The framework
Nauru has no data protection law of general application.
Absent a local rule, the practical constraints come from platform policies and foreign laws with extraterritorial reach.
Marketing and advertising
No data protection framework. With no local statute, the practical guardrails are platform policy and any foreign law that can reach the campaign.
Cross-border transfers
With no data protection law, nothing restricts personal data leaving Nauru, and nothing local protects it once it has. The binding transfer rules for most campaigns touching this market come from the origin jurisdiction of the data.
Enforcement and penalties
No penalties exist under a general privacy law, because none exists. Only sectoral, criminal or consumer statutes could reach data misuse in Nauru, and enforcement of those against marketing practices is rare.