Influencer marketing and GDPR: planning proportionate tracking

An influencer campaign may process personal data: contact details, click identifiers or information linked to an order. Before publication, describe the data used and where it goes. Installing a tool alone does not make the journey compliant.

Map data and responsibilities

Identify who determines processing purposes and means, who acts on another party’s behalf and who receives data. Roles must be assessed for each processing activity, not simply from labels such as “brand”, “creator” or “platform”.

Where a processor relationship exists, it must be governed by the applicable Article 28 requirements. The CNIL explains how to identify these roles (French). Opening a WeeGlad account does not determine that assessment.

Define the purpose and legal basis

Separate attribution, billing, fraud prevention and prospecting. Each purpose needs an appropriate legal basis; consent is not the only possible basis. Performing a contract does not automatically justify every marketing activity.

Collect only necessary data and limit its use to defined purposes. These principles appear in GDPR Chapter II (French). Avoid sending contact details or sensitive information in campaign links or free-text fields without justified necessity.

Check cookies and other trackers

In France, reading or writing information on a user’s device is also subject to tracker rules. Exemptions are limited. Audience measurement can qualify under strict conditions; advertising attribution is not automatically exempt. The CNIL FAQ (French) explains these distinctions.

Where consent is required, plan collection before the relevant activation and check refusal, withdrawal and evidence of the choice. Do not treat a pixel loading as proof of valid consent. Test behaviour with your consent manager and integration.

Do not confuse pseudonymisation with anonymity

A technical identifier or a name replaced by a code does not necessarily make data anonymous. Pseudonymised data that permits reidentification remains personal data, as the European Data Protection Board security guide (French) explains.

Moving processing to a server does not remove personal data obligations. Check what is collected, possible links with other data and recipients. The absence of third-party cookies alone does not establish anonymity.

Inform people and organise their rights

Provide clear information on the responsible actor, purposes, legal basis, recipients and retention. Explain applicable rights and the contact for exercising them. The GDPR provisions on individual rights (French) detail these requirements, to be adapted to the processing.

Also document access and incident responsibilities. Sharing an evaluation with a creator does not require sharing your entire customer database.

Set appropriate retention

There is no universal thirteen-month retention period for every conversion. Set periods according to purposes and applicable obligations, then implement appropriate deletion or archiving. The CNIL retention guide (French PDF) helps justify those choices.

Prepare the WeeGlad integration

Read the privacy policy (French) and cookie policy (French). Describe your own journey, check necessary information and permissions, then test conversion tracking.

This guide provides preparation points; it certifies neither your configuration nor all WeeGlad processing. Each campaign needs assessment against its actual data, actors and uses.