WTF is a GDPR?

In the event that you like to ignore your emails (hi—come sit by me) and/or GDPR, short for General Data Protection Regulation, hasn’t blipped your radar yet, there are plenty of articles to get you up to speed. A few we found to be most helpful are listed below. 

For the policy and business-minded, you can read this one.

For those who prefer to speak human, there’s this one.

And for those of you who like to get your news straight from the data gobbling horse mouth, Facebook posted a blog about it. 

As many of these articles mention, this is an EU law which technically doesn’t apply here in the US, though some companies will have to make the shift if their subscription or user lists contain EU-based email addresses/data. Other organizations will go ahead and comply based on transparency commitments, in anticipation of US law following suit or simply to cover their asses. Cue the flood of privacy emails and feelings of mild surprise that you were on that many lists to begin with.

If you’re a US-based company with no EU subscribers, there’s no reason to let this keep you up at night. However, in an industry that is relying more and more on user data for things like ad targeting, following digital snail trails and trying new and exciting ways to convince people to give you their email addresses—totally unrelated, anyone want a free t-shirt—it is something we as professional communicators need to start thinking about. 

The most superficial impacts of this are copy and design driven. You’re now having to include extra steps and extra reading in your initial subscription and user outreach, creating additional (admittedly low) barriers for an audience whose attention span and patience in digital experiences is waning rapidly. Some speculate users have become so accustomed to “passive consent” templates, that doubling down on requiring them to affirm their consent for communication is tantamount to requiring them to learn a new behavior— though Facebook seems to be handling it  just fine. 

Others argue that while it might be a lot of extra information, explicit confirmation is only going to take the form of (larger) fine print. And as this piece  points out, the print doesn’t always come neatly wrapped in a privacy update email and people might not even read it anyway. 

Moving past the surface issues of “sounds pretty looks pretty,” GDPR-compliant customer/target audience engagement becomes more complicated. Normal practices like adding someone to an email list after receiving their business card, certain types of marketing content partnerships or requesting and retaining a user zip code to show nearby locations may no longer be legal options without appropriate, lengthy consent documentation or data protections.

It’s a possibility that we need to be thinking critically about—not just because there’s a potential that a similar law could be passed here, but from an authenticity and growth standpoint for the brands and campaigns we manage. Measurement is important, and data is an easy tool to use—sometimes to the point of being lazy. For example, you have an email subscription list of 2,500 email addresses. Great. But how many of those people actually want to be there? How many of those people are actually reading the monthly newsletter you’re putting out? How much does that newsletter matter to you? Are you only sending it because you feel you have to send it?

Lax data laws make superficial contact easy. But real contact, real engagement, is so much more than a monthly email. To really move the needle, it requires more footwork and creative thinking than a monthly email. There’s going to be a lot of huffing and puffing by companies over the next few months, scrambling to find work-arounds or just-under-the-radar ways to stick to what’s worked in the past. But we should see this as more than just an inconvenience. Maybe this is a chance to move beyond a model that’s stayed static for far too long, and grow into something new.