Yes, retargeting is legal under GDPR and other privacy laws as long as businesses comply with the regulations. This means having a clear privacy policy that informs users how their data is being collected and used, including cookies for retargeting purposes. Users should also be given the option to opt-out if they wish.