Which areas are affected by GDPR and CAN-SPAM in digital marketing activities?

• A. They regulate only social media advertising.
• B. They regulate consent, data processing, email opt-in, data rights, and opt-out mechanisms.
• C. They ban all email marketing.
• D. They require privacy notices only for new customers.

Answer: (B)

Understanding how data protection and anti-spam laws shape digital marketing is essential. The idea being tested is that GDPR and CAN-SPAM govern how you handle consent, process personal data, manage email opt-ins, respect data rights, and implement opt-out mechanisms.

GDPR governs the processing of personal data and requires a lawful basis for marketing activities, including clear, informed consent where needed, plus rights for individuals to access, rectify, delete, and port their data. It also requires transparent use of data through privacy notices. CAN-SPAM governs commercial emails in the U.S., focusing on truthful headers, clear identification of messages as advertisements, and a working opt-out mechanism that must be honored promptly. Together, these rules regulate the aspects listed: consent, data processing, email opt-in, data rights, and opt-out mechanisms.

The other options don’t fit because they either limit the scope to social media, claim an outright ban on email marketing, or imply privacy notices are required only for new customers, which is not accurate.