Rules and ethics
Part of Customer data platforms rules and ethics: UK guide
Customer data platforms advertising rules: UK checklist
Customer data platforms advertising rules: a UK pre-release checklist for CDP audiences, covering UK GDPR, PECR, consent, claims and accessibility.
Use this customer data platforms advertising rules checklist before an audience leaves a customer data platform for advertising or direct marketing. It is a pre-release checklist, not legal advice.
This checklist is for proposed operations based in England; the ICO, CAP and CMA material cited here applies across the United Kingdom where relevant. A tick is evidence of a completed control, not a compliance certificate.
What to take away
- Classify public advertising, targeted advertising, service messages and promotional electronic communication separately.
- Match every objective accuracy, performance or outcome claim to evidence held under CAP Code Section 3.
- Give privacy, PECR, advertising, consumer and accessibility reviewers separate authority to hold release.
Audience creation
- Create an audience record naming each data source, identifier, join, profile field, inference and segment rule; record the purpose, responsible legal entities, recipients, retention and transparency information.
- Identify the UK GDPR lawful basis for each purpose. Where relying on legitimate interests, record the purpose, necessity and balancing tests in a legitimate interests assessment; where relying on consent, retain the wording, scope, affirmative action and withdrawal state. Do not treat a UK GDPR lawful basis as permission under PECR.
- Screen whether a data protection impact assessment (DPIA) is required; complete one before processing where the processing is likely to result in a high risk, and record the risks and mitigations.
- Preserve uncertainty and false-match correction rather than treating an inferred attribute as fact.
- Keep refused, objected, suppressed, deleted and unknown states distinct and traceable; record the suppression identifier, channel, reason and current status.
Keep the audience record, DPIA screening or completed DPIA, PECR technology assessment and suppression list as linked evidence. These are working records, not a single prescribed form: each should identify the audience or technology reviewed, the decision, supporting evidence, owner and any conditions.
The ICO's data-protection principles guidance supports purpose limitation, minimisation and accuracy review. It does not authorise an audience because a platform can build it.
Apply the UK GDPR and Data Protection Act 2018 to the personal data processing. For each purpose, document the Article 6 lawful basis; if it is legitimate interests, the record should show the purpose, why the processing is necessary and why the interests do not override the individual’s rights and interests.
Check whether the controller must pay the ICO data protection fee or is exempt, and retain the self-assessment result. GOV.UK fee guidance says the annual fee depends on size and turnover: it is £52 or £78 for most organisations, including charities and small and medium-sized businesses, and can be up to £3,763 for businesses that employ many people and have a high annual turnover.
Collection and targeting technologies
- Inventory pixels, tags, scripts, software development kits, link decoration and device access.
- Record each technology, provider, purpose, trigger, user control and the consent state at the point it operates.
- For storage of or access to information on terminal equipment, assess whether PECR regulation 6 applies; record prior consent or the specific exemption relied on and why it applies.
- Complete a separate PECR assessment that identifies the technology, purpose, trigger, consent evidence or exemption, and any user choice that stops it.
- Recheck the ICO's storage and access technologies guidance before release.
Labels such as first-party, server-side or consented do not settle the question. A technical setting cannot replace the reviewer decision.
Apply the same evidence test in the actual systems used. For example, record the segment definition, activation mapping and consent or suppression state in Salesforce Data Cloud or Adobe Real-Time CDP, then record the audience source, exclusions and campaign settings in Google Ads or Meta Ads Manager. A platform name or setting is not, by itself, evidence of permission.
Illustrative example: a retailer builds a CDP segment of customers who viewed a product page. Before activation, the team inventories the pixel, tag and SDK on that page.
It records the provider, purpose and trigger, then completes a PECR assessment for each storage or access technology. If the team cannot evidence prior consent or a specific applicable exemption under regulation 6, the reviewer with delegated PECR authority holds release and records the reason in the release record.
Communication route
- Identify channel, subscriber category, sender and purpose; check objections and the maintained suppression list at audience build and every activation.
- Treat research participation and later promotional contact as different permissions.
Use the ICO's direct marketing guidance and assess the actual channel under PECR, including applicable changes made by the Data (Use and Access) Act 2025. For electronic mail to individual subscribers, regulation 22 generally requires prior consent; the soft opt-in is limited to details obtained during a sale or negotiations for a sale, marketing the sender's own similar products or services, and giving a simple opt-out when details are collected and in every message.
Record which regulation 22 route applies and the evidence for it. A UK GDPR legitimate interests assessment does not replace PECR consent or establish that the soft opt-in conditions are met.
Final advert and claims
- Save the final creative, landing page, audience definition, exclusions and settings as one evidence bundle.
- Make the commercial nature recognisable where required under CAP Code Section 2 (Recognising marketing communications and identifying the marketer).
- Hold evidence matching every objective accuracy, performance or outcome claim under Section 3 (Misleading advertising).
- Keep qualifications close enough to the claim to inform the overall impression.
- Do not use a CDP segment as proof that a claim applies to the recipient.
CAP is an advertising code. It does not provide a data-protection permission or determine consumer law.
Build a claim register before approval, recording objective or subjective per statement, plus likely audience impression and source evidence. Then note population, date, conditions and material limitation.
Illustrative example: a retailer creates a CDP segment of past buyers for a running shoe. The advert says the shoe is the most cushioned in the range.
The claim register lists that statement as objective and records the model comparison, test date, population and limitation. The evidence bundle holds the final creative, landing page, audience definition, exclusions and settings. If the evidence supports only one model, the qualification stays next to the claim.
Claims about match accuracy, audience quality, incremental results or customer behaviour need evidence suited to those exact words. A supplier case study or modelled platform output should remain attributed and bounded; it is not automatically proof for the advertiser's configuration.
Preview every placement and destination. Check that the disclosure, qualification and correction route remain visible on the device and format actually used. Save the rendered advert, not merely the approved copy. If an advertising platform changes cropping, labels or audience options, reopen the affected review.
Consumer and accessibility review
- Check the overall journey against the CMA's Unfair commercial practices: CMA207 guidance and the Digital Markets, Competition and Consumers Act 2024 regime where consumers are affected.
- Identify the accessibility duties and benchmark relevant to the service: consider the Equality Act 2010, test against WCAG 2.2 AA, and use EN 301 549 where applicable. For a public-sector website or mobile application, check the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018; do not imply that WCAG 2.2 AA is a universal statutory advertising rule.
- Record conflicts, paid relationships, material limitations and correction routes.
The privacy reviewer checks the UK GDPR basis and DPIA decision; the PECR reviewer checks regulations 6 and 22; the advertising reviewer checks the CAP Code; the consumer reviewer checks the applicable CMA requirements; and the accessibility reviewer checks the identified duties and benchmark. These are internal delegated release gates, not statutory appointments: the controller remains responsible, and no sign-off makes unlawful processing or marketing lawful.
Stop if the audience provenance is incomplete, the Article 6 basis or PECR consent or exemption cannot be evidenced, suppression cannot be proved, a claim lacks matching evidence or a material disclosure disappears in the final rendering. Reopen the checklist when data, targeting, creative, destination or law changes.
Before you act
- Confirm the release record has all five reviewer sign-offs.
- Confirm the evidence bundle is saved and linked from the release record.
- Confirm no open stop condition remains.
Common questions
What must be recorded when creating an audience in a customer data platform?
The audience creation record holds the provenance chain: sources, identifiers, joins, segment rule, purpose, Article 6 basis, transparency information, recipients and retention. Preserve uncertainty and false-match correction rather than treating an inferred attribute as fact. Link the record to DPIA screening or a completed DPIA, the PECR assessment and the suppression list, keeping refused, objected, deleted and unknown states distinct and traceable.
How should communication routes be classified before sending?
Classify the channel and subscriber category, then identify the sender, purpose and applicable objection or suppression. For electronic mail to individual subscribers, record whether prior consent or the PECR regulation 22 soft opt-in applies and retain evidence of the relevant conditions. Treat research participation and later promotional contact as different permissions.
What evidence is needed for claims in the final advert?
Use the claim evidence rule in What to take away. Keep qualifications close enough to the claim to inform the overall impression. Do not use a CDP segment as proof that a claim applies to the recipient. Build a claim register before approval.
