into a single digital market and “creating a safer digital environment which protects consumers’ fundamental rights and establishes fair competition conditions for companies.” These are centered around the Digital Market Act (DMA), the Digital Services Act (DSA) and the Data Governance Act (DGA). The DMA aims to regulate the behavior of platforms that have a significant impact on the European market, particularly with regard to competition law. This text contemplates obligations relating to the use of personal data for targeted advertising. The DSA aims to regulate the operation of platforms, regardless of their size, and in particular the content published on the Internet. The DGA aims to increase trust in data sharing, strengthen mechanisms to increase data availability and overcome technical barriers to data reuse. The DMA and DSA entered into force in November 2022 and the DGA entered into force in June 2022.
Artificial Intelligence (AI) is rapidly developing and is commonly used in advertising and other Groupe activities. This development comes with increased attention from regulators. Many countries are implementing AI-specific laws and regulations. At European Union level, the EU Artificial Intelligence Act entered into force in June 2024, with provisions which take effect in stages until 2027. Specific AI laws have also been introduced in Latin America, Asia-Pacific and in several US states.
In addition, the European regulatory environment is characterized by the emergence of regulations in terms of corporate social responsibility (CSR), in particular Directive (EU) 2022/2464 known as the CSRD (Corporate Sustainability Reporting Directive). Its purpose is to improve the transparency and reliability of non-financial information provided by companies.
