---
title: "Gibraltar — AdTech & Commercial Privacy | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/gibraltar/adtech-and-commercial-privacy/
source_html: /jurisdictions/gibraltar/adtech-and-commercial-privacy/index.html
description: "Gibraltar — AdTech & Commercial Privacy (Amber, 6 sub-modules, 2 claims): Direct marketing sub-module is well evidenced; most other sub-modules rely on inferred alignment with EU ePrivacy norms rather than confirmed Gibraltar-specific sourc"
generated_at: 2026-10-25T04:46:50Z
content_sha256: fafd2eec45132a8b4a6c0e0ca36be2b184576031c16a94dd85d455a0a800e0c9
generator: "fe-fleet/md-twin@1.0"
---
# Gibraltar — AdTech & Commercial Privacy | Data Protection Monitor

### D7AdTech & Commercial Privacy6 sub-modules2 claimsAmber▾#

Direct marketing sub-module is well evidenced; most other sub-modules rely on inferred alignment with EU ePrivacy norms rather than confirmed Gibraltar-specific sources.

Primary framework Communications (Personal Data and Privacy) Regulations 2006

Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection)

Traffic-light rationale — Amber Direct marketing sub-module is well evidenced; most other sub-modules rely on inferred alignment with EU ePrivacy norms rather than confirmed Gibraltar-specific sources.

#### Sub-modules (6)

Category narrative 278 words

Electronic marketing, cookies, and online tracking in Gibraltar are governed by the Communications (Personal Data and Privacy) Regulations 2006 (CPDPR 2006, LN 2006/126) read alongside the Gibraltar GDPR. Under Reg. 6 CPDPR 2006, storing information or gaining access to information stored in the terminal equipment of a subscriber or user (cookies, SDKs, tracking pixels, device fingerprinting) is permitted only where the user has been provided with clear and comprehensive information about the purposes of the storage/access and given consent (to the Gibraltar GDPR Art. 4(11) / Art. 7 affirmative opt-in standard), except for technical storage/access for the sole purpose of carrying out the transmission of a communication or where strictly necessary to provide an information society service explicitly requested by the user. Note that the UK's DUAA 2025 Schedule 12 analytics/preference cookie exemptions do NOT apply in Gibraltar: non-essential analytics and advertising cookies continue to require prior opt-in consent. Direct marketing by electronic mail (email, SMS, push/in-app messages) to individual subscribers requires prior opt-in consent under Reg. 23 CPDPR 2006 unless the commercial 'soft opt-in' under Reg. 23(3) applies (contact details obtained in the course of a sale or negotiations for the sale of a product or service, marketing the controller's own similar products/services, with a free opt-out offered at collection and in every subsequent communication). Unsolicited automated calling systems require prior opt-in (Reg. 20), and live unsolicited marketing calls must respect subscriber opt-out objections and directory preference markings (Reg. 22). Every marketing communication must identify the sender and provide a valid opt-out address (Reg. 24), and Art. 21(2)–(3) Gibraltar GDPR confers an absolute right to object to direct marketing and profiling for direct marketing at any time.

Evidence 2

Sources and claims (2)
- Confirmedunavailable — Under Reg. 6 and Reg. 23 of the Communications (Personal Data and Privacy) Regulations 2006 (LN 2006/126), non-essential cookies and electronic mail marketing to individual subscribers require prior Gibraltar GDPR-standard opt-in consent unless the Reg. 23(3) existing-customer soft opt-in applies.
- Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/notes/gibraltar-smsmms-marketing) — The Communications (Personal Data and Privacy) Regulations 2006 impose consent requirements applicable to SMS/MMS marketing in Gibraltar, operating alongside the Gibraltar GDPR and Data Protection Act 2004.observed 2026-08-05