In June 2025, the UK Data Protection and Digital Information Act received royal consent and marked a pivotal moment for B2B marketers navigating an increasingly complex data environment. This law goes beyond compliance. It fundamentally reshaping how data-driven marketing works in the UK and beyond.
While we already share important insights into the impact of the new bill on B2B marketing late last year, the final version of the law provides much needed clarity on long-standing issues such as legitimate profit marketing and consent frameworks.
Its practical regulations address the reality of modern digital engagement, from cookie management to AI-powered profiling, presenting new opportunities for innovation and differentiation as well as compliance requirements.
To stay competitive, B2B marketing leaders need to integrate this evolving regulatory environment into strategic planning, operational processes and technology investments.
Winning for legitimate interests and consent models
One of the most influential explanations in the new law focuses on the use of legitimate interests as a legal basis for direct marketing. This foundation already existed under rules tailored to the previous GDPR, but its interpretation was vague, and many companies (incorrectly) continued to demand explicit consent for all engagement.
Tony Lamb, a data and insight expert at Propolis, emphasizes that the law explicitly addresses legitimate interests as an effective legal basis for direct marketing. This removes important areas of ambiguity that previously led to careful and over-practice, such as unnecessary consent pop-ups and fragmented data collection flows.
For B2B marketers, this means rethinking the consent strategy. If legitimate interests apply, and if the team has consented by default, it’s time to update their approach. However, Tony warns that the changes should be reviewed with his legal counsel.
“I can’t do much right now, but that doesn’t mean I’m not going to do anything. I’ll see what it actually looks like in operational context with my legal counsel. In any case, there’s no ambiguity about that now that I can use legitimate interest in direct marketing.”
Towards a more frictionless web experience
The law’s handling of cookies represents another step towards making things simpler, but it’s not as far as you would have liked at first. Early drafts suggested a fundamental reduction in consent requirements, but the final version’s measurements are more measured.
Importantly, explicit opt-in is not required for B2B websites, certain non-essential cookies, especially cookies used to statistical tracking or adjust user-setting content.
Tony explains that the new law will reduce friction with statistical cookies and user tracking, and reduce the need for pop-ups that get in the way.
“The bill provides exemptions from the requirement to request consent for certain non-essential cookies and similar tracking techniques. For example, non-essential cookies used for statistical purposes previously required consent.
This is especially good news for marketers who focus on user experience and transformation optimization. Frequent cookie pop-ups have been a point of friction in the digital journey, especially for return users.
Under the new scheme, data such as session duration, video engagement, page navigation patterns, and more can be collected more seamlessly, unless used in a way that invades the privacy of the user.
Marketers should work closely with web developers and legal teams to update cookie banners and consent scripts. Many organizations can now simplify or in some cases remove performance cookie pop-ups without violating the law.
International Data Transfer: Overseas Uncertainty
The bill makes domestic data governance modernised, but leaves behind public questions about international data transfer. This is a critical issue for global B2B companies using cloud-based Martech Solutions.
As Tony explained, previous GDPR frameworks did not reflect the reality of modern distributed cloud computing, where data can be stored and dynamically moved across multiple regions.
He says that while the law provides greater clarity within the country, there is still uncertainty about how it will align with the international regime, including EU law.
The new law could improve the clarity of UK-based processing, but it remains unclear whether it will be recognized by other jurisdictions, particularly the EU.
For B2B marketers using Offshore CRM Systems, Marketing Automation Tools, or Analytics platforms, maintaining close collaboration with Legal and IT teams is essential to avoid a blind spot in compliance.
In the short term, companies may need to rely on standard contractual clauses (SCCs) or updated international data transfer agreements until mutual recognition is established between the UK and its trading partners.
AI, profiling, predictive analytics
One of the most forward-looking aspects of the new law is its approach to AI and data-driven profiling. Under previous law, virtually any form of profiling agreed to the theoretical necessary consent.
This approach has become increasingly a step further with the reality of modern marketing. Today’s Martech Ecosystem runs through profiling, from lead scoring and personalization to content recommendations and predictive analytics.
The new bill is more practical. Now, profiling can be carried out without express consent if we do not get a decision that has a significant negative impact on the individual, such as a denial of service or legal consequences.
As Tony points out, “General profiling is now more relaxed, and therefore gives more scope.” This shift opens the door for greater innovation in AI-driven marketing, including dynamic segmentation, account-based personalization, and behavioral targeting.
B2B marketers investing in AI tools can move forward with more confidence, provided that the principles of privacy through ethical frameworks and design remain embedded in development and deployment. The law does not give a Carte Blanche, but it brings closer regulation in line with real-world practice.
First Party Data Strategy
Using third-party cookies along the way and first-party data that are more valuable than ever, the new law reaffirms the strategic importance of building a direct value-based relationship with your audience.
Collecting first-party data through gated content, newsletter sign-ups, and CRM-enriched lead forms is not only compliant, but also increasingly powerful.
The law reduces friction with consent requirements, but also strengthens cases of transparent and meaningful data exchange. As Tony explains, “First-party data is creating relationships with individuals by trying to create a relationship of value there. That’s still true.”
B2B marketers should double the value proposition that encourages users to share their data with pleasure. Premium Insights, ROI calculators, or tailored reports all serve this purpose. The goal is not just to stay compliant, but to build trust and loyalty in an environment where customer data becomes a critical, competitive asset.
Operational adjustment: What should we do now?
The new bill will provide marketing operations leaders with the opportunity to audit and streamline data practices. The key areas to review are:
Consent mechanism: Update forms, pop-ups, and backend logic to match clearer rules about legitimate interest and consent.
As Tony says, “If you were previously compliant, life has been a bit easier. But if you are careful and overcompatible, now is the time to trim the over-. Overall it’s simpler and more clearer… yet, if you’re using your data for very sensitive purposes, there are still all the regulatory requirements.”
This is a great opportunity to enhance internal data governance policies, staff training and collaboration across capabilities between marketing, legal and IT teams.
Digital verification and AI-driven fraud protection
Finally, the new law introduces provisions regarding the verification of digital IDs. This is an increasingly important topic in an era of AI-generated fraud, spoofing and data breaches.
It is primarily intended for consumer protection, but this also affects the B2B environment. Especially when checking business contacts, customer reliability, or partnership integrity.
Tony highlighted how ACT supports safe and modest identity management practices. “Digital verification becomes extremely important. This behavior allows for more digital verification to be used without obtaining additional permissions.”
As threats from deepfake and spoofed identities increase, especially in sales and procurement channels, the ability to verify digital identities more robustly can be a key differentiator for secure B2B engagement.
Advanced marketers should investigate how digital identity tools can integrate with existing CRM systems and onboarding flows.
Beyond Compliance: Towards Competitive Differentiation
Data Protection and Digital Information Act is more than just updating compliance. By clarifying legitimate interests, reducing unnecessary consent friction, and opening the door to responsible AI innovation, marketers can attract audiences with greater confidence and efficiency.
The legal environment for international data transfer remains fluid, but the law gives UK B2B marketing leaders the opportunity to optimize their data strategies. Those who actively improve the consent process, improve the user experience, and embed ethical AI-driven profiling not only reduce risk, but are also standing out in an increasingly data-centric market.
The true winners are those who use new laws to build trust, provide personalized value, and make data governance an important part of their marketing playbook.
Learn more about using AI and ABM intent data
