The framework
There is no comprehensive data protection statute in Afghanistan.
With no local consent rule, platform policies and the extraterritorial reach of laws like the GDPR govern campaigns here in practice.
Marketing and advertising
No data protection law. With no local statute, the practical guardrails are platform policy and any foreign law that can reach the campaign.
Cross-border transfers
With no data protection law, nothing restricts personal data leaving Afghanistan, and nothing local protects it once it has. The binding transfer rules for most campaigns touching this market come from the origin jurisdiction of the data.
Enforcement and penalties
No penalties exist under a general privacy law, because none exists. Only sectoral, criminal or consumer statutes could reach data misuse in Afghanistan, and enforcement of those against marketing practices is rare.