How UK GDPR and PECR shape video marketing agency audience data

What to take away

Why ICO consent rules sit at the centre of video campaign data

Video campaigns collect more data than most agencies assume. A single embedded player can set cookies, log IP addresses, record watch time and pass a device identifier to an ad platform. Add a lead form and you have names, job titles and email addresses in the same workflow.

That combination makes the Information Commissioner's Office the main regulator for your campaign data. The ICO enforces the UK GDPR and the Privacy and Electronic Communications Regulations, usually shortened to PECR, across the whole of the UK, from Greater London and the South East to Scotland, Wales and Northern Ireland.

The ICO's UK GDPR guidance and resources | ICO sets out the principles you have to meet. The first group covers lawfulness, fairness and transparency, plus purpose limitation and data minimisation. Accuracy, storage limitation, and integrity and confidentiality complete the list. Accountability runs across all of them.

Consent sits at the centre because it is the basis most video teams reach for by default. It is also the hardest to get right. ICO consent must be freely given, specific, informed and unambiguous, shown by a clear affirmative action. Boxes already ticked, lack of response and combined conditions are not sufficient.

For agencies, the practical consequence is record keeping. If a client asks in month nine why a named contact received a retargeting ad, you need to show what that person agreed to, when, and what wording they saw. Without that trail, the consent claim fails.

Most agencies doing this work for the first time run a short set of data protection checks before any campaign goes live. That habit is cheaper than rebuilding a consent record after a complaint.

Where agencies commonly get it wrong

The failures cluster. Teams treat a newsletter opt-in as permission for paid social targeting. They assume a business email address is not personal data. They let a media buyer accept platform terms that shift controller duties onto the agency.

Each of those assumptions breaks under ICO consent rules. A work email identifies a person, so it is personal data. A newsletter opt-in covers the newsletter, not a lookalike audience. Platform terms do not override UK law.

Lawful bases for video marketing agency audience data under UK GDPR

Consent is one of six lawful bases. The ICO's Sending direct marketing: Choosing your lawful basis | ICO explains that the right choice depends on your purpose, your relationship with the person and the channel you plan to use.

For marketing work, the realistic shortlist is consent and legitimate interests, with contract occasionally relevant for existing customers. The table below sets out each option and where it fits.

The channel decides more than the basis does. PECR bans unsolicited electronic mail marketing to individuals without consent, regardless of what your UK GDPR basis says. Legitimate interests can support B2B email to corporate subscribers, but the soft opt-in and the corporate subscriber definition both need checking case by case.

In practice, most agencies use legitimate interests for narrow B2B outreach and consent for everything consumer-facing, cookie-based or platform-targeted. Document the balancing test for legitimate interests: what you want to do, why it is necessary, and why it does not override the person's interests.

Agencies that handle this without in-house counsel often start with UK regulations without a legal team, which walks through the same decisions in plain terms.

Legitimate interests is not a free pass

The ICO expects a three-part test: identify a legitimate interest, show the processing is necessary for it, and balance it against the individual's rights. Write it down before the campaign, not after a complaint.

People can object to processing based on legitimate interests at any time. If they do, you must stop unless you can show compelling grounds that override their interests. For marketing, that is a high bar.

PECR cookies, pixels and video embeds: what storage and access technologies require

PECR sits alongside UK GDPR and covers storage and access on a user's device. The ICO's Guide to Privacy and Electronic Communications Regulations | ICO explains the rules for cookies, tracking and electronic marketing.

The core rule is simple to state. You need clear and comprehensive information, plus consent, before storing information on someone's device or accessing information held there from an earlier visit. That covers cookies, pixels, local storage, device fingerprinting and SDK identifiers in apps.

The ICO's Guidance on the use of storage and access technologies | ICO is the document to work from. It applies the same standard to new techniques as to cookies, so a script that captures a canvas fingerprint needs consent just as a cookie does.

Video embeds are a frequent blind spot. A YouTube or Vimeo embed can set cookies and log viewing behaviour before the visitor presses play. If your cookie banner has not run first, that is storage without consent.

The usual fix is a click-to-load placeholder. The visitor sees a thumbnail and a short notice, and the third-party player only loads after they interact. That keeps the embed from setting anything on first page view.

The strictly necessary exemption

The exemption is narrow. It covers storage that is essential to provide a service the user asked for, such as a shopping basket or a security token. Analytics, advertising and most personalisation do not qualify.

The ICO has been clear that analytics cookies generally need consent, even where the data is aggregated. If you rely on the exemption, be able to justify it in one sentence that a regulator would accept.

What a compliant banner needs

Withdrawal has to be as easy as giving consent. If the reject button takes three clicks and the accept button takes one, the banner fails the fairness test.

Building a consent flow for video marketing agency lead capture

A consent flow is a sequence, not a checkbox. Build it once, reuse it across campaigns, and keep the wording under version control.

That sequence covers most of what the ICO looks for. It also creates the audit trail you need if a complaint arrives a year later.

Joint controller questions

When you run video campaigns for a client, both parties may be controllers for the same data. Set out who decides purposes, who handles requests, and who answers complaints in the contract.

Without that, a data subject request can fall between you. The ICO treats unclear allocation as a governance failure, not a paperwork slip.

Suppression and retention

Keep a suppression list of people who have opted out or objected. Retain it even after you delete the rest of the record, so you do not contact them again by accident. Set a retention period for campaign data and stick to it.

Good audience research feeds directly into this. The clearer your picture of who you are contacting, the easier it is to pick a basis and write honest consent wording.

Data broker and third-party audience targeting obligations

Buying audience segments does not transfer responsibility. If you use a purchased list or a data broker's segment to build a video campaign audience, you are processing personal data and you need your own lawful basis.

Do the checks before the money moves. Ask the seller what basis they relied on, how the people were told about onward sharing, and whether consent covered marketing by third parties. Vague answers are a warning sign.

For email and SMS, PECR is strict. Consent must name your organisation or describe the category of organisations clearly enough for a person to understand who will contact them. A generic phrase like "selected partners" does not meet that standard.

For paid social and programmatic video, the platform usually acts as a processor or an independent controller for its own purposes. Check the platform terms, because the split affects who answers a complaint and who carries the fine.

Audience matching tools that upload hashed email lists carry the same duty. The hash does not make the data anonymous, because the platform can re-identify it. You still need a valid basis and a privacy notice that mentions the practice.

Agencies serving clients across the UK often fold these checks into a wider review of UK rules and ethics, which covers the ASA and CAP Code alongside data rules.

Due diligence questions for brokers

International transfers

Many brokers and ad platforms process data outside the UK. Check the transfer mechanism, such as an adequacy finding or the International Data Transfer Agreement, and record it. Transfers without a documented safeguard are a straightforward compliance gap.

Children's data and age assurance in video campaigns

Video audiences skew young, and some campaigns reach children directly. The ICO's children's code sets standards for services likely to be accessed by children, including default high privacy settings and data minimisation.

UK GDPR consent for information society services offered directly to a child requires parental consent below the age of 13 in the UK. That threshold matters for apps, games and interactive video experiences, not just websites.

Age assurance is the practical control. If a campaign targets a channel with a large under-13 audience, decide whether you will age-gate, use platform age signals, or avoid the placement altogether.

Advertising rules layer on top. The CAP Code requires particular care with ads directed at children, and age-restricted products carry their own restrictions. Data compliance does not excuse a creative that breaches those rules.

Keep children's data out of retargeting pools by default. A child who watches a video should not end up in a lookalike audience built for adult products.

If your personas include younger viewers, audit them properly. The target audience work you do should flag age bands where consent and assurance rules change.

Breach reporting and the data protection fee for video marketing agencies

Two administrative duties catch agencies out. The first is the data protection fee. Most organisations processing personal data must pay an annual fee to the ICO, with the tier based on size and turnover. Non-payment can attract a penalty.

The second is breach reporting. If a breach is likely to result in a risk to people's rights and freedoms, you must report it to the ICO within 72 hours of becoming aware of it. If the risk is high, you must also tell the affected people without undue delay.

For agencies, the likely breach scenarios are familiar: a misconfigured audience upload, a tag that fired before consent, a list of leads emailed to the wrong client, or a platform account accessed without two-factor authentication.

Have a one-page incident plan. It should name who decides whether to report, what information to gather in the first hours, and how you will record the decision either way. Even a decision not to report should be logged with reasons.

What to include in a breach record

Keep the record even for near misses. The ICO expects accountability, and a documented near miss shows your controls are working.

Auditing campaign compliance with the ICO direct marketing checklist

The ICO's Direct marketing checklist | ICO is the most useful single document for an agency audit. Work through it before a campaign goes live and again at quarter end.

Score each item red, amber or green and put a named owner against every red. An audit without owners is a paper exercise.

A worked example

A Manchester agency runs a video campaign for a retail client. The audit finds three issues: the Vimeo embed loads before consent, the lead form bundles newsletter and retargeting consent into one box, and no one checked the broker's basis for a purchased segment.

The fixes are small. Add a click-to-load placeholder. Split the consent box into two purposes with separate records. Ask the broker for the consent wording and drop the segment if it cannot be produced. Total effort: under a day.

That is the pattern. Most gaps are configuration, not strategy, and they are cheapest to close before the first ad impression.

Keeping the audit live

Re-run the checklist whenever a tag, platform or supplier changes. Campaign tooling changes often, and each change can quietly break a consent flow that passed last quarter.

Common questions

Official sources

• ICO guide to Privacy and Electronic Communications Regulations
• UK GDPR Article 8 on child's consent for information society services