*This should not be construed as legal advice. These are marketing tips. Consult your legal counsel for official direction about GDPR.

If you’re in the media and publishing industry, then you’ve heard the news: The General Data Protection Regulation (GDPR) that went into effect on May 25, 2018 is a big deal.

It affects all industries, from eCommerce, to finance, to the travel industry and everything in between. And as publishers, you know the drill. You’re veritable data collection agencies, gathering and managing a treasure trove of unique data about your subscribers.

This holding of data is exactly what the GDPR addresses. How, where, when, and why did you come to manage and store this data? It’s a question you now have to have an answer for each and every contact record.

It sounds daunting; however, it’s not impossible. Many are pulling it off and we’ve got three no-brainer ways to tackle GDPR for media and publishing companies.

#1 subscriber acquisition

The core of your business model is subscriptions — email addresses for electronic delivery of content, house addresses for physical delivery, preference of subject matter, time of delivery… the list of information you collect from subscribers goes far beyond the typical name-age-phone-number kind of data other industries gather.

And the very first piece of data on that list — an email address — is one of the cruxes of GDPR implementation rules.

Email messages can only be sent to subscribers who have opted in clearly and explicitly. In other words, you’re not allowed to use shady email marketing subscriber acquisition tactics anymore. We’re talking no-nos for pre-checked boxes on forms or subscribing people just because they’ve entered their email addresses into a contest or promotional message.

What we’d actually suggest is being as up front as possible when asking for an opt-in. Make it clear why you’re collecting their personal information, how you’re going to use it, if any of your partners will have access to it, or if it will be used for retargeting.

For media and publishers, the GDPR implications are clear: For every section of your publication you send a dedicated email message about, you must have a check box. No more subscribing people to every communication because they chose to hear about “News.”

Pro tip: Include a link to your updated privacy policy at the bottom of each form. It can’t hurt to cover your bases. And remember, keep a record of every sign-up and the language the form used at the time. It’s essential in covering your back in the case of a (hopefully unlikely) GDPR suit.

#2 email marketing confirmations

Once someone opts in to receiving email updates from you about whatever topic or topics he or she chooses, you’re first going to send a confirmation email. It’s automated, it contains helpful information, it’s what everyone does.

Under the GDPR, you’re allowed to contact someone in the course of business dealings, so you’ve got the thumbs up to send confirmation emails. However, it’s important to understand that technically, this counts as monitoring your contacts’ behaviors, which is a big topic of GDPR.

To stay in the clear, we suggest letting your subscribers know they’ll be receiving this confirmation email on a thank you page or with a pop-up message once they’ve opted in. Track everything including what the subscriber agreed to receive and what your confirmation email said at the time of opt in.

And remember, just because someone is okay with a confirmation email to receive updates about one communication of your media offerings doesn’t mean you can pop them into all the lists for the other sections. The GDPR states this is a fail.

#3 email retargeting

Unless you’ve been living under a rock, you know what website retargeting is. And those cookies you use to track your website visitors’ behaviors so you can dish them up content tailored to their interests — well, they’re money-makers. After all, it’s been proven that personalized content gets more engagement, and more engagement leads to more conversions.

Say someone spends 15 minutes looking at the sports area of your website and you can show them scores all day long as they browse other sites. Win, right? Traditionally, yes, this is a big plus for media and publishers because it keeps your brand top-of-mind and brings website visitors back for more content.

However, the use of cookies for website retargeting and tracking customer behavior is one of the main topics covered under the new GDPR rules. In fact, this type of tracking for use in ads, email marketing, or any other type of marketing is strictly prohibited as a violation of personal privacy. You may only continue with this type of marketing IF you can gain each and every single website visitors’ explicit consent.

This is where an updated privacy policy is of the utmost importance. Consulting your legal counsel, you should revise your privacy policy with clear and specific language about how you’ll be tracking your website visitors. Serve this new privacy policy up to new visitors as soon as they arrive with a pop-up. And it can’t hurt to add it to your forms, either. Make sure you give people a way to say “yes” or “no” and keep a record of their answers. If the latter is the answer, you must have a documented and automated process to remove the visitor from being tracked.

When it comes to GDPR, email and website retargeting are the most important areas for all marketers — especially those in media and publishing — to give their full attention to. It may be possible to tell if an email address is from the EU, but it’s impossible to tell if a website visitor is.

conclusion: GDPR for media and publishing doesn’t have to be a bear

There’s no doubt it’s scary as a marketer to think about the GDPR and its implications if you’re in the wrong. After all, if you don’t take it seriously, you could wind up like the company in the first ruling for a GDPR violation.

But if you’ve taken the past two years to prepare for this change in GDPR email marketing rules — including following the three no-brainer tips we mentioned here — your processes are airtight. There’s nothing to be worried about.

Our team has worked hard to add GDPR-friendly features to our platform, and our strategy team has helped many marketers develop a strategy and execution plan for making GDPR changes to their email marketing programs. Need help, too? Just reach out.