Four media buying risk scenarios, from missing consent to abused account access

Four risk scenarios for media buying agencies deserve rehearsal for advertisers in England: lawful measurement loses its consent basis, protected audiences receive restricted advertising, an account is compromised, and reported performance cannot be substantiated. Each connects an observable warning to a contained response, and none predicts that an incident will occur.

For an England-based advertiser, the escalation contacts are the advertiser compliance owner, the agency security owner, and the ICO or CAP as relevant.

What to take away

Scenario 1: a measurement design depends on unavailable consent

The campaign plan assumes a pixel, identifier or device signal will be available. During implementation, the consent route does not cover the intended purpose, or a material share of users objects. Reporting and automated bidding then lose an input on which the forecast relied.

In a dashboard, the consent management platform may show no consent recorded for advertising, while the plan assumed a high opt-in rate. An audit sample may then show personalisation rows with no lawful basis recorded.

The UK Information Commissioner's Office guidance on storage and access technologies covers cookies, pixels, fingerprinting, exceptions, consent and online advertising. It was finalised in April 2026. The application of those rules is fact-specific, so obtain qualified advice before launch. Complaints about consent can go to the ICO through its concerns form.

Containment means pausing the affected collection, preserving configuration evidence and switching to an approved measurement route. Escalate when the agency cannot identify the controller, purpose, technology owner or user-choice record. Before approving the plan, ask for a fallback report that does not assume complete tracking.

Scenario 2: an age-restricted advert reaches the wrong audience

A platform setting, inferred-age segment or publisher placement appears to exclude protected groups, yet a complaint or audit sample shows delivery outside the intended audience. The immediate issue is exposure, not whether the campaign average still looks efficient.

In a delivery report, an age-restricted campaign may show a placement row labelled unknown age or a publisher site known for younger audiences, even though the plan said the segment excluded under-18s.

The CAP guidance on age-restricted ads online, refreshed in September 2025, explains responsible targeting in open online environments and social media. Product categories have different rules. A specialist advertising reviewer should confirm the controls that apply to the actual brief. Complaints about a specific ad can go to the ASA through its website.

Stop the affected activity, retain delivery and targeting records, and involve the advertiser's compliance owner. A pre-launch rehearsal should identify who can suspend spend, how exclusions are checked and what evidence the agency will provide after an alert.

Scenario 3: privileged access to a buying account is abused

An unexpected administrator appears, a campaign changes outside the approval window or logs become unavailable. Treat any of these as a security event rather than a routine trafficking error until investigated.

In an audit log, a new administrator account may appear at 02:00, or a campaign budget may change outside the approval window, with no change ticket attached.

The UK National Cyber Security Centre guidance for Software as a Service recommends modern authentication including multi-factor authentication, controlled privileges, protected activity logs and incident preparation. It does not certify an advertising platform or agency. Cyber incidents can be reported to the NCSC through its website.

Disable suspect access through the agreed emergency route, preserve logs outside the affected account and contact the named security owners. The contract and operating plan should say who controls administrator identities, how departing staff are removed and how long useful audit records remain available.

Scenario 4: a result claim outruns the evidence

A report attributes revenue to media even though conversion definitions changed, source data is incomplete or the analysis cannot separate correlation from causation. Pressure to present a positive result may then turn a measurement weakness into a misleading commercial claim.

In a dashboard, revenue may be attributed to a campaign even though the conversion definition changed mid-flight and the source export no longer matches the approved specification.

The UK CAP Code on non-broadcast advertising requires advertisers, agencies and media to follow its rules, including substantiation requirements in the misleading advertising section. Whether a particular claim complies needs case review. Complaints about misleading claims go to the ASA, which can require evidence and publish a ruling.

Quarantine the statement, keep the underlying exports and compare them with the approved measurement specification. Escalate if a public claim has already run, material definitions were changed without approval or no one can reproduce the calculation. A corrected dashboard is not enough if the same wording remains in adverts or sales material.

Run a short rehearsal

Choose the scenario closest to the planned campaign and walk through the first hour. Name the person who can stop activity, the records to preserve, the client decision owner and the threshold for specialist advice. Repeat the exercise after a major platform, regulatory, staffing or access-control change. The value lies in a practised response, not a decorative risk register.

Common questions

What should happen when a measurement design depends on consent that is not available?

Scenario 1 covers the consent test. The ICO guidance on storage and access technologies is the UK reference.

How should an agency respond when privileged account access is abused?

Scenario 3 covers the security response. The NCSC guidance for Software as a Service is the UK reference.

What makes a result claim unsafe to publish?

Scenario 4 covers the substantiation test. The CAP Code on non-broadcast advertising is the UK reference.