Programmatic advertising campaign review workflow

A media team has assembled a proposed programmatic advertising campaign: named audience segments, consent-based data, a model that may infer interests, and creative carrying performance claims. This worked review follows the file from intake to sign-off, showing how the reviewer records audience, consent and inferred-data checks. Substantiation and policy monitoring sit alongside the review as separate team controls.

The audience file reaches the desk

The reviewer opens the proposed audience file before activation and records what each segment uses. Consent-based data, an audience model and performance claims are present in this worked scenario; no brand or campaign result is assumed.

The first decision is whether every segment has a documented lawful basis under UK GDPR Article 6.

The ICO guide to lawful basis says a basis must be identified before processing and documented. For this England media buy, the UK programmatic rules guide maps obligations to practical controls. The reviewer writes the exact basis beside each segment rather than treating the campaign as one undivided audience.

The reviewer records the selected lawful basis for each segment. For advertising, the file considers consent or legitimate interests; where it relies on legitimate interests, the reviewer completes and retains a balancing test.

Permission follows the signal

Next, the reviewer traces storage and access on the user's device, then follows the consent record when data moves to third parties. This tests PECR as well as whether UK GDPR consent is valid. A consent label in a segment description does not complete that end-to-end review.

The reviewer records PECR regulation 6 as part of the check on storage and access on terminal equipment. The ICO online advertising guidance says this covers ad selection, delivery, tracking and profiling.

If consent-based data is passed to third parties, the persons consent must cover that chain. The party that collected it must tell those third parties when consent is no longer valid. The reviewer tests a sample of live traffic monthly, while the UK consent explainer explains how a signal travels through the bidstream.

UK GDPR Article 4(11) and Article 7 require consent to be freely given, specific, informed and unambiguous, with evidence that it exists. Consent fails when there is no real choice; do not make it a service condition when the data is unnecessary.

The model output is screened

At the model review, the reviewer asks whether anyone will be treated differently because of an inference connected to a protected category. Every audience segment is screened before activation.

The screen covers:

In this worked file, the reviewer finds a segment assigned inferred political interests for advert targeting. The segment is excluded by default and the decision recorded; the data protection review covers the wider process. If the campaign proposes to process this data, the reviewer must record an applicable UK GDPR Article 9(2) condition as well as an Article 6 lawful basis. For this scenario, the route considered is explicit consent under Article 9(2)(a); unless valid explicit consent covers this processing, the segment stays excluded.

The sign-off record captures the decision

The reviewer records the outcome of each review check and names an evidence owner. A red result blocks launch until its gap is closed. The scoring is repeated at every new campaign launch, each quarterly review and after any platform or regulator change. Monthly consent-signal testing is a separate control, not a substitute for launch sign-off or rubric scoring.

Creative sits beside, not inside, the legal checks: keep substantiation for every performance claim, price comparison and testimonial before an advert runs, in line with the disclosure policy. Assign one owner to review platform and regulator updates monthly and log changes affecting live campaigns. These are team-set controls and good practice.

Apply the rubric at setup and each quarterly review, then repeat the scoring at every new campaign launch and after any platform or regulator change. One red blocks launch until the gap is closed. The same thresholds are used at setup and during later reviews.

Use the quality checklist as the working record and the launch review to identify who signs it off. For each campaign, record the campaign and audience segment; the data source and intended use; the Article 6 basis and its evidence; and, where legitimate interests is used, the completed balancing test. Also record the device storage and access check, the consent evidence and recipients, and the result of the monthly live-traffic test. If special-category data is identified, record the applicable Article 9(2) condition and evidence; for inferred political opinion, include evidence of explicit consent under Article 9(2)(a) if that is the condition relied on. Record the substantiation for creative claims, the evidence owner, reviewer, date, result and any outstanding action. The compliance lead signs the checklist, the media buying team supplies evidence, and one accountable person is named. A red result blocks launch until its gap is closed. Dated records identify the owner, control tested and result; a traceable consent record or signed balancing test is stronger than written assurance.

The review record carried forward

The campaign review produces a record, not a general assurance: each segment has a named basis, consent is evidenced, inferred interests are screened, creative claims are substantiated and a policy owner is named. These controls make the review repeatable at setup and during later reviews.

Data protection law applies UK-wide, but some advertising and licensing rules differ in Scotland, Wales and Northern Ireland; check the devolved position before campaigns outside England. This is general guidance only, so take advice from a qualified adviser where special category data, financial promotions or political advertising are involved.