Key points

• Retail media networks combine first-party shopper data with advertising inventory, which places them at the center of GDPR, ePrivacy and US state privacy law.
• In the EU and UK, personalized advertising generally requires consent for storing or accessing information on a device, and a valid legal basis for processing personal data. Legitimate interests will rarely stretch to cover intrusive profiling.
• In the United States, a growing number of state laws give consumers the right to opt out of targeted advertising and the sale or sharing of personal data, and to use universal opt-out signals.
• Clean rooms and data collaboration tools reduce some risks but do not make shared data anonymous for legal purposes.
• Advertising disclosures, sponsored placement labeling and claims about product rankings are also consumer protection issues, and regulators in several jurisdictions have shown interest.

Why retail media creates distinctive legal risk

Retail media networks let a retailer sell advertising to brands using the retailer's own audience and purchase data. The model is attractive because the data is first-party, the audience is close to a purchase decision and measurement can be tied to actual sales. But the same features make it legally sensitive. The retailer is both a merchant and an ad seller, it holds detailed records of what individuals buy, and it often shares audience data or measurement results with advertisers and technology partners.

Each of those relationships raises privacy and consumer questions. Who is the controller of the data? What have shoppers been told? Can they say no? And are sponsored placements clearly identified as advertising?

GDPR and the basis for processing

Under the GDPR, building audience segments from purchase history, loyalty data and browsing behavior is processing of personal data and needs a lawful basis. Consent is the safest basis for targeted advertising, and European regulators have repeatedly said that legitimate interests will be difficult to rely on where profiling is extensive, unexpected or involves sensitive inferences. Purchases can reveal health conditions, religious practices or family circumstances, and the use of special category data for advertising is tightly restricted.

Transparency is another recurring weakness. Privacy notices need to explain in plain language that purchase data is used for advertising, who receives it and how it can be controlled. Retailers should also revisit data protection impact assessments, which are usually required for large-scale profiling.

Where advertisers and the retailer jointly determine the purposes and means of processing, they may be joint controllers, which calls for a clear allocation of responsibilities and a summary of the arrangement available to individuals.

ePrivacy and tracking technologies

In the European Union and the United Kingdom, the rules on storing or accessing information on a user's device are separate from the GDPR. They require consent for cookies, software development kits and similar technologies, except where strictly necessary for a service the user requested. Retail media typically relies on identifiers and measurement tags on websites and in apps, so these rules apply directly.

Regulators have been active on consent interface design. Banners that make it harder to refuse than to accept, pre-ticked options and misleading labels have all attracted enforcement. Companies should test their consent flows as a user would and keep records that demonstrate consent.

United States state privacy laws

The United States has no single federal privacy statute, but a majority of states now have comprehensive consumer privacy laws. Most give residents the right to opt out of targeted advertising, the sale of personal data and profiling, and several require businesses to honor browser-based universal opt-out signals. Sensitive data, which can include certain health and precise location information, generally requires opt-in consent or additional protections, and some states have added limits on processing the data of minors.

State attorneys general and the California privacy regulator have made advertising technology and data sharing a priority. Retailers should check that opt-out links work, that signals are recognized, that vendor contracts contain required terms, and that audience-sharing arrangements are accurately described in privacy notices. The Federal Trade Commission also continues to apply its unfairness and deception authority to data practices, including claims that data is anonymous or aggregated when it is not.

Clean rooms and data collaboration

Data clean rooms are often presented as a privacy-preserving way to match retailer and advertiser data. They can reduce exposure by limiting what each party sees, but they do not by themselves change the legal status of the data. If individuals remain identifiable, even indirectly, the underlying processing remains subject to privacy laws. Contracts should specify permitted queries, output thresholds, retention and audit rights, and governance should include review of the technical configuration.

Consumer protection and advertising standards

Retail media also raises questions that sit outside privacy law. Sponsored product listings must be identifiable as advertising. Claims such as best seller or top rated should be accurate and based on clear criteria, and if sponsored results influence ranking, shoppers should be able to understand that. Consumer protection regulators in the United States, the United Kingdom and the European Union have all signaled interest in online ranking and advertising transparency, and the UK's recent consumer enforcement reforms increase the stakes of getting these practices wrong.

Competition law is relevant too. Retailers that sell advertising to the same brands that supply their shelves should consider how data and ranking decisions might be viewed by regulators concerned about self-preferencing or supplier leverage.

A practical checklist

Retailers building or scaling retail media should map data flows from collection to advertiser reporting, confirm lawful bases and consent records by jurisdiction, update privacy notices, review vendor and advertiser contracts, label sponsored placements consistently, and set a governance process for new audience products. A short privileged review before launching a major feature is far cheaper than responding to a regulator afterward.

Corvane Ryle's Privacy & Cyber and Consumer Protection teams advise retailers, brands and technology providers on retail media programs in the United States, Europe and Asia.