How the Data Act is Unlocking the Value of Data in Europe

On 12 September 2025, the Data Act comes into force. This ambitious European regulation on data access, use and sharing is transforming the foundations of digital marketing and, in particular, the Retail Media ecosystem.

This new regulation marks a turning point in the way brands, retailers and advertisers activate their audiences and measure the impact of their campaigns, forcing a profound rethink of the strategy and technologies associated with data management.

Why is the Data Act Revolutionising Data Access?

Until now, large platforms and manufacturers of smart, connected devices have centralised data access. This limited the ability to segment and measure in Retail Media. The Data Act breaks this de facto monopoly by establishing that users and companies who own connected products and services have the right to decide on the access and transfer of the data generated by their activity. This implies a radical opening up of the data market and enables new collaborative models under the user’s explicit control and consent.

With this new regulation, the focus shifts from data ‘ownership’ to ‘access control’. Now, data generated by IoT devices, point-of-sale terminals or digital services can be shared with third parties (for example, Retail Media providers or analytics solutions) if requested by the user or owning company. This must always be done under fair, transparent and secure conditions.

The Challenge: Adapting your Data Activation Strategy

The entry into force of the Data Act requires all players in Retail Media —retailers, marketplaces and brands—to reconfigure both their technical systems and their data governance models. It is no longer enough to have consent; it is essential to guarantee the interoperability, security and traceability of data, both personal and non-personal.

Some key recommendations include:

• Inventory and classify data generated by devices or digital platforms (what data is collected, where it is stored and what it is used for).
• Implement technical measures to guarantee the quality, secure access and portability of data between different parties.
• Define clear protocols for responding to requests for access to or transfer of data to third parties.
• Review and standardise contracts to include clauses on data use, portability and FRAND (Fair, Reasonable & Non-Discriminatory) conditions.

Clean Rooms: the Star Technology of the New Era of Retail Media

In this context, data clean rooms are establishing themselves as the great enabler for compliance with the Data Act, while at the same time boosting the effectiveness of omnichannel activation and measurement.

These secure platforms allow for the joint analysis of data between different companies —for example, between a retailer and a brand— without the exchange or leakage of personally identifiable data. In this way, both the law and the new standards of privacy and consent are met.

Clean rooms make it possible to:

• Activate personalised audiences and incremental attribution models, while respecting user consent.
• Measure the impact of advertising campaigns throughout the entire purchase journey, linking digital browsing data with offline transactions, while avoiding the direct exposure of sensitive information.
• Generate valuable insights and segmentations by combining data from different sources, supporting more open and collaborative ecosystems.

A New Competitive and Contractual Balance

The Data Act also protects against unfair contractual clauses, promotes transparency in the aggregation and sharing of data with third parties, and provides end-users with guarantees regarding the secondary uses of their data.

Furthermore, it expressly excludes large platforms considered “gatekeepers” from new access privileges if requested by the user. This prevents excessive accumulations of power in the digital ecosystem.

In practice, the regulation requires companies to:

• Reinforce explicit agreements on the secondary uses of non-personal data.
• Establish clear mechanisms for compensation or remuneration for access to certain data sets.
• Align legal, technical and marketing teams for comprehensive and strategic data management.

Implications for Attribution in Retail Media and Immediate Challenges for Companies and Retailers

With interoperability and responsible sharing as cornerstones, companies in the sector can:

• Create richer omnichannel attribution loops, cross-referencing online and offline sales data with journeys digitales bajo estrictas garantías de privacidad.
• Build personalised and dynamic segmentation models, activated within the same secure clean room environment.
• Take advantage of the flexibility to incorporate new data sources, from marketplaces to distribution networks or logistics partners, thereby enriching both advertising activations and performance reports.

The transition will not be simple. The main challenges include:

• Reviewing data sources to clearly differentiate the data affected by the right of access (data that is generated or pre-processed, but not inferred or derived from proprietary models).
• Implementing technical clean room solutions as standard, avoiding the systematic denial of access based on weak arguments of trade secrecy.
• Carrying out periodic compliance audits, for both the GDPR and the new Data Act framework. This will help to avoid penalties that can reach up to 4% of global turnover or 20 million euros.

The Role of Anticipation and Governance

The most agile and forward-thinking companies will see the Data Act as a strategic opportunity rather than a regulatory obligation. Investing in technologies like clean rooms, creating hybrid teams (data/legal/business) and strengthening data governance will be essential to leading a Retail Media built on privacy, trust and cooperation.

As Cristina Cantero (VML The Cocktail) points out:

“With the arrival of the Data Act, by giving users back control over their data, a great opportunity opens up for brands to design experiences with real value and explicit consent.”

The Data Act marks the beginning of a new stage: that of responsible data activation in Retail Media. After the era of cookies and closed ecosystems, the sector is moving towards collaborative models based on clean rooms, consent and clear attribution. In this new scenario, leading will mean going beyond compliance: it will mean turning ethical data management into the engine that drives the next generation of Retail Media.