How UK GDPR and PECR change a media buying brief

What to take away

Where UK GDPR and PECR sit in a media buying brief

Two rulebooks apply to almost every UK campaign. UK GDPR and the Data Protection Act 2018 set the general duties: lawful basis, transparency, data minimisation and rights. PECR adds specific rules for cookies, tracking and electronic marketing. A brief that ignores either will fail at planning or at audit.

UK GDPR applies to personal data, which includes cookie IDs, device identifiers, email addresses and any data that can single out a person. The retained regulation sets the core obligations on lawful basis, consent and data minimisation that a planner must apply to audience selection, Regulation (EU) 2016/679 (UK GDPR as retained).

If a brief cannot name the lawful basis for a list, the list should not be bought.

PECR sits alongside UK GDPR for electronic communications. It covers cookies and similar storage on a user's device, plus electronic marketing by email, text and automated calls. The ICO's Guide to Privacy and Electronic Communications Regulations | ICO explains the rules that shape what a brief can ask for.

PECR consent must meet UK GDPR standards: freely given, specific, informed and unambiguous.

The brief is where these rules become practical. It should state which data enters the campaign, where it comes from, what it is used for, how long it is kept and who is accountable. That is why a campaign data map belongs in the brief, not in a post-campaign review.

Agencies also work with platform policies that overlap with UK law. A brief should separate legal duties from platform terms. That way a rejection by one ad platform is not mistaken for a legal breach, and a legal duty is not missed because a platform allows it. Sorting UK codes from platform policies early prevents wasted planning cycles.

Lawful basis choices for audience data and campaign lists

UK GDPR requires a lawful basis for any processing of personal data. For marketing, the common choices are consent, legitimate interests and, less often, contract or legal obligation. The brief should name one basis per purpose, not one per campaign.

Consent is the safest basis for electronic marketing to individuals, especially email and SMS. It must be recorded, specific and easy to withdraw. A brief should state where consent was captured, what the user was told and when it was given. Without that record, a list is a liability.

Legitimate interests can support some direct marketing by post and some online advertising, but it requires a balancing test. The ICO's Sending direct marketing: Choosing your lawful basis | ICO sets out how to choose and document that basis.

The brief should include the outcome of the balancing test, not just a claim that it was done.

The soft opt-in is a narrow exception for email and SMS. It applies where a business obtained contact details in a sale, offers similar products and gave an opt-out at collection and in every message. It does not cover bought lists or unrelated brands. A brief should not rely on it unless those conditions are met.

B2B marketing is not exempt. Sole traders and some partnerships are treated as individuals, and corporate subscribers still have rights. A brief should record whether the audience is corporate or individual and which basis applies to each segment.

Consent for cookies and ad tech under PECR

PECR requires consent for storing or accessing information on a user's device, with one exception: strictly necessary cookies. Analytics, advertising, attribution and most measurement tags are not strictly necessary. They need consent before they run.

Consent must be granular where purposes differ. A banner that bundles advertising, analytics and personalisation into one switch is not valid. The brief should list each tag, its purpose and the consent category it sits in. If a vendor cannot explain its purpose, it should not be in the plan.

Consent must be collected before the tag fires. That means the tag management setup, the consent management platform and the media plan must agree on order of operations. A brief that asks for immediate pixel firing on page load is asking for a breach.

Withdrawal must be as easy as giving consent. The brief should name the route: a persistent settings link, a preference centre or a one-click opt-out. It should also state how withdrawal propagates to downstream platforms and data stores.

Ad tech vendors act as processors or joint controllers depending on the setup. The brief should identify the role of each vendor and the contract that covers it. Where a vendor uses data for its own purposes, that changes the risk and the paperwork.

Measurement is not exempt. Attribution windows, view-through tracking, cross-device graphs and audience extension all rely on device storage or access. Each needs a consent basis or a documented exemption. The brief should say which measurement methods are allowed and which are out of scope.

ICO guidance on storage and access technologies

The ICO has published detailed guidance on cookies and similar technologies. It covers what counts as storage or access, what consent looks like and how to handle exceptions. The Guidance on the use of storage and access technologies | ICO is the practical reference for tag-level decisions.

The guidance makes clear that consent must be unambiguous and based on clear information. Pre-ticked boxes, silence and continued browsing are not consent. A brief should specify the consent wording and the categories shown to users, not leave them to a vendor default.

The strictly necessary exception is narrow. It covers things like security, load balancing and remembering basket contents. It does not cover analytics, advertising or most personalisation. A brief should not accept a vendor's claim that its tag is strictly necessary without evidence.

The guidance also covers device fingerprinting and other techniques that access a device without a cookie. If a plan uses fingerprinting, the brief must treat it like a cookie and secure consent. The same applies to pixels, SDKs and server-side tagging that reads or writes to a device.

Consent records matter. The brief should require a log of what each user saw, what they chose and when. That log is the evidence if a complaint arrives. It also supports the transparency duty under UK GDPR.

Data broker and B2B audience data in a media plan

Data broker audience data is a common shortcut to scale, and a common source of risk. The ICO has specific expectations for organisations that buy marketing services from data brokers.

The Organisations using marketing services of data brokers: what you need to know | ICO sets out the checks a buyer should make before using those segments.

The brief should require the broker to confirm the lawful basis for the data, the source of consent or other basis, and the purposes allowed. It should also require audit rights and a clear description of any onward transfers. A broker that cannot answer these questions should not be in the plan.

B2B audience data is not automatically safer. Corporate subscribers have PECR rights, and sole traders and some partnerships are treated as individuals. The brief should separate corporate and individual records and apply the right basis to each.

Where a broker segment is used for lookalike modelling, the brief should state whether the seed data is personal data and how it is protected. It should also cover whether the platform uses the seed for its own purposes. That determines the contract and the consent position.

Retention and deletion should be agreed up front. The brief should say how long broker segments are kept, how they are refreshed and how they are deleted at the end of the campaign. Without that, data lingers in platforms and creates avoidable risk.

What the brief must record for targeting and measurement

A brief is a working document, not a legal opinion. But it should record enough that a planner, a buyer and a compliance reviewer can all see the same picture. The following checklist covers the minimum for a UK campaign that uses audience data.

A worked example shows how this fits together. Suppose a retailer plans a UK campaign with a CRM list, a data broker segment, a retargeting pixel and a measurement tag.

The brief should set out the consent record for the CRM email list, including date and source. It should also cover a legitimate interests assessment for the broker segment, plus contract and audit rights. The retargeting pixel needs a consent category, and the measurement tag needs a consent or exemption basis.

The brief should name the retention period for each data set and the route a user takes to object or withdraw.

Targeting choices follow from those records. If consent is missing for a segment, the segment is out of scope. If a tag cannot fire before consent, the measurement plan must change. A live campaign is not the place to discover that a list has no basis.

Plans that skip this step stall mid-flight on missing consent or on an untraced vendor. The brief should give the buyer clear instructions on what to do when a record is missing, not leave it to judgement during delivery.

Measurement choices follow the same logic. Attribution windows, view-through and cross-device reporting all depend on device storage or access. The brief should say which methods are approved, which need consent and which are not allowed. That prevents a late change that invalidates the consent position.

Handling data subject rights inside a live campaign

Data subject rights do not pause when a campaign goes live. A user can ask for access, erasure, objection or restriction at any time. The brief should name who handles those requests and how they reach the platforms and brokers in the plan.

Access requests need a route to the data held in ad platforms, CRM and broker systems. The brief should list the systems in scope and the owner for each. It should also set a response process that meets the UK GDPR deadline.

Erasure is harder in advertising because data is copied across platforms. The brief should require a suppression list and a process for pushing deletions to vendors. It should also state what happens to aggregated or modelled data that cannot be traced back to a person.

Objection to direct marketing is an absolute right. The brief should require an immediate stop for that person across channels, not just the channel they complained about. That means a shared suppression process, not separate lists per platform.

A live campaign can also reveal gaps. If a vendor cannot support a rights request, the brief should say what happens next: pause the vendor, replace the tag or adjust the audience. Planning for that in advance is cheaper than fixing it mid-flight.

The brief should also record how rights requests interact with consent withdrawal. A withdrawal should trigger the same suppression and deletion steps as an objection. That keeps the campaign consistent and reduces the chance of a complaint escalating to the ICO.

Common questions