Zero-Party Data Collection in Regulated Industries Under GDPR and CCPA

Passive data collection is running out of legal road. Regulators on both sides of the Atlantic now treat inferred data, scraped data, and third-party data purchases as liabilities first, not as business assets. GDPR has applied since May 2018, and it reaches any organization processing the personal data of people in the EU or EEA, no matter where that organization sits or how big it is. There's no revenue threshold that lets a company sit this out.

GDPR rests on seven principles that all have to hold at once: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. A company can't collect a signature and call the job done. CCPA runs on a different architecture, built around transparency and consumer control rather than GDPR's opt-in model, so a company operating in both California and the EU ends up managing two compliance tracks that don't line up cleanly. For regulated industries, add HIPAA, GLBA, and other sector law on top of that, and a single bad data practice can draw attention from several enforcement bodies at once. That's the pressure zero-party data is built to answer.

Zero-party data and its consent architecture under GDPR and CCPA

Zero-party data is information a customer chooses to hand over directly, a stated preference, a stated interest, a stated intention, given to a brand on purpose rather than picked up by a tracking pixel or bought from a broker. That one design choice, intentional sharing instead of passive capture, is what makes the consent trail behind it legible from the start.

GDPR requires that consent be freely given, specific, informed, and unambiguous, backed by a clear affirmative action. Pre-checked boxes fail that test. Cookie walls fail it. If agreeing to one thing means agreeing to five things, that's bundled consent, and it fails too. Zero-party collection, by the nature of how it works, clears that bar: the customer acts first, and the record of that action is the consent.

Purpose limitation works the same way. GDPR says data can only be used for the purpose it was collected for, and zero-party data names that purpose at the moment of collection, so the consent record comes pre-scoped from the start. Data minimization follows the same logic: GDPR's Article 5 says collect only what's adequate, relevant, and necessary, and that's far easier to hit when the customer decides what to share than when a platform pulls everything it can reach.

CCPA takes a different angle, built around transparency and the right to opt out ahead of opt-in consent. Zero-party data still serves that model well: it leaves a paper trail of voluntary disclosure, the direct opposite of the undisclosed data sale that California regulators have gone after hardest. GDPR needs granular consent, so you can agree to marketing without agreeing to analytics, and the preference center, the standard zero-party collection tool, is built for exactly that kind of separation. Every consent record it produces, what the user was told, when they agreed, how their choices changed over time, comes out of the collection process itself.

The enforcement record shows what non-compliance costs

The cases regulators have pursued hardest are the same failures zero-party architecture is built to prevent: undisclosed collection, consent that wasn't real, opt-outs that didn't work.

In May 2026, General Motors paid $12.75 million, the largest CCPA penalty issued to date, because regulators said it sold driving and location data from hundreds of thousands of California drivers to data brokers without their consent. Disney paid a significant penalty in February 2026 after California's Attorney General found that opt-out settings only applied to specific devices instead of whole accounts, that connected TV users got routed to webforms instead of being able to opt out inside the app, that Global Privacy Control signals weren't honored consistently, and that data kept moving even after people asked it to stop. Honda was fined by the California Privacy Protection Agency in March 2025 for a cluster of CCPA violations: asking for more information than necessary to process opt-out and data limitation requests, dark-pattern cookie consent design, friction built into authorized-agent submissions, and ad-tech contracts that didn't meet CCPA standards. That last point is a data minimization failure at the collection stage, the exact obligation a zero-party framework is designed to satisfy.

Google received a substantial GDPR fine in September 2026 for unlawful and unfair handling of location data, transparency failures, and retaining data longer than it should have, along with an order to bring its processing into compliance within six months. And healthcare isn't exempt: Hôpital Privé de la Loire took a GDPR fine in September 2026 over a sensitive data breach, proof that poor data handling in a hospital setting carries the same financial consequences as anywhere else. Every one of these cases traces back to a failure in consent, transparency, or scope, the exact properties zero-party collection is structured to get right from the start.

Healthcare's Sector-Specific Obligations for ZPD Collection, Storage, and Use

Healthcare organizations carry GDPR or CCPA obligations and sector-specific rules at the same time, and clearing one layer doesn't mean the other is covered. GDPR classifies health data as a special category under Article 9, so it needs explicit consent or another specific legal basis, a higher bar than the standard consent needed for ordinary personal data. Any zero-party collection that touches clinical or wellness information has to clear that higher bar, not the general one.

Purpose limitation draws a hard line here. Even if the patient handed that data over willingly in the first place, data collected to coordinate someone's care can't be repurposed for pharmaceutical marketing or third-party research without a fresh legal basis or a new, explicit consent. A preference center built to manage care-coordination communications isn't automatically cleared to feed a marketing pipeline. That boundary has to be built into the collection system at the design stage, not bolted on after the system is already live.

Healthcare organizations in 2026 have to manage a large number of national privacy laws when they try to move patient data across borders. GDPR's cross-border transfer rules, the general prohibition on moving data outside the EEA unless strict conditions are met, trace back to the Schrems II case, and they apply to health data with extra force because of its special-category status. That ruling raised the bar on cross-border transfers so much that technology-based alternatives have become more relevant as a workaround, including user-held data models where patients keep their own data stored locally rather than routing it through a central system that has to justify every transfer.

Enforcement has gotten tougher too. Average GDPR penalties per violation in healthcare have climbed, driven in part by ransomware incidents tied to missing technical and organizational measures; absent multi-factor authentication is a recurring example. None of that changes because the data was shared voluntarily. Healthcare organizations still have to run Data Protection Impact Assessments for high-risk processing activities, zero-party collection included, if the processing crosses that risk threshold.

Financial services regulation as a further compliance layer on ZPD strategies

Financial services carries its own version of this compounding problem, but the pressure point is different from healthcare's. Healthcare's core tension is purpose limitation around special-category data. Finance's core tension is a regulatory environment that keeps changing, so institutions have to rebuild compliance processes on an ongoing basis.

GDPR applies to financial data with the same force it applies to any other personal data. A bank or lender operating across the EU and the U.S. has to satisfy GDPR's explicit consent and purpose-limitation rules and CCPA's transparency and opt-out framework, often for the exact same customers. Cross-border transfer restrictions add another layer of operational risk for institutions with global footprints: the same GDPR prohibition on moving data outside the EEA without meeting strict conditions, made significantly harder to navigate after Schrems II, applies to financial data just as directly as it applies to health data.

A zero-party preference center in financial services has to do more than satisfy GDPR's consent requirements. It has to document, precisely, which purposes a customer agreed to, because regulators test whether the data was actually used the way it was described at the point of collection. That documentation requirement is about to get another use case. The EU AI Act is phasing in requirements for high-risk systems in 2027 and 2028, and financial institutions using AI for credit decisions, fraud detection, or risk scoring will need regular audits, transparency disclosures, and detailed documentation of how the data behind those systems was processed. A zero-party consent trail built correctly now becomes direct supporting evidence for those audits later.

The practical design requirements for a ZPD collection system that holds up under audit

Legal compliance on paper doesn't survive an audit if the collection system itself is built poorly. The design of the consent interface, the granularity of what gets recorded, and the way the data is stored all carry legal weight, not just the policy document sitting behind them.

Granular consent is a structural requirement. GDPR requires that someone be able to consent to analytics separately from marketing separately from personalization. A single "I agree" button that bundles all three into one click doesn't count as valid consent for any of them. Withdrawal has to be just as easy as giving consent in the first place: one-click withdrawal and a preference center that's always accessible aren't user-experience extras, they're legal requirements, and a system that makes withdrawal hard is non-compliant no matter how clean the original consent process was.

Consent records need to capture what the user was told, when they agreed, which specific purposes they agreed to, and how their preferences changed afterward, because those logs are what regulators and auditors look at first. The Honda enforcement action is the clearest illustration of why the collection interface itself gets tested, not just what happens to the data downstream. Honda was fined for asking for more information than necessary to process opt-out requests, for building friction into the opt-out process that didn't exist on the opt-in side, for mishandling authorized agent requests, and for sharing data without the ad-tech contracts CCPA requires. Regulators looked directly at the form, not just at what happened to the data after it was collected.

Purpose limitation has to be built into the system, not just written into a policy. If a preference center collects data for personalized communications, the system itself has to block that data from flowing into a commercial marketing pipeline or a third-party analytics tool without a separate, documented consent step. For healthcare and financial services organizations, Data Protection Impact Assessments are still required for high-risk processing, and voluntary sharing doesn't remove that obligation if the activity meets the risk threshold. The EU AI Act's documentation requirements, phasing in through 2026 and 2027, mean the consent trails collected today will double as audit evidence for AI systems built on that data later, so building the audit trail into the collection system now is a lot more efficient than trying to reconstruct it afterward. Cross-border storage has to account for GDPR's transfer restrictions too. You can also store your own data locally in personal data clouds, a user-held data model that cuts cross-border transfer exposure by design, instead of leaning entirely on Standard Contractual Clauses or adequacy decisions that can be challenged in court.

Three real limitations of zero-party data that regulated organizations must plan around

Zero-party data's compliance advantages are genuine, but they don't arrive automatically just because a company switches to a preference center. Three structural limits need active planning.

Consent fatigue is the first. When people face a constant stream of consent decisions across dozens of websites and services, the choices they make stop reflecting their actual privacy preferences. That weakens the voluntariness assumption GDPR's consent model depends on, and it gives regulators or plaintiffs an opening to question whether "proactively shared" data was really informed consent or just fatigue-driven clicking.

Self-reported data is the second, and it's unreliable in a specific way: preference and intention data collected through surveys and forms carries social desirability bias and simple inconsistency between what people say and what they do. The explicit consent and documented purpose that make zero-party data legally strong don't make it accurate. If you rely on self-reported inputs for consequential decisions, you need verification loops and a plan for data decay over time.

The third limit is cost. The value exchange that makes zero-party collection work, people sharing data because they get something real in return, puts design work on the organization collecting it. The preference interface, the personalization needed to deliver on that promised value, and the ongoing maintenance of consent records all take real investment, and smaller organizations in regulated industries may not have the capacity to build all three well.

None of these three limitations breaks the case for zero-party data. Each one names a design requirement instead: consent fatigue calls for interfaces that are frictionless and clear about purpose, unreliable self-reports call for verification built into the system, a shifting regulatory environment calls for architecture that can adapt, and the value exchange calls for sustained investment in the user experience, not a one-time build.

A cross-jurisdictional ZPD strategy addressing sector obligations, state laws, and international transfer rules together

Treating zero-party compliance as a single-layer problem, satisfying GDPR or CCPA on their own, breaks down exactly where sector law, state law, and cross-border transfer rules overlap and sometimes conflict. A strategy built to meet the strictest requirement across every applicable jurisdiction at once, GDPR's explicit consent and purpose limitation, CCPA's transparency and opt-out completeness, and whatever sector-specific framework applies, becomes one documented standard that covers multiple regimes together. Building parallel tracks for each regulation separately costs more and holds up worse under scrutiny.

Mediahuis is the clearest example of this working commercially, not just defensively. The media company used first-party and zero-party data collected from its registered users to build targeted advertising, and that kept revenue flowing even as privacy rules around it kept shifting. That's evidence the governed path pays for itself.

Two broader trends point in the same direction. Nineteen U.S. states now have their own comprehensive privacy laws, and the EU has amendment proposals to GDPR moving through the process as of Q4 2025. Organizations that build adaptable, well-documented, consent-first collection systems now will spend less time rebuilding that infrastructure every time the legal landscape shifts again. The EU AI Act adds a forward-looking reason to get this right: its requirements are phasing in through 2026 and 2027, and a zero-party consent trail built into collection from the start becomes documentary evidence for AI system audits later, so the same infrastructure investment serves two compliance needs at once. If you work across GDPR jurisdictions, you can keep your own data stored locally, a user-held data model that gives you a structural way to cut cross-border transfer risk alongside zero-party consent architecture, not in place of it.

The underlying principles are the same ones that define good data governance generally: documented consent, access scoped to a stated purpose, records that can be audited, and real-time visibility into what data is in use and why. When an organization builds its zero-party collection system around those principles, it does more than meet a compliance checklist. It's building the kind of operational trust that regulators, customers, and its own teams can all rely on at the same time.