A reader asked recently whether we could offer a point of view on trends, audience behaviour, messaging and regional nuance across markets. This intentionally isn’t a data-backed victory lap of what I have seen in each market, because my weight of evidence isn’t equal enough across all territories. Instead, it’s fifteen-odd years of watching this industry lurch from market to market, held up against the best third-party evidence I could find, with the gaps left as gaps rather than papered over. If you’re running, or thinking about running, an account-based programme across more than one region, I think it’s worth your ten minutes.
What you’ll learn in this article:
Why UK and EU privacy law are quietly pulling apart for the first time since GDPR, and what that means for addressability on each side of the Channel
Why the US isn’t “looser” than Europe, it runs on an entirely different consent architecture, and why the difference is more significant than most vendors let on
Whether the old floor trader’s instinct, hashed email in the US, clusters and personas in Europe, actually holds up against the evidence
Why Singapore tops the global AI adoption tables while running a stricter consent regime than most of the region, and why those two facts sit together perfectly well
What high-context and low-context culture actually means for B2B messaging and campaign sequencing, and why the “one deck, three markets” approach still quietly underperforms in 2026
The UK and the rest of Europe used to be one privacy story. They aren’t any more.
For most of my career, “European privacy law” has meant one thing. GDPR plus the ePrivacy Directive, enforced with local flavour but pointed in the same direction everywhere. I watched that direction get set in 2018, when GDPR went live and half the industry spent that May frantically re-papering consent flows they’d been ignoring for a decade. It caused carnage in agency land and a wave of premature in-housing happened to manage legal workflows at the cost of client performance. I watched it harden further when the Belgian regulator went after the IAB’s own Transparency and Consent Framework and the CJEU backed them up in 2023, which told every publisher and every DSP that the industry’s own self-built consent plumbing wasn’t going to save anyone. Reject the banner, and that was that, wherever you were standing.
That assumption is now out of date, and it’s the UK that’s broken the pattern.
Since February 2026, UK cookie law has been changing shape under the Data (Use and Access) Act. New categories of storage and access technology no longer require consent at all, and the ICO has gone further than that. It’s signalled openly that it intends to submit evidence to government on which advertising activities could earn a statutory exemption from consent, provided the privacy risk is genuinely low. This is something I have been privately advocating for yonks, and especially in B2B where the targeting currency becomes ‘the account’, with measurement mapped to that aggregation of people in an office; I genuinely think B2B sits squarely in that very low risk category.
The regulator’s own finalised guidance makes an argument I’ve been making in agency pitch rooms for a decade without much luck: treating a cross-site behavioural profile and a single contextual ad as the same category of risk was always a very blunt instrument. That’s the ground I covered in the piece on PECR reform a couple of months back, and nothing’s actually switched on yet, advertising still needs consent in the UK today. But the regulator is the one holding the door open, which is a genuinely new posture for a UK data authority to take. For the first time in a generation the privacy direction of travel has changed, and I really do think that is positive. The wider ecosystem of an ad-funded internet enabled by addressable advertising is what has kept the ‘web free since ninety-three’ as OG adtechers like to say, and that privacy cost has been blown out of all proportion. The ad ecosystem isn’t looking at bank account numbers and personal phone numbers, its pseudo anonymous identifiers that map back to signals like which business you may work for or what news story you were reading in which region of which country.
Before we get excited and think the whole continent of Europe, of which the UK has always had one foot in and probably a bit more than that out since Brexit in 2016, they are in-fact on another track entirely. The EU has gone the other way.
The long-stalled ePrivacy Regulation, which had been in negotiation since I was still cutting my teeth on RTB, was formally withdrawn in February 2025. Rather than loosening anything, the Commission’s Digital Omnibus package folds cookie consent straight into GDPR through two new articles. Article 88a restricts how often a site can re-ask for consent after someone’s said no. Article 88b will eventually make browser-level consent signals legally binding on every controller, which hands more power to the rejection, not less. And enforcement hasn’t slowed down to match the political mood. The French regulator fined Google and Shein a combined €475 million in a single day in September 2025 for cookie violations, and Brussels separately fined Meta €200 million over its consent-or-pay model.
So for the first time since GDPR landed, “Europe” isn’t one privacy regime moving in one direction. The UK’s exploring a risk-based exemption for low-risk advertising. The EU’s consolidating and tightening. Anyone running the same programme across the UK and the rest of the continent on the assumption that the compliance posture is identical is working off an assumption with an expiry date, and that date is this year, not some hypothetical future one.
All of this is explored in my ultimate guide to B2B programmatic advertising in 2026
The Ultimate 2026 Guide to B2B Programmatic Advertising: The Full Stack, The Real Gaps, and How to Win Multi-Channel
Most “programmatic for B2B” guides you’ll read in 2026 were written by someone who has never bought a deal ID, never negotiated a curation fee, and couldn’t tell you the difference between SupplyChain Object validation and a seller-defined audience if you put a gun to their head. If this sounds like made up nonsense, read on!
The US was never “looser.” It’s built on a different foundation entirely.
Every European media buyer I’ve ever trained has walked into their first US campaign with the same instinct: this market’s simpler, less regulated, more room to move. I had exactly that instinct myself the first time I ran budget into the US, many years ago, and it’s not quite right, and getting it wrong costs you.
The UK and EU run on opt-in. Nothing gets stored on a device for advertising until the user actively says yes, and the default state is off. That’s true whether you’re dealing with the original 2011 UK implementation of the EU cookie directive, which is the piece of regulation that actually started the banner era before GDPR existed, or the version we’re living under now. The US runs on opt-out, and it still does even in its most regulated states. As of March 2026, no US state requires affirmative consent before a cookie is placed. The twenty states with comprehensive privacy laws, California’s CCPA/CPRA leading the pack, give consumers a right to opt out of targeted advertising and data sales after the fact. The default is collection. The user has to go and switch it off, and almost nobody does. That’s not a looser version of the European rule. It’s a different rule built on a different premise about who has to do the work.
That single structural difference is why individual-level, device-level signal has persisted at far greater scale in the US by default, and it’s exactly why deterministic identity, hashed email matched to mobile advertising ID, grew up there as a discipline in the first place. This manifests into being the go-to identity tactic for North American adtech businesses and about the last tactic to try for a European business. These legal norms determine the entire approach to identity that European versus North American adtech businesses take, which is an interesting nuance which probably often gets forgotten.
I strongly believe that any B2B vendor with global advertising ambitions are better working with a European adtech business, precisely because they have had to adopt the widest range of tactics to build deep addressability. The combined scale of the US market combined with the default to ‘on’ for data collection makes everything easier - and a rude awakening when US businesses come across the pond and collide with Europe’s default to ‘off'‘. As a UK based founder, I am bias, but I do think there’s validity in this argument.
I remember the identity graph wars properly kicking off around 2016 to 2018, Drawbridge and Tapad slugging it out over cross-device matching, LiveRamp building what eventually became RampID out of the old Acxiom onboarding business, and all of it assuming a US-style ocean of persistent, matchable signal to work with. Then GDPR hit in 2018 and a huge amount of that infrastructure simply didn’t translate to European traffic, not because the vendors got worse at their jobs, but because the underlying signal they needed to match against had been legislated into scarcity on this side of the Atlantic. Many packed their bags and left the UK/EU market entirely.
One identity vendor is blunt about what happens when a US-built graph gets pointed at non-US traffic: match rates fall off a cliff, because the hashed-email-to-device associations that make the whole thing work were never built at density outside their home market. It isn’t purely a regulatory story. It’s a data-density story too, and the two feed each other. Roqad, one of the European identity players, is upfront that it exists specifically because the US-style deterministic model doesn’t fit the region it operates in, which tells you the industry itself has already made this call, it’s just rarely said out loud to the client.
Below is how hashed email, clusters and messaging change from market to market, and what that means for your programme.