Gibraltar: AdTech & Commercial Privacy

Electronic marketing, cookies, and online tracking in Gibraltar are governed by the Communications (Personal Data and Privacy) Regulations 2006 (CPDPR 2006, LN 2006/126) read alongside the Gibraltar GDPR. Under Reg. 6 CPDPR 2006, storing information or gaining access to information stored in the terminal equipment of a subscriber or user (cookies, SDKs, tracking pixels, device fingerprinting) is permitted only where the user has been provided with clear and comprehensive information about the purposes of the storage/access and given consent (to the Gibraltar GDPR Art. 4(11) / Art. 7 affirmative opt-in standard), except for technical storage/access for the sole purpose of carrying out the transmission of a communication or where strictly necessary to provide an information society service explicitly requested by the user. Note that the UK's DUAA 2025 Schedule 12 analytics/preference cookie exemptions do NOT apply in Gibraltar: non-essential analytics and advertising cookies continue to require prior opt-in consent. Direct marketing by electronic mail (email, SMS, push/in-app messages) to individual subscribers requires prior opt-in consent under Reg. 23 CPDPR 2006 unless the commercial 'soft opt-in' under Reg. 23(3) applies (contact details obtained in the course of a sale or negotiations for the sale of a product or service, marketing the controller's own similar products/services, with a free opt-out offered at collection and in every subsequent communication). Unsolicited automated calling systems require prior opt-in (Reg. 20), and live unsolicited marketing calls must respect subscriber opt-out objections and directory preference markings (Reg. 22). Every marketing communication must identify the sender and provide a valid opt-out address (Reg. 24), and Art. 21(2)–(3) Gibraltar GDPR confers an absolute right to object to direct marketing and profiling for direct marketing at any time.