Customer Data Platforms
Customer Data Platforms unify data across touchpoints, enabling personalization but creating significant privacy obligations. CDPs are both a compliance tool and a compliance risk depending on implementation.
By Sergio Maldonado Elvira, Attorney, State Bar of California · FIP, CIPP/US, CIPP/E, CIPT
Published · Last reviewed
Key points
- →Establish lawful basis for data unification
- →Manage consent across data sources
- →Enable privacy rights fulfillment
- →Vet CDP vendors for compliance
CDP role in privacy compliance
A well-configured CDP can support privacy compliance by: centralizing consent management across channels, enabling efficient data subject request fulfillment, maintaining data lineage and purpose documentation, and enforcing retention policies. However, the same data unification that enables personalization can amplify privacy risks through expanded profiling capabilities.
Lawful basis for data unification
Under GDPR, unifying data from multiple sources requires lawful basis for each use. Consent given for email marketing doesn't automatically extend to combining that data with app behavior for profiling. Document the lawful basis for each data combination and purpose. CCPA similarly requires disclosure of cross-context behavioral advertising and opt-out mechanisms.
Consent management integration
CDPs should integrate with consent management platforms to respect user preferences across all activation channels. Key requirements: sync consent signals in real-time, prevent activation of data where consent was withdrawn, maintain consent records with timestamps and scope, and ensure downstream systems respect consent limitations. Test consent flows thoroughly.
Vendor due diligence
CDP vendors become data processors requiring proper DPAs. Evaluate: where data is stored and processed, subprocessor lists and change notification, security certifications and audit reports, data portability and deletion capabilities, and contractual commitments on data use. Your CDP vendor's compliance posture directly affects your own.
Related reading
This guide is general information, not legal advice. Reading it does not create an attorney-client relationship. The law is stated as of January 28, 2026.
Got questions?
Every business is different. Let's discuss how these principles apply to your specific situation.
Book a call