Originally published on ANA.net
In March 2018, I witnessed the high-water mark of Big Tech's data mismanagement from the inside. I was an industry manager at Facebook for the CPG vertical when the Cambridge Analytica story broke. Fifty million users' had their data collected without meaningful, informed consent and stealthily repurposed for political targeting.
This flippant misuse of data didn't just damage Facebook's reputation. It didn't just wipe more than $100 billion off Facebook's market cap. It marked the end of an era.
Two months later, the GDPR took effect, and the relationships between consumers, brands, and the data that connects them would never be the same. Today, nearly €6 billion GDPR fines have been handed out. In the US, businesses have 21 different state data privacy laws to contend with—and in the first few months of 2026 alone, state Attorneys General and regulators have issued more than $4 million in fines.
And yet, nearly 10 years on from data mismanagement's high-water mark, I still encounter marketing leaders who treat data privacy as someone else's problem—a legal checkbox, a compliance burden, or at worst, an obstacle to work around. That's a mistake. More than that, it's a missed opportunity.
For marketing leaders, data privacy isn't a constraint on effective strategy—it is effective strategy.
The regulatory environment isn't stabilizing. Eight new US data privacy laws went into effect in 2025 alone and the U.S. state-by-state patchwork continues to grow—most recently with the passage of Oklahoma's and Alabama's data privacy laws. Globally, GDPR enforcement shows no signs of letting up, with regulators increasingly targeting ad-tech, behavioral targeting, profiling, and the marketing data practices that sit at the heart of modern demand generation.
Privacy enforcement isn't abstract, and regulators are naming marketing technologies and practices specifically. Ford and Honda, were penalized for failures to honor "Do Not Sell" opt-outs and for transferring consumer data for targeted advertising purposes. Sephora became the first company sanctioned under the CCPA, also for violations tied to its data sharing with advertising partners.
Looking ahead, the enforcement trends most likely to affect marketing teams in 2026 center squarely on consent practices—how companies obtain it, whether they honor it, and whether their consent infrastructure holds up to scrutiny. And it's not just regulators watching. Consumers are, too.
The idea that everyday people don't care about privacy is a myth. When California launched its new DELETE Act opt-out mechanism, 217,000 residents registered in the first month alone—a powerful signal of just how much consumer awareness has grown.
The fines from recent enforcement actions aren't anything to sneeze at—even in the US, they regularly reach seven figures—but fines are recoverable. Less recoverable and more valuable: trust.
Consumer trust and data privacy have grown increasingly entwined. That makes privacy a brand strategy.
Research shows that 60 percent of consumers are willing to spend more with brands they trust to protect their data. Google has found that a positive privacy experience can increase brand preference share by as much as 49 percent. These aren't trends compliance teams are tracking, but CMOs and revenue leadership should be.
When consumers consent to tracking, personalization, and data usage for marketing purposes, and/or marketing communications, that is in and of itself an important signal. Bizarrely, it's an intent signal that many marketers seem to ignore at best or actively avoid at worst.
Google may have reversed its phase-out of third-party cookies, but the structural shift away from third-party tracking technologies is real and ongoing. Safari and Firefox haven't reversed course. iOS App Tracking Transparency has fundamentally changed mobile attribution. Once California's Opt Me Out Act kicks in in 2027, more and more consumers will set and forget their default "no" to third-party data transfers. In this environment, marketers who have already built first-party and zero-party data strategies are ahead of the game.
Zero-party data, or data a brand's audience directly gives through email sign-ups, preference centers, loyalty programs, and the like, carries less legal risk and reflects genuine intent. That combination is increasingly rare and increasingly valuable. And first-party data, or data that companies collect from their audience with systems they own, gives data teams can use for personalization and segmentation.
If a brand's audience then consents to external transfers for, e.g., targeted advertising, great; but a first- and zero-party data strategy avoids the automatic transfers inherent to third-party data strategies. Nobody likes having decisions made for them. Investing in data privacy is all about giving choice and control back to consumers.
There is a right way—and a wrong way—to give consumers these controls, though. Most marketing teams scrutinize every element of the digital customer experience—UX, load times, personalization—except the consent experience. That blind spot is costly, as research shows that 56 percent of website visitors ignore opt-in cookie banners.
There's a meaningful difference between consent flows designed to confuse or exhaust users into opting in and ones that are transparent, simple, and build genuine trust. The former invites regulatory scrutiny and produces unreliable data. The latter produces an audience that wants to be marketed to.
I've found that, for the most part, I don't need to do all that much persuading to convince marketers that data privacy matters and can be a good thing. The barrier isn't unwillingness to invest in data privacy; it's not knowing how.
It's easier to get started than it may seem, but teams also must be in it for the long haul. Once that mindset is embraced, there are three first steps to take that will help teams off to a great start:
Audit the company's data collection and consent flows. Understand what the company is collecting, on what legal basis, and whether its consent mechanisms would survive regulatory scrutiny. Map the brand's martech stack against its privacy policy—the gaps found will be instructive. Partner with legal and compliance teams on this; it's their domain too.
I often think about what I saw at Facebook in 2018, and how intimately connected data and trust are, how fragile trust is, and how long it takes to win it back. In Facebook's case, it's arguable whether they ever regained the trust they lost following Cambridge Analytica.
The Cambridge Analytica story wasn't just a crisis for one company. It was a preview of a new relationship between brands and the people they serve: one where consumers expect more, regulators demand more, and the price of indifference costs more.
Data privacy's moment isn't a threat to marketing effectiveness. It's a forcing function toward better marketing—more honest, more durable, and ultimately more effective. The regulations aren't going away. Consumer expectations aren't retreating.
Marketing leaders who lean into privacy now will find themselves with something invaluable: an audience that wants to hear from them.