Usercentrics blog

Usercentrics co-founded the European CMP Association to bring operational consent expertise into EU policy – starting with the Digital Omnibus.

The EU AI Act was adopted in March 2024, making it the world’s first comprehensive AI regulation. In March 2026, the European Parliament also approved the EU’s signature of the Council of Europe’s Framework Convention on Artificial Intelligence — the first legally binding international AI treaty. Usercentrics examines what these regulations include, who they affect, and what they mean for data privacy compliance.

Collecting personally identifiable Information (PII) from users is the backbone of data analytics in most organizations. Depending on the business purpose, PII ranging from email addresses to health records can help deliver services, build relationships, and enable more personalized experiences. This guide provides a PII compliance checklist to help you protect user data and avoid regulatory fines from global data privacy regulations.

Usercentrics is opening its North American headquarters in New York City, marking a major step in its U.S. expansion. Already trusted by 2.4 million websites worldwide, the global consent and data privacy leader is now bringing its full suite — spanning cookie consent, server-side tracking, AI governance, and audience activation — to U.S. marketers and enterprises.

Every organization collects data. Far fewer have clear answers to the questions that follow: who’s responsible for it, what it can be used for, how long it should be kept, and what happens when something goes wrong. Data governance principles provide those answers, written down and enforced.

The General Data Protection Regulation has changed how organizations approach data processing, but one lawful basis continues to create challenges: legitimate interest. As the most flexible basis, and often also the most heavily scrutinized under Article 6(1)(f), it gives organizations room to process data while also requiring careful justification.

Using personal data in AI systems triggers GDPR protections and obligations. This guide breaks down what counts as processing, where risks exist, and how to build practical privacy and consent compliance into data collection, training, deployment, and governance.

GDPR exemptions are specific circumstances in which organizations may be excused from certain requirements under the law. This guide explains what those scenarios are, which obligations may still apply, and when an organization may be able to rely on its legitimate interests.