Algorithmic Personalization in Digital Marketing and Personal Data Protection: Legal Limits of Consent, Profiling, and Targeted Advertising

Abstract

This article examines the legal boundaries of algorithmic personalization in digital marketing within the framework of the European Union's General Data Protection Regulation (GDPR), the ePrivacy Directive, and emerging regulatory instruments such as the Digital Services Act (DSA) and the Artificial Intelligence Act (AI Act). Through a doctrinal and comparative legal methodology, the study critically analyzes three interconnected regulatory dimensions: the validity and effectiveness of consent as a legal basis for data-driven advertising; the legal constraints governing profiling and automated decision-making under Articles 4(4) and 22 GDPR; and the normative limits of targeted advertising in the context of fundamental rights to privacy and data protection. Drawing on regulatory guidance from the European Data Protection Board (EDPB), the Article 29 Working Party, and relevant case law from the Court of Justice of the European Union (CJEU), the analysis reveals that the consent-based model suffers from structural deficiencies, including information asymmetry, consent fatigue, and the commodification of personal data. Profiling, while defined and regulated, remains insufficiently constrained due to ambiguities in the scope of solely automated decisions and the lack of robust explainability requirements. The article proposes a rights-based regulatory framework that moves beyond the notice-and-consent paradigm toward substantive protections incorporating purpose limitation, data minimization, algorithmic transparency, and meaningful human oversight. The findings contribute to the ongoing scholarly and policy debate on reconciling innovation in digital marketing with the protection of individuals' fundamental rights in the data-driven economy.