It is a Tuesday, and you are reviewing lead reports for a client who sells kitchen worktops in Chicago. One row stops you. The name is Irish, the number starts +353, the form says Dublin. Your client runs Meta ads targeted to “United States and similar,” and somewhere in that “similar” bucket a person in the European Union filled out the form. That contact is now in your GoHighLevel account, tagged and queued for a nurture sequence.
Here is the short answer. Yes, that lead can pull your agency into the GDPR, and no, it is not as scary as the headlines sound. You need to know which side of one line you sit on, write two short documents, and change about five settings. This guide walks through all of it, with the consent copy you can lift.
Table of contents
- Does GDPR even apply to a US agency?
- Controller or processor?
- What it actually costs you
- The six lawful bases, in plain terms
- Cookies and tracking are a different rulebook
- The five things you actually have to do
- Steal this: the consent and DPA language
- Solo, 8-person, 20-person
- Objections, answered
- FAQ
Does GDPR even apply to a US agency?
Most US operators assume GDPR is a European problem for European companies. It reaches across borders on purpose. Article 3(2) applies the GDPR to an organization outside the EU in two situations: when you offer goods or services to people in the EU, whether or not they pay, and when you monitor the behavior of people in the EU. If either is true, it applies to you, no office or bank account on the continent required.The word doing the work is “targeting.” The European Data Protection Board is clear that processing an EU person’s data by itself is not enough, there has to be an element of aiming at people in the EU (EDPB Guidelines 3/2018). A company that does not specifically target individuals in the EU is not subject to the rules (Commission guidance).
So the single Dublin lead is a grey case on its own. But agencies rarely stay in that zone. Run a campaign that reaches EU residents on purpose, offer a lead magnet anyone in the EU can download, price in euros, or set an audience that includes EU countries, and you are offering services there. The monitoring trigger is wider still: a client’s site that drops a Meta pixel and retargets an EU visitor is monitoring, and so are behavioral advertising and geo-targeting.
There is no escape hatch for being small. The Commission states that the GDPR depends not on the size of your organization but on the nature of your activities (Commission guidance). The one size-based break, in Article 30(5), excuses organizations under 250 staff from formal records of processing, and even that falls away once your processing is regular rather than occasional.
Controller or processor?
Before you touch a consent form, answer one question that sets the shape of everything else. Are you a controller or a processor?A controller decides why and how personal data gets processed. A processor processes data on a controller’s behalf, following their instructions (Article 28). For most agency work the split is simple: when you run campaigns and manage a client’s contacts for that client, the client is the controller and you are the processor, which carries the lighter load.
But the role is set by what you do, not a label you pick. The EDPB warns that a processor who goes beyond the controller’s instructions and starts deciding its own purposes becomes a controller for that activity (EDPB Guidelines 07/2020). The classic trap: you pull a client’s lead list into your own newsletter. Process client data for your own goals and you are a controller for it, with a controller’s full duties.
When you are a processor, Article 28 requires a written data processing agreement, a DPA, with the client. The UK’s Information Commissioner’s Office lays out what it must cover, and the exact clauses are in the steal-this section below (ICO contracts guidance). Bring in a freelance media buyer or an overseas VA and you need the client’s permission plus the same terms binding that subcontractor, the same contract hygiene that protects you when sending email on behalf of clients.
What it actually costs you
The fines come in two tiers under Article 83. Lower-tier breaches, like failing to keep records, cap at the higher of 10 million euros or 2% of worldwide turnover. Upper-tier breaches, like ignoring data subject rights, cap at the higher of 20 million euros or 4%.GDPR fine ceilings, in millions of euros, or 2% and 4% of global annual turnover, whichever is higher. Source: GDPR Article 83.
Those ceilings are built for billion-dollar platforms. Meta holds the record, 1.2 billion euros from the Irish Data Protection Commission in May 2023 over unlawful data transfers (Irish DPC).
For a small agency, the real cost is almost never a regulator knocking, it is the client contract. A client with a European footprint asks for your DPA before signing, and if you cannot produce one, you lose the deal. Worse is a breach that exposes a client’s EU contacts with no DPA on file. Cumulative GDPR fines have already passed 5.65 billion euros (CMS Enforcement Tracker), so you just want to be boring to that machine.
The six lawful bases, in plain terms
Under Article 6, you cannot process personal data unless you have one of six lawful bases. For agency marketing, two matter.Consent (Article 6(1)(a)). The person agrees, but the bar is high. Article 7 requires it to be freely given, specific, informed, and unambiguous. A pre-ticked box is not consent, and it must be as easy to withdraw as to give (consent overview).
Legitimate interest (Article 6(1)(f)). You can process data for a genuine business interest if it is not overridden by the person’s rights, and Recital 47 even names direct marketing as a possible one. The ICO sets a three-part test: name the interest, show the processing is necessary for it, and check it does not trample the person’s rights (ICO legitimate interests).
The catch: the right to object to direct marketing is absolute. Article 21(2) says that when someone objects, you must stop, no balancing test, so one objection ends it. This is the same opt-out discipline you already run for CAN-SPAM email and TCPA-compliant SMS, it just has to reach your EU contacts too.
Cookies and tracking are a different rulebook
This is the part even careful agencies miss. The consent to drop a cookie or fire a tracking pixel does not come from the GDPR at all, it comes from the ePrivacy rules. The EDPB’s position is that storing or reading anything on a user’s device requires that the person was informed and agreed, with the only exception being cookies strictly necessary to run the site (GDPR.eu cookies guide). Analytics and advertising cookies are not strictly necessary, so they need consent before they fire, and legitimate interest is not a valid basis for them.A banner with only an “Accept” button, reject hidden a layer deep, is the pattern the EDPB’s Cookie Banner Taskforce flagged as invalid consent in most member states (EDPB taskforce report). For EU visitors, “reject all” has to be as easy as “accept all,” and the pixels wait until the visitor says yes. This is where your lead attribution setup and your consent settings have to agree, or you track people you were told not to.
The five things you actually have to do
Compliance is a handful of concrete moves. For each, how it breaks and the fix.1. Sign a DPA with every client whose data you touch. It names you as processor, the client as controller, and sets the terms Article 28 requires. Breaks: the agency never signs one, so a client asks and there is nothing on file. Fix: make a standard DPA part of onboarding, signed before the first campaign. One template, every client.
2. Fix consent at the point of capture. Every form that can reach an EU resident needs a clear, unticked opt-in and a link to a privacy notice. Breaks: a generic form with a pre-checked “I agree” and no privacy link, so the consent is invalid. Fix: unticked checkbox, plain-language purpose, privacy link, and a stored timestamp to prove consent later.
3. Build a working opt-out and deletion path. Honor an objection immediately, and answer a deletion or access request within one month (ICO time limits). Breaks: the request lands in a shared inbox, nobody owns it, the month runs out. Fix: route requests to one named person, log the date, and automate suppression so an objection stops every sequence at once.
4. Gate cookies and pixels behind consent. On any client site that reaches EU visitors, trackers wait for a yes, and “reject” is as easy as “accept.” Breaks: the tag manager fires everything on load, and the banner only offers accept. Fix: a consent gate that blocks non-essential tags until consent, with reject on the first layer.
5. Appoint an EU representative if you are in scope and not exempt. Article 27 says a non-EU organization caught by the rules must appoint a written representative where its EU data subjects are, with an exemption for occasional, low-risk processing. Breaks: the agency assumes it is exempt without checking. Fix: if EU data is a regular part of what you do, appoint one (the service is inexpensive); if your exposure is genuinely rare, document why the exemption applies.
Steal this: the consent and DPA language
Lift these in, swapping the brackets for real details. Not legal advice, so have your counsel glance at it, but it beats a pre-ticked box.The form consent checkbox (unticked, at the point of capture):
☐ I agree that [Agency or Client name] can contact me by email and SMS about [specific topic], and I have read the [Privacy Notice]. I can withdraw this at any time by replying STOP or emailing [address].
The privacy notice micro-summary (next to the form):
We collect your name and contact details to [specific purpose]. We keep them for [time period], we do not sell them, and you can ask us to show, correct, or delete your data at any time at [address]. Full details in our [Privacy Notice].
The core clauses a DPA must contain (the spine of your Article 28 contract):
- The Processor acts only on the Controller’s documented instructions.
- All Processor staff with access are bound by confidentiality.
- The Processor applies appropriate technical and security measures.
- No sub-processor is engaged without the Controller’s prior written authorization, on equivalent terms.
- The Processor assists the Controller in responding to data subject requests.
- On termination, the Processor deletes or returns all personal data at the Controller’s choice.
- The Processor makes available the information needed to demonstrate compliance and allows audits.
The data subject request reply (logs the clock):
Hi [First name], thanks for your request. We received it on [date] and will respond within one month, as required. If we need to confirm your identity first, we will reply within [X] days with what we need. In the meantime we have paused marketing to you.
The objection confirmation (send the moment someone opts out):
You are now opted out of all marketing from [Business]. We have stopped every sequence and will not contact you for marketing again. If this was a mistake, reply RESUME.
Most agencies have none of this, and having it makes you the boring, safe vendor a careful client wants.
Solo, 8-person, 20-person
The rules are the same at every size, the right amount of effort is not.The solo operator. A handful of local US clients, rarely an EU lead, genuinely occasional processing. Sign a short DPA with each client, put a proper consent checkbox and privacy link on every form, and set one opt-out automation. You almost certainly qualify for the Article 27 representative exemption, so write a one-paragraph note explaining why. An afternoon of work, then it runs itself.
The 8-person agency. Fifteen to thirty clients, some running broad campaigns, EU leads normal rather than rare. Your processing is now regular, so the record-keeping break and the representative exemption probably do not apply. Standardize one DPA signed at onboarding, build consent and suppression into a template you deploy identically for every client, name one owner for data requests, and look seriously at an EU representative. This is where a client’s procurement team asks for your compliance posture in writing, and the same standardization is what lets you scale without adding headcount.
The 20-plus agency. Real volume, subcontractors, a few clients with direct European business. Everything above, plus a sub-processor list with signed back-to-back terms for every freelancer and tool, a documented record of processing, an appointed EU representative, and a named data protection lead. The risk is not one regulator, it is dozens of clients times thousands of contacts, so make compliance a property of your standard system, not something you re-check per account.
Objections, answered
“We are a tiny US shop. Surely this does not apply.” Size is not the test. The Commission is explicit that the GDPR depends on what you do with data, not how big you are (Commission guidance). Target or track people in the EU and you are in scope.“We have never heard from a European regulator.” Most small agencies never will directly. The exposure that bites is the client contract and the breach: a client with European ties asks for your DPA before signing, and if a leak exposes their EU contacts with no agreement on file, you are the unassigned liability in the room.
“Does a single EU lead really drag us in?” On its own, one unsolicited lead from a US-targeted campaign sits in a grey area (EDPB Guidelines 3/2018). The problem is agencies rarely stay there: broad audiences, lead magnets, and retargeting pixels all count as reaching EU residents.
“Is legitimate interest a loophole to skip consent?” No. It is a real lawful basis for some marketing, but it does not cover cookies and tracking, and the right to object overrides it instantly (Article 21(2)).
FAQ
GDPR for US agencies: quick answers
Does GDPR apply to a US marketing agency with no EU office?
It can. Under Article 3(2), the GDPR applies to any organization, wherever based, that offers goods or services to people in the EU or monitors their behavior. No EU office or bank account is needed. If you run ads, lead capture, or tracking that reach EU residents, you are likely in scope.
Are we the controller or the processor?
When you handle a client's leads on the client's instructions, you are usually the processor and the client is the controller, which requires a written data processing agreement under Article 28. If you use client data for your own purposes, such as adding their leads to your newsletter, you become a controller for that use.
What is a DPA and do we really need one?
A data processing agreement is the written contract between a controller and a processor required by Article 28. It sets out that you process only on documented instructions, keep data secure, help with data requests, delete or return data at the end, and allow audits. You need one with every client whose data you touch, and sophisticated clients ask for it before signing.
How fast do we have to answer a data access or deletion request?
Without undue delay, and at the latest within one month of receiving it, per Article 12. You can extend by up to two further months for complex requests, but you must tell the person why within the first month. Route these to one named owner and log the date.
Do our cookie banners and pixels fall under GDPR?
The consent to store cookies or fire pixels comes from the ePrivacy rules, which sit next to the GDPR. Analytics and advertising trackers are not strictly necessary, so they need consent before they load, and legitimate interest does not cover them. For EU visitors, the reject option must be as easy as accept.
What happens if we get it wrong?
Fines run in two tiers, up to the higher of 20 million euros or 4% of global annual turnover. Small agencies are rarely a regulator's first target, but the practical cost is lost deals when you cannot produce a DPA, and unclear liability if a breach exposes a client's EU contacts.
It is still Tuesday, and that Dublin lead is still sitting in the account. Check whether your consent form captured a real opt-in, confirm you have a DPA with the kitchen-worktop client, and make sure one objection would stop every sequence at once. If all three are true, tag the lead and move on; if not, you now know the five settings to fix. This is not a compliance department, just a system that is boring to a regulator and reassuring to a client. Build it once into how you onboard, and the next EU lead is a non-event.