YouTube Ads GDPR Compliance Guide for EU Advertisers
YouTube's vast audience targeting capabilities create significant GDPR exposure for EU campaigns — especially for health, finance, and lifestyle products. This guide covers the compliance obligations that apply to your video ad copy and scripts.
Updated 25 June 2026
YouTube advertising in the EU is governed by Google's EU User Consent Policy (requiring Consent Mode v2), GDPR, and the UCPD. YouTube-specific risks include the breadth of audience targeting available, the format of video scripts where misleading health or outcome claims are common, and the high visibility of pre-roll and mid-roll ads shown to audiences who have not necessarily consented to personalised advertising. This guide covers what matters for your ad copy and scripts.
Consent Mode v2 and YouTube (Art. 6)
YouTube personalised ads in the EU/EEA require Google Consent Mode v2 to be correctly implemented. When consent is withheld, Google runs ads in a non-personalised mode. Your scripts and copy must not imply personalisation that contradicts the consent status. A pre-roll ad with 'We noticed you've been looking at…' language implies consent-based personalisation that may not have been given.
Health claims in YouTube video scripts (Art. 9, UCPD)
YouTube health, medical, and supplement advertising is subject to both Google's restricted categories policy and GDPR Art. 9. Video scripts commonly include before/after testimonials, outcome guarantees, and condition-specific claims. Under Art. 9, a supplement ad that implies the viewer has a health condition infers sensitive data without explicit consent. Under the UCPD, health outcome claims must be substantiated. Both risks frequently appear in the same script.
Customer Match and remarketing video campaigns (Art. 13/14)
YouTube remarketing uses Google's audience tools — including Customer Match (email lists) and website visitor retargeting (Google Ads pixel). Using these audiences constitutes a transfer to Google as a third party and requires disclosure under Art. 13/14. Video ad scripts for remarketing campaigns must not imply a level of personalisation that exceeds what was disclosed when the original data was collected.
Children's content and COPPA/GDPR-K
YouTube's made-for-kids content is subject to additional restrictions. If your ad could reach children under 16 (the GDPR age of consent in many EU member states), the consent and lawful basis requirements are stricter. Ads shown against children's content must not collect personalised data without appropriate consent, and scripts must not use persuasive techniques that exploit younger audiences.
Common violations to avoid
- Health outcome guarantees in video scripts — 'lose X kg in Y weeks', 'clinically proven' without substantiation
- Condition inference — scripts addressing 'if you suffer from…' language to broad audiences without Art. 9 explicit consent
- Implied personalisation in pre-roll — copy implying prior awareness of the viewer's behaviour beyond what Consent Mode consent covers
- Testimonial accuracy — before/after testimonials that are not representative of typical results (UCPD)
- Urgency and scarcity in end screens — countdown timers or stock claims that are not accurate
- Missing disclosure for customer match remarketing — scripts implying personalisation without transparency notice naming Google
Get the GDPR Ad Copy Checklist
12 pre-launch compliance checks for EU campaigns. Free, instant delivery.
No spam. Unsubscribe any time.
Frequently asked questions
Are YouTube ads subject to the same GDPR rules as other Google Ads?
Yes. YouTube advertising is served through Google Ads and is subject to the same EU User Consent Policy, Consent Mode requirements, and GDPR obligations. YouTube-specific risks relate mainly to video script content — health claims, testimonials, and outcome guarantees are more common in video than in text ads.
What is the most common GDPR violation in YouTube ad scripts?
Health condition inference is the most frequent issue. Video scripts for health, wellness, and supplement products often directly address the viewer's assumed health status. This triggers Art. 9 special category data obligations, which require explicit consent that no YouTube ad funnel typically obtains.
Can I check my YouTube ad script for GDPR compliance?
Yes. Paste your video script or key ad copy into Legalify's free GDPR Ad Copy Checker. It scans for GDPR article-level risk and returns findings with compliant rewrites.
Do YouTube bumper ads (6 seconds) have different GDPR requirements?
The GDPR obligations are the same regardless of ad length. Short-form ads carry the same risk if they make health inferences or personalisation claims — the brevity does not reduce the obligation.
Check your YouTube ad copy now
Paste your ad copy into the free GDPR Ad Copy Checker and get article-level findings in seconds — no login, no card required.