Badge scanning at trade shows is generally legal in most jurisdictions. Attendees consent to potential exhibitor contact through the event registration terms, which typically disclose that contact information may be accessed by exhibitors. The legality of what happens next — follow-up email, data storage, data sharing — depends on the applicable privacy and anti-spam laws in the attendee’s jurisdiction: GDPR in the EU and UK, CASL in Canada, and CAN-SPAM plus state privacy laws in the US. This guide is not legal advice.

The question exhibitors ask most often when attending events in the EU, UK, or Canada for the first time is whether badge scanning is permitted under local data protection law. The short answer is yes, generally, within the boundaries established by the organiser’s registration terms and the applicable laws in each jurisdiction. The more nuanced answer is that the scan itself is rarely the legal issue — it is the subsequent use of the scanned data that privacy law has most to say about.

This guide covers the key frameworks by region, what exhibitors need to do to maintain a defensible compliance posture, and how BoothMaven’s badge scanning and privacy infrastructure supports compliant lead capture across markets. It is not legal advice.

How Consent Works at Trade Shows and Conferences

Badge scanning at events involves two distinct consent moments. First, the attendee consents at registration — the organiser’s privacy notice and registration terms disclose that contact information may be accessed by exhibitors via the lead retrieval system. Second, exhibitors accept the organiser’s exhibitor terms, which typically require compliance with applicable data protection laws and restrict use of lead data to purposes consistent with the show interaction.

When an exhibitor scans a badge, they become a data controller for that individual’s personal data. This means the exhibitor — not the organiser — is responsible for how the data is stored, used, shared, and eventually deleted. Exhibitors need a privacy policy covering event-collected data, a secure storage process, a mechanism to respond to data subject requests (in GDPR jurisdictions), and an opt-out mechanism in all follow-up communications.

Best practice: ask before scanning

Regardless of what the registration terms technically permit, best practice is to ask before scanning: “May I scan your badge so I can follow up with you?” This creates a transparent, acknowledged interaction, a cleaner contemporaneous consent record in the lead note, and a better first impression. Any attendee who declines should have their decision respected immediately — scanning a badge without the attendee’s awareness or against their expressed preference is inappropriate and creates legal exposure under most applicable privacy frameworks.

Badge Scanning and Privacy Law in the United States

The United States does not have a single comprehensive federal privacy law governing B2B trade show data collection. Privacy regulation is primarily a patchwork of state laws and sector-specific federal regulations. CAN-SPAM governs commercial email; it does not prohibit badge scanning or trade show lead capture.

CAN-SPAM: the commercial email framework

The CAN-SPAM Act requires that commercial emails to US recipients include: an accurate From address, a non-deceptive Subject line, a valid physical postal address, and a working opt-out mechanism honoured within 10 business days. CAN-SPAM operates on an opt-out basis — exhibitors may send the first commercial email to a US trade show contact without prior explicit consent, provided the email contains all required elements. Modern email platforms include CAN-SPAM-compliant footers by default — verify that your templates include all required elements before launching post-show sequences.

California CCPA/CPRA and state privacy laws

California’s CCPA (as amended by CPRA) gives California residents the right to know what personal data has been collected about them, request deletion, opt out of the sale or sharing of their data, and correct inaccurate data. Virtually all exhibitors at US trade shows collect data from California residents — California is the most populous US state and is disproportionately represented at major US conferences. Exhibitors should ensure their privacy policy covers event-collected data and that they have a process to respond to CCPA rights requests within the statutory timeframes.

Virginia, Colorado, Texas, Connecticut, and more than a dozen other states have enacted or are implementing consumer privacy laws with similar structures to CCPA. For exhibitors targeting broad US audiences, implementing CCPA as the compliance floor — the most comprehensive US standard — covers most state-level requirements as a practical matter. This is general guidance only, not legal advice.

B2B context and the “consumer” definition

Many US state privacy laws define “consumer” as a natural person acting in a personal or household capacity — which may exclude B2B contacts encountered in a professional capacity at a trade show. The applicability of state consumer privacy laws to trade show lead data collected in a B2B context varies by state law definition and the specific circumstances of collection. Do not assume B2B context eliminates all state privacy law obligations — verify with qualified counsel for your specific situation.

Badge Scanning and Privacy Law in Canada

Canada has two primary frameworks relevant to badge scanning: CASL (Canada’s Anti-Spam Legislation), which governs commercial electronic messages, and PIPEDA (Personal Information Protection and Electronic Documents Act), which governs how private-sector organisations collect, use, and disclose personal information in commercial activities.

CASL: implied consent and its limits

CASL operates on an opt-in basis — commercial electronic messages require either express consent or implied consent. A Canadian trade show or conference badge scan, where the attendee is present in a professional commercial capacity and voluntarily allows the scan, creates implied consent under CASL for a period typically interpreted as two years from the date of the interaction. This implied consent permits commercial email directly related to the show interaction during that window.

CASL requirements for exhibitors: record the consent date and source (BoothMaven auto-populates the event name, scan date, and source field in the CRM), include a working unsubscribe mechanism in every commercial email, and honour unsubscribe requests within 10 business days. After the two-year window expires, contacts who have not provided express consent must be suppressed from commercial email. The CASL consent expiry date should be calculated and stored in the CRM — BoothMaven populates this field automatically for Canadian contacts based on the scan date.

CASL enforcement is handled by the CRTC. Penalties can reach C$1 million per violation for individuals and C$10 million per violation for organisations — CASL compliance is not a formality for exhibitors regularly attending Canadian events.

PIPEDA: data handling requirements

PIPEDA requires that personal information collected for one purpose (trade show lead capture) not be used for a materially different purpose without the individual’s knowledge and consent. It also requires data accuracy, limited retention, adequate security measures, and accessible data subject rights. Quebec’s Law 25 adds enhanced requirements for organisations processing Quebec residents’ data, including mandatory privacy impact assessments for certain processing activities and a data protection officer obligation for some organisations.

Badge Scanning Under GDPR — EU and UK

GDPR requires a lawful basis for every processing activity involving personal data. For B2B trade show badge scanning and follow-up, the most commonly applicable basis is legitimate interest — the exhibitor has a legitimate commercial interest in following up with a visitor who voluntarily attended their stand at a business event, and that interest is not overridden by the individual’s data protection rights in the B2B context.

Legitimate interest is not automatic. It requires a documented Legitimate Interest Assessment (LIA) covering: the purpose of processing, the necessity of using personal data, and a balancing test confirming the interest is not overridden by the data subject’s rights. Exhibitors regularly operating in EU or UK jurisdictions should have a completed LIA for their event lead capture activities on file.

Transparency: privacy notice in the first email

GDPR requires that individuals be informed of data processing at the time of collection or promptly thereafter. In the event context, the organiser’s registration privacy notice covers the initial collection. Exhibitors complete the transparency requirement by including a privacy notice reference in the first follow-up email — a line such as “Our privacy policy explains how we handle your data and your rights: [URL]” satisfies this requirement for most B2B exhibitors in most EU/UK contexts. Do not omit this from the first email to EU or UK contacts.

Germany and stricter EU member state rules

Germany’s UWG (Unfair Competition Act) imposes direct marketing restrictions that are stricter than the GDPR baseline in some contexts. Prior explicit consent may be required for commercial email in certain German B2B situations where GDPR’s legitimate interest basis would otherwise apply. Exhibitors specifically targeting German contacts should obtain qualified German legal advice before commencing commercial email campaigns to German exhibition leads.

Six Best Practice Steps for Compliant Badge Scanning

These six steps create a defensible compliance posture for event lead capture that covers the most common requirements across US, Canadian, EU, UK, and other major markets. They do not substitute for qualified legal advice specific to your programme.

• Ask before scanning. Always get the attendee’s verbal acknowledgement before scanning their badge. “May I scan your badge to follow up with you?” takes three seconds and creates the clearest possible consent record. Any decline should be respected immediately.
• Record the consent context in every lead record. BoothMaven records event name, scan date, and data source (badge scan, card OCR, QR form, manual entry) in every CRM record at sync. This data origin record supports GDPR LIA documentation, CASL consent date tracking, and CCPA data source disclosure.
• Include a privacy notice link in the first follow-up email. A single footer line — “How we handle your data: [URL]” — satisfies GDPR transparency requirements for most B2B contexts and is good practice globally.
• Provide a working opt-out in every commercial email. Required by CAN-SPAM, CASL, and implied by GDPR legitimate interest. Use an email platform with a native unsubscribe footer. Process opt-out requests within 10 business days.
• Do not share or sell event contact data to third parties without disclosure. Attendees consented to exhibitor follow-up — not to data sharing with other commercial parties. Any sharing requires separate disclosure and a valid lawful basis in GDPR, CASL, and CCPA contexts.
• Define and apply a data retention policy. Contacts who have not engaged with any outreach after two to three years and who have not become customers should be reviewed for deletion or suppression. GDPR, PIPEDA, and most state privacy laws include data minimisation and retention limitation principles.

Badge Scanning and Privacy Law in India, UAE, and Other Markets

As exhibitors increasingly attend events across Asia, the Middle East, and other emerging markets, awareness of local data protection frameworks is becoming more important. The following is a brief orientation to the key frameworks in the most commercially significant non-Western markets for trade show exhibitors. It is not legal advice — verify applicable requirements with qualified counsel in each jurisdiction before conducting lead capture in these markets.

India: DPDP Act 2023

India’s Digital Personal Data Protection (DPDP) Act, enacted in August 2023 with implementing rules and enforcement regulations still being phased in, establishes a framework for the processing of digital personal data in India. Key provisions relevant to trade show exhibitors: processing of personal data requires consent or falls within a set of defined legitimate uses; individuals have rights to access information about their data and to withdraw consent; and data fiduciaries (those who determine the purpose of data processing) must implement reasonable security safeguards.

For exhibitors at Indian exhibitions — at Pragati Maidan, BIEC, or HITEX — the DPDP Act creates obligations for those who collect and process personal data of Indian residents. The implementing rules, including specific obligations around consent notices and processing records, were still being finalised as of mid-2026. Exhibitors with significant Indian market operations or large volumes of Indian contacts should monitor DPDP rule-making closely and obtain qualified Indian legal advice before the rules come fully into effect. In the interim, applying GDPR-equivalent practices — asking before scanning, providing a privacy notice reference, offering an opt-out — represents a reasonable interim posture.

UAE: Federal Data Law No. 45/2021

The UAE’s Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) came into effect in 2022 and establishes data protection requirements broadly similar to GDPR in structure: lawful basis for processing, data subject rights, cross-border transfer restrictions, and security obligations. For exhibitors at UAE events — GITEX, Arab Health, The Big 5 — the law requires that personal data processing have a lawful basis (consent or legitimate interest in qualifying circumstances), that individuals be able to exercise their data rights, and that data be protected from unauthorised access.

Exhibitors attending Dubai-based events for the first time should review the UAE law’s applicability to their lead capture activities with qualified UAE legal counsel. The UAE has a relatively active regulatory environment for data protection, and the Dubai International Financial Centre (DIFC) — where some financial services events are hosted — operates under its own data protection law that is separate from the federal law.

Practical approach for multi-market exhibitors

For exhibitors attending events across multiple jurisdictions in the same year, maintaining a single high-standard global practice — equivalent to GDPR — is more practical than tracking jurisdiction-specific requirements for each show. Ask before scanning at every event globally; record consent context in every lead record; provide privacy notice access in every first follow-up email; offer an opt-out in every commercial email; do not share data externally without disclosure. This approach satisfies the most restrictive requirements (GDPR, CASL) and creates a compliant baseline for jurisdictions with lower current requirements. As regulations in India, UAE, and other markets mature, the GDPR-equivalent practice will already meet or exceed the emerging requirements.

Healthcare and Sensitive Context Badge Scanning: Extra Caution Required

Standard B2B trade show badge scanning becomes more legally sensitive in two specific contexts: healthcare and medical congresses (where attendee professional credentials, specialities, and institutional affiliations may constitute regulated professional data in some jurisdictions), and events targeting consumers rather than B2B buyers (where consumer protection laws and consent standards are typically stricter than B2B frameworks).

Medical congress exhibitors

At medical congresses and healthcare conferences — HIMSS, Arab Health, BIO International, ESMO — exhibitors are typically life sciences, medical device, or health technology companies. Some jurisdictions have specific rules about how pharmaceutical and medical device companies may interact with healthcare professionals, including restrictions on personal data collection and use in the context of healthcare professional marketing. The ABPI Code of Practice (UK), EFPIA Code (EU), and state-level pharmaceutical marketing regulations in the US all impose requirements beyond general data protection law. Exhibitors from regulated life sciences sectors should verify with their compliance and legal teams that badge scanning and follow-up practices comply with applicable industry codes as well as data protection law.

Vocabulary note relevant to compliance: at medical congresses and healthcare conferences, the correct term is “congress stand” or “exhibition stand” — never “trade show booth.” This vocabulary distinction reflects the professional context of the event, which is also relevant to the nature of the consent being obtained: a healthcare professional at a medical congress is engaging in a professional clinical or scientific context, and the consent expectations differ from a general trade show interaction.

Events with consumer attendees

Most B2B trade shows and conferences have predominantly business-attending audiences — procurement professionals, executives, technical evaluators. Some events blur the B2B/B2C line: large technology expos, automotive shows, and home improvement exhibitions may have significant proportions of consumer attendees alongside trade visitors. Where consumer attendees are present, consent standards are typically higher, the “legitimate interest” basis for GDPR processing is harder to justify, and consumer protection laws may impose additional obligations. Exhibitors at mixed B2B/B2C events should seek advice on whether their standard B2B lead capture practices are appropriate for the consumer segment of the audience.

Frequently Asked Questions

Conclusion

Badge scanning at trade shows is generally legal. The scan itself — accessing contact data the attendee provided at registration under organiser terms that disclose exhibitor access — is rarely where privacy law creates issues. What matters, and what varies significantly across jurisdictions, is what exhibitors do with that data after the scan: how they follow up, what their emails contain, how they handle opt-outs, how long they retain the data, and how they document the consent.

The six best practice steps in this guide — ask before scanning, record consent context, include a privacy notice link, provide a working opt-out, do not share data without disclosure, and apply a data retention policy — represent a reasonable compliance foundation for most exhibitors at most events. For programmes spanning multiple international jurisdictions or targeting large EU, UK, or Canadian audiences, qualified legal review specific to your programme is essential. This guide is not that review.