A consumer is a natural person who buys or uses goods and services for private purposes rather than for a trade, business or profession. In advertising the word carries two jobs at once. It names the human being an advertisement is meant to reach, and it names a legal status that decides which protections attach to that person and which obligations attach to the companies handling data about them. The two meanings overlap without matching, and the space between them accounts for a large share of the compliance machinery now embedded in programmatic advertising.

Three definitions that do not agree

European law defines the consumer by the purpose of the transaction, not by the identity of the person. Article 2(1) of the Consumer Rights Directive 2011/83/EU covers any natural person acting for purposes outside a trade, business, craft or profession. The Unfair Commercial Practices Directive 2005/29/EC uses the same formula, and its Article 2(d) defines business-to-consumer commercial practices to include commercial communication, advertising and marketing. Status is therefore situational. The same individual buying a laptop for a spare room is a consumer; buying the identical machine for a sole trader business, that person is not.

United States privacy law took the opposite route. The California Consumer Privacy Act defines a consumer as a natural person who is a California resident, a test of residency rather than of purchasing. The practical effect became visible when the statute's exemptions for employee and business-to-business data lapsed on January 1, 2023. Since that date employees, job applicants, contractors, directors and business contacts have been consumers under the law, which means human resources departments now field the same access and deletion requests as e-commerce teams. The word survives as a label while the concept underneath has widened to something closer to resident.

Media measurement supplies a third meaning. There, a consumer is a sampled household member whose purchases or media exposure stand in for a projected population, a definition that only makes sense in aggregate.

Where the consumer enters the bid stream

Programmatic protocols avoid the word almost entirely. In OpenRTB, adopted as an IAB Tech Lab standard in January 2012 with version 2.1 and updated to 2.6 in April 2022, the person is the User object, documented as information known or derived about the human user, and described in the specification as the audience for advertising. Its fields are sparse: an exchange-side identifier, a buyer-side identifier mapped by the exchange, year of birth, gender, a comma-separated keyword string, a home geography, and an array of Data objects contributed by segment providers.

Legal status travels separately, in the Regs object rather than the User object. An IAB Tech Lab advisory published in February 2018 established the pattern ahead of the General Data Protection Regulation, carrying the consent string as an extension on User while jurisdiction flags sat on Regs. The Global Privacy Platform later merged both, placing an encoded string at regs.gpp with an accompanying array at regs.gpp_sid identifying which regional sections apply. The word consumer appears in the specification mainly in these privacy fields, describing signals under United States regulation.

That split matters operationally. Attributes describing the person move through one branch of the object model, while permissions describing what may be done with those attributes move through another, and the two are set by different parties. A browser-level opt-out arrives as an HTTP header before any bid request exists, then has to be translated into an encoded string further down the chain, a translation covered in PPC Land's explainer on Global Privacy Control.

Counting a population that cannot be surveyed

Advertising has measured consumers by sample far longer than by census. The National Consumer Panel and the Nielsen Radio Index both launched in 1942, the latter using the Audimeter to log radio tuning mechanically. The method persists at scale: NielsenIQ's Homescan panel reports more than 250,000 households across 25 countries, while the academic extract licensed through the University of Chicago covers 40,000 to 60,000 United States households annually since 2004.

Set against digital measurement, those numbers look small, and that contrast is the point. A panel of 60,000 households produces demographically weighted estimates about a national population; an identity graph produces individual-level records with no sampling frame and no weighting. Retail media has pushed the second approach further, with purchase histories used to build intent-driven segments that behave like panels but are not samples of anything.

From protected category to targeting input

The modern political meaning dates to March 15, 1962, when John F. Kennedy sent Congress a special message on the consumer interest opening with the line that consumers "include us all" and setting out rights to safety, information, choice and a hearing. Consumers International later adopted March 15 as World Consumer Rights Day.

European courts then supplied a benchmark. In Gut Springenheide (C-210/96, July 16, 1998) the Court of Justice held that misleadingness should be judged against a consumer who is "reasonably well-informed and reasonably observant and circumspect", a formula copied into recital 18 of the UCPD in 2005. Advertising regulation across the single market still runs on that standard.

Digital-era instruments added targeting-specific rules. Article 26 of the Digital Services Act requires per-advertisement transparency about who paid and which parameters were used, while Article 28(2) bars profiling-based advertising where a platform knows with reasonable certainty that the recipient is a minor. The European Data Protection Board's guidance on the interaction between the DSA and the GDPR noted a sequencing problem: Article 26 information reaches the person after processing may already have occurred. Similar profiling bans now operate outside Europe, including the Brazilian provision at issue in the ByteDance enforcement action reported in August 2026.

What the industry knows about how consumers respond

Attitudinal research keeps returning gaps between industry assumptions and stated consumer views. Digital Advertising Alliance survey results published on February 24, 2026 found 85% recognition of the AdChoices icon, with 88% expecting interest-based advertising and 87% supporting independent watchdogs in new legislation. IAB research covering 505 Gen Z and Millennial respondents and 104 executives, fielded between October 2025 and January 2026, found a 37-point gap between executives who assumed positive sentiment toward AI-generated advertising and consumers who reported it, widening from 32 points in 2024.

Behavioral studies show similar fragmentation. Brainlabs analysis of 3,000 purchase journeys published on August 15, 2025 identified three distinct search personas, with respondents using an average of 2.5 platforms in the United States and 1.9 in the United Kingdom. Consent research points the same way: Deloitte work published for the IAB treats permission as the binding constraint on first-party data strategy rather than data volume.

Limitations and disputes

The average consumer benchmark is contested. Critics argue the standard assumes a level of attention inconsistent with behavioral evidence. The Court of Justice revisited the question in Compass Banca (C-646/22), restating that the concept is neither statistical nor purely theoretical while declining to adopt the language of bounded rationality, an outcome commentators read as a cautious update rather than a revision.

A second dispute concerns whether disclosure is a workable remedy at all. In its proposed enforcement policy statement on personalized pricing, the Federal Trade Commission cited Pew findings that 67% of Americans reported understanding little or nothing about what companies do with their personal data, up from 59%. The same document cited 2024 research in the American Economic Review concluding that partial adoption of personalized pricing can leave consumers worse off than either universal adoption or none, and the Commission declined to decide whether fully disclosed personalization can still be unfair.

A third runs through terminology itself. Calling a person a consumer frames the relationship as commercial, which is precisely what critics of behavioral advertising dispute when the person is a reader, a viewer or a minor rather than a buyer.

Disambiguation

User is the technical counterpart, denoting whoever is operating a device or session. It carries no legal status and no purchase assumption, which is why OpenRTB uses it.

Customer denotes an existing commercial relationship. Every customer is a consumer in the marketing sense; most consumers reached by an advertisement are not customers.

Data subject is the GDPR term for an identified or identifiable natural person. It attaches to data processing regardless of commercial context, so it covers employees and citizens whom European consumer law would not treat as consumers.

Audience and shopper are measurement constructs. An audience is a projected or modeled aggregate; a shopper is a person observed in a purchase context, typically within retail media.

Recent developments

On August 19, 2026 the Federal Trade Commission approved a proposed enforcement policy statement on personalized pricing by a 2-0 vote, opening a 30-day comment window on publication. The statement argues that failing to disclose personalization, its basis and the data behind it is likely an unfair or deceptive act, and it extends the Commission's data-privacy theories, including its warning that hashed identifiers are not anonymous, into pricing. The context includes the January 2026 dispute over whether Google's Universal Commerce Protocol enables surveillance pricing and the first Senate hearing on the subject on August 4, 2026.

In California, data brokers have been required since August 1, 2026 to poll the Delete Request and Opt-out Platform at least every 45 days and act on deletion requests submitted through a single state-hosted form. In Brussels, the Digital Fairness Act remained unpublished as of August 2026, with the Commission work programme scheduling a proposal for the fourth quarter covering dark patterns, addictive design, influencer marketing and unfair personalization.

Timeline

  • 1942 - The National Consumer Panel and the Nielsen Radio Index begin sampling household consumption and radio tuning
  • March 15, 1962 - Kennedy sends Congress a special message setting out four consumer rights
  • July 16, 1998 - The Court of Justice defines the average consumer in Gut Springenheide (C-210/96)
  • May 11, 2005 - The Unfair Commercial Practices Directive adopts the average consumer benchmark at recital 18
  • October 25, 2011 - The Consumer Rights Directive fixes the purpose-based definition at Article 2(1)
  • January 2012 - OpenRTB 2.1 is adopted as an IAB Tech Lab standard
  • June 28, 2018 - The California Consumer Privacy Act is signed, defining consumer as any California resident
  • May 25, 2018 - The GDPR becomes enforceable, using data subject rather than consumer
  • January 1, 2023 - CCPA exemptions for employee and business-to-business data expire
  • February 17, 2024 - Digital Services Act obligations, including the minors profiling ban, apply in full
  • October 3, 2024 - The European Commission publishes the Digital Fairness Fitness Check
  • January 1, 2026 - Californians can submit deletion requests through DROP
  • August 1, 2026 - Registered data brokers must begin retrieving DROP requests every 45 days
  • August 19, 2026 - The FTC proposes an enforcement policy statement on personalized pricing

Summary

Who: Natural persons acting outside a trade or business, as defined by European consumer directives, and California residents, as defined by state privacy law. The term is operated on by advertisers, publishers, exchanges, data brokers, measurement firms and the regulators supervising them.

What: A dual concept. In marketing it names the human target of a commercial message; in law it names a protected status carrying rights to information, opt-out and deletion. Advertising protocols encode the person as a user and the legal status as a separate privacy signal.

When: The political definition dates to March 15, 1962. The European benchmark dates to July 16, 1998 and 2005. The dominant United States privacy definition dates to 2018, broadened on January 1, 2023.

Where: European Union consumer directives and the Digital Services Act; United States federal enforcement under Section 5 of the FTC Act and state privacy statutes led by California; and the OpenRTB and Global Privacy Platform specifications that carry both attributes and permissions through the bid stream.

Why: Which definition applies determines what may be collected, what must be disclosed, and what a person can demand be deleted. As inferences built for advertising reach into pricing and recommendation systems, the legal meaning of consumer increasingly governs what the marketing meaning is allowed to do.