The EU’s General Data Protection Regulation goes into force in May and will be a permission game changer for many organizations that serve Europeans. It requires, among other things, explicit, provable permission from individuals to use their personally identifiable information to send direct-marketing campaigns to them. The GDPR also requires clear unambiguous explanations as to what the information will be used for, and the collection of no more data than is necessary to execute the campaigns for which permission has been granted.