Joint Controller

A joint controller is one of two or more parties that, under the GDPR, TOGETHER determine the purposes and means of processing personal data — they jointly decide WHY data is used and HOW. It's a distinct status from the two roles teams usually think in: a DATA-CONTROLLER decides alone, a DATA-PROCESSOR only acts on a controller's instructions, and joint controllers SHARE the controller's decision-making and therefore share the controller's legal responsibility. The status matters because marketing arrangements trigger it far more often than teams realize — and with it comes shared liability and a specific legal obligation many partnerships ignore.

When it arises and why marketing keeps triggering it: joint controllership exists wherever two parties genuinely co-decide the purposes and means of processing — and the landmark cases are squarely in marketing's territory. The EU Court of Justice's Fashion ID ruling found that a website embedding a Facebook 'Like' button was a joint controller WITH the platform for the data collection the button caused (the brand chose to embed it for its own purposes; the platform set the means) — establishing that embedding social plugins, pixels, and tags can make the embedding site a joint controller for that collection. The IAB-TCF Belgian ruling similarly found IAB Europe a (joint) controller for the TC String. So the everyday marketing acts that can create joint controllership: embedding tracking pixels and social plugins, running co-marketing and shared-campaign data arrangements, certain ad-platform and CUSTOMER-MATCH-style data collaborations, and CONSENT-MANAGEMENT setups where responsibilities are shared. What the status legally requires (GDPR Article 26): joint controllers must put in place an 'arrangement' that transparently allocates their respective responsibilities — especially who handles data-subject rights (the DSAR requests, the information duties) and who does what for compliance — and crucially, data subjects can exercise their rights against EITHER controller regardless of the internal arrangement (so you can't contract your way out of being answerable to the individual). The shared-liability reality is the trap: regulators and courts can hold a joint controller responsible for the joint processing even when the other party did the technical work — 'the platform handles that' is not a defense, and the common mistake is treating a co-controller relationship as a processor relationship (a Data Processing Agreement) when it actually needs an Article 26 joint-controller arrangement. The practical discipline: map the marketing stack for joint-controller relationships (pixels, plugins, co-marketing, ad collaborations), recognize them rather than defaulting everything to controller-processor, put Article 26 arrangements in place where they apply, and price the shared liability into partner and platform decisions — because the embedded pixel that 'the vendor handles' may be a shared legal responsibility the brand never acknowledged.

Joint-controller status matters wherever marketing co-decides data use with another party — embedded pixels and social plugins (the Fashion ID territory), co-marketing and shared-campaign arrangements, ad-platform data collaborations, and shared consent setups — which is a large and growing share of the martech stack. It matters most as a liability-and-contract recognition problem (the common, costly mistake is treating a joint-controller relationship as a processor one, with a DPA where an Article 26 arrangement is required) and as a data-subject-rights reality (individuals can come to either party regardless of the internal deal). The discipline is mapping the stack for genuine co-decision relationships, putting the right arrangements in place, and pricing shared liability into platform and partnership choices — recognizing that 'the platform handles the data' is not a status, a contract, or a defense. (General information, not legal advice.)

The joint-controller concept is codified in GDPR Article 26, but its marketing significance was set by case law - the CJEU's Fashion ID ruling (2019) making a website that embedded a Facebook Like button a joint controller, and the Belgian DPA's IAB TCF decision extending the logic to the ad ecosystem - turning an abstract role into a concrete liability the martech stack triggers routinely.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where joint controller is a core concern: