UK: Using retailer audiences outside retail-owned properties

Before a retailer audience is sent to an external ad platform, check whether that particular data use is fair, lawful and clear to the people concerned. A segment’s technical availability is not permission to use it.

Treat this as a decision before data transfer, not as a check of platform eligibility or campaign reach. The ICO’s planning guidance recommends building in data protection and PECR compliance before direct marketing starts.

Describe the actual data flow

Name the retailer, advertiser, activation partner and platform. Record who selects the audience, what personal information or identifiers move between them, whether matching happens on the platform, and who can use the resulting audience.

Record the intended message, destination, geography, retention or refresh period, and whether the use is consistent with what customers were told when their data was collected. A purchase-based segment may involve shopping records, a matched customer list and platform delivery data, so confirm the actual route with the parties involved; do not assume a new advertiser is covered because the retailer calls the data first-party.

Identify whether the information includes personal information, special category data or children’s information. Plan how it will be kept accurate and not retained for longer than needed.

Resolve roles and lawful basis before sharing

Check the UK GDPR and Data Protection Act 2018 requirements for the proposed use. Also assess PECR where relevant to the planned direct-marketing method; the ICO’s guidance separately asks whether electronic mail, including emails and texts, can be used.

Confirm whether the activity is direct marketing. The ICO says this includes promoting aims and ideals as well as selling products and services, and its Direct marketing guidance includes a Plan direct marketing section. Identify and document the data-protection reason (‘lawful basis’) for this particular activity; the guidance has separate sections on consent and legitimate interests.

Record who is responsible for compliance when parties work together and what each party does across collection, audience creation, matching and campaign delivery. Do not assign every party the same role by default.

Have the responsible privacy and campaign owners answer four questions before activation:

These are decision prompts, not a conclusion that consent or any other basis automatically applies. If the parties cannot explain the data flow and their obligations, pause the audience transfer for specialist review.

Lawful bases for direct marketing under UK GDPR and PECR

Keep the activation within the approved use

Check that people were told clearly and fairly how their information would be used for the proposed activity. The ICO’s Direct marketing guidance says to collect information fairly and clearly explain how it will be used; do not assume that an earlier explanation covers a different advertiser or purpose.

People have an absolute right to object to or opt out of direct marketing at any time. Record how objections and opt-outs will be applied, check them before each audience refresh, and prevent people who have opted out from entering the activation.

Write down the approved audience definition, advertiser, platform, purpose, refresh rule and expiry, then compare the final activation request with that record. A broader product category, new platform or reuse for another advertiser should return to the privacy assessment rather than being treated as covered by the original decision.

Keep evidence of the decision and a contact for objections or suppression failures. After the privacy decision, platform availability and reach forecasting are separate checks.

Key compliance indicators for off-site audience activation