Microsoft Advertising (Bing) GDPR Compliance Guide
Microsoft Advertising inherits most of Google's editorial and claim rules, but the consent architecture around the UET tag and Customer Match is its own. This guide covers what GDPR requires of your Microsoft campaigns, with the focus on ad copy.
Updated 13 August 2026
Microsoft Advertising is often run as a copy-paste import from Google Ads, which is exactly where the compliance risk starts: the copy is reviewed again under Microsoft's own policies, and the tracking runs on a different tag with a different consent signal. In the EU, the Universal Event Tracking (UET) tag places identifiers on the user's device, so it falls under the ePrivacy Directive's consent rule before GDPR is even reached. This guide covers the obligations that apply to Microsoft campaigns specifically, and the copy patterns that get them disapproved.
UET tag consent and Consent Mode (ePrivacy Art. 5(3))
The UET tag stores and reads identifiers on the user's terminal equipment, which requires prior consent under Art. 5(3) of the ePrivacy Directive in every EU member state. Microsoft supports a consent signal (analogous to Google's Consent Mode) that must be wired to your CMP so that no tag fires before an affirmative choice. If your CMP blocks Google's tag but leaves UET firing on page load, that is a common and easily detected gap. It also creates a copy problem: remarketing copy written for an audience you were not lawfully permitted to build cannot be salvaged by a rewrite.
Customer Match and audience uploads (Art. 6 and Art. 14)
Uploading a customer list to Microsoft is a disclosure of personal data to a new recipient. You need a lawful basis for the disclosure and a transparency notice that names the category of recipient. Consent obtained for a newsletter does not automatically extend to advertising audiences. Practically: check that your privacy notice describes advertising-platform sharing, and that your copy for these audiences does not imply a level of personal knowledge that the audience definition does not support.
Claim rules carried over from Google campaigns (UCPD)
Imported campaigns bring imported claims. Superlatives, guaranteed outcomes, and countdown urgency all breach the Unfair Commercial Practices Directive regardless of which platform serves them, and Microsoft applies its own misleading-content policy on top. If a claim was rewritten to clear a Google disapproval, mirror the rewrite in Microsoft rather than leaving the original version live in a second account.
Sensitive categories and inference in ad copy (Art. 9)
Microsoft restricts targeting on sensitive categories, but Art. 9 is triggered by inference, not only by targeting. Copy addressed to people with a health condition, a religious affiliation, or a financial hardship infers special-category data about the audience it reaches. The safe pattern is to describe the product rather than the reader: 'a budgeting app for irregular income' rather than 'struggling with debt?'.
Common violations to avoid
- UET tag firing before consent — tracking loaded on page load while the CMP only gates Google tags
- Audience upload without a matching transparency notice naming advertising platforms as recipients
- Imported claims — guaranteed-result or superlative copy carried over unchanged from a Google campaign
- Health or hardship inference — copy addressed to people with a condition or financial difficulty
- Countdown urgency the landing page does not honour, breaching UCPD Annex I
Get the GDPR Ad Copy Checklist
12 pre-launch compliance checks for EU campaigns. Free, instant delivery.
No spam. Unsubscribe any time.
Frequently asked questions
Does Microsoft handle GDPR consent for me?
No. Microsoft acts as a controller for its own platform data, but you remain the controller for the consent collected on your site and for the data you upload. The UET tag consent gate is your responsibility, implemented through your CMP.
Can I import Google Ads campaigns directly into Microsoft?
Technically yes, and most advertisers do. Legally, the import copies every claim and disclosure gap along with the campaign structure. Review imported copy before it goes live rather than after a disapproval, and re-apply any fix you made in Google.
Is Bing ad review stricter or looser than Google?
The policies are broadly aligned, but review outcomes differ in practice, and an ad approved by one platform is regularly disapproved by the other. Neither approval is evidence of legal compliance in the EU.
How do I check my Microsoft ad copy for GDPR risk?
Paste the headline, description, and any consent or lead-form copy into Legalify's free GDPR Ad Copy Checker. It flags article-level GDPR risk and misleading-claim exposure and returns compliant rewrites.
Check your Microsoft Advertising (Bing) ad copy now
Paste your ad copy into the free GDPR Ad Copy Checker and get article-level findings in seconds — no login, no card required.