Rules and ethics
Part of How does GDPR consent for programmatic advertising work in the UK?
How does GDPR consent for programmatic advertising work in the UK?
UK GDPR consent for programmatic advertising: how ICO rules, PECR and the IAB TCF shape publisher and agency buying across display, video and app inventory.
What to take away
- UK GDPR consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes, silence and inactivity do not count.
- PECR adds a separate rule for storing cookies and similar identifiers on a device, so most programmatic tags need clear notice and a lawful basis.
- The IAB TCF is an industry framework for passing consent signals, not a legal safe harbour. Publishers remain accountable for how vendors use those signals.
- Advertisers should check contractual warranties, consent strings and vendor lists before buying UK inventory.
Where UK GDPR consent sits in programmatic buying
The core rulebook is the UK GDPR, which applies to personal data processed in the UK and sets the standard for valid consent.
UK consent rulebooks
UK GDPR
- Applies to
- personal data
- Requires
- valid consent
- Scope
- UK processing
PECR 2003
- Applies to
- cookies, pixels, IDs
- Requires
- consent for storage
- Scope
- device access
ICO guide
- Applies to
- consent tests
- Requires
- withdrawal, records
- Scope
- practical guidance
Cookies, pixels and device identifiers fall under the Privacy and Electronic Communications Regulations 2003. This sits alongside the UK GDPR and requires consent for most non-essential storage or access.
The guide to the UK GDPR from the Information Commissioner's Office sets out the tests for valid consent, including withdrawal and records.
How consent travels through the bid stream
A bid request may include a consent string, which records the user's choices by purpose and vendor. The IAB TCF is the common structure for that string in the UK and EU.
Consent in the bid stream
- User makes purpose-specific choices
- CMP records choices in consent string
- Bid request carries the consent string
- Buyer checks purpose consent
- Compliant buyer bids only if covered
If the string says consent is missing for a purpose, a compliant buyer should not use that data for that purpose. In practice, many buyers still bid, which creates risk for publishers and advertisers.
Consent is purpose-specific, not a single yes or no. A user may accept analytics but reject personalised advertising. The bid stream must reflect that split.
What publishers must do
- Audit every tag, pixel, SDK and vendor that can read or write to a user's device, including tags loaded by other tags.
- Map each processing purpose to a lawful basis, then decide where consent is the only realistic route under UK GDPR and PECR.
- Configure a consent management platform that collects specific choices and can pass a valid consent string into bid requests.
- Record what each user saw and chose, with timestamps, so you can prove consent if the ICO or a partner asks.
- Review your global vendor list and contracts at least quarterly, because new partners and purposes change the compliance picture.
Publishers weighing whether to run buying in-house should read our guide to in-house programmatic advertising for UK brands, because consent duties change when you control the tech stack.
What advertisers and agencies should check
Advertisers do not escape responsibility by buying through an agency or DSP. If you set the purposes and means of processing, you may be a controller or joint controller.
Ask for the consent string and check that it covers the purposes you rely on, not just the vendors you use. A vendor list alone is not proof of valid consent.
Before launching a campaign, test the user journey from first banner to bid request. If a consent choice is hard to withdraw, the consent is weak.
Keep a record of your due diligence, including the CMP version, vendor list date and any restrictions you placed on data use.
For a related control, see our guide to programmatic brand safety tools, since consent data and brand safety both depend on clean supply paths.
What goes wrong in practice
Many problems come from tags firing before a user makes a choice. That can breach PECR even if a consent banner appears later.
Another common fault is a consent string that lists vendors but not the purposes a buyer needs. The buyer then relies on a signal that does not match its processing.
Common questions
Does the IAB TCF make consent valid under UK GDPR?
No. The TCF records and transmits choices in a standard format. Legal validity still depends on UK GDPR and PECR, and the ICO can act on poor practice.
What counts as valid consent for programmatic ads?
Consent must be a clear affirmative act, specific to each purpose, and as easy to withdraw as to give. Inactivity, pre-ticked boxes and vague wording fail this test.
Can legitimate interests replace consent for programmatic advertising?
Sometimes for limited processing, but not for storing cookies or similar identifiers without consent under PECR. Targeted advertising often needs consent in practice.
Who is responsible if a vendor misuses consent?
Publishers and advertisers can both be controllers or joint controllers. Contracts, due diligence and records matter, and the ICO enforces against the parties that set the rules.
