When to review programmatic advertising data protection

What to take away

Consent rules that trigger a review

Programmatic buying depends on recognising people, devices or households across sites. Under the Guide to Privacy and Electronic Communications Regulations, storing information on a user's device or accessing information already stored generally requires clear consent, with limited exceptions. That covers cookies, local storage and comparable identifiers used for frequency capping and targeting.

If your consent banner, tag set or vendor list has changed since the last audit, the position has moved and a review is warranted. The same applies when a publisher passes new identifiers into a bid request your team did not previously receive.

Identifiers and lawful basis

The Data Protection Act 2018 sets the statutory framework that sits alongside the UK GDPR, including provisions on the ICO's powers. For advertising teams, the practical question is whether an identifier, alone or combined with other data, relates to an identifiable person.

Hashed emails, mobile advertising IDs and IP addresses can all fall inside that boundary depending on context. When you add a new identifier type to a deal, re-check the lawful basis, the notice given to users and the retention period.

Vendor and contract checks

Every new demand-side or supply-side partner adds a data flow. Before activation, confirm the contract names the roles, purposes and deletion terms, and covers sub-processors and onward transfers.

Map each campaign to the partners that touch personal data. If a partner cannot explain its retention or its lawful basis, pause the integration. The programmatic advertising UK rules and compliance guide sets out how the wider regulatory picture fits together for English agencies and publishers.

Advertising code exposure

The Committees of Advertising Practice codes sit alongside data protection law. The sanctions available to the ASA include published rulings, removal of paid search ads and referrals to other bodies. A data protection failure can become an advertising standards problem if targeting or claims breach the codes.

If a campaign claims a particular audience, the data behind that claim should be documented, not assumed.

Before and after a review

Timing and triggers

Set triggers rather than relying on a calendar. Examples include a new identifier type, a new market or a change in platform policy. Other triggers are a regulator statement, a breach, a near miss, or a campaign aimed at a new audience segment.

For agencies working across England, the programmatic advertising UK regulations in England article explains how England-specific enforcement interacts with the UK-wide framework. Where a rule differs in Scotland, Wales or Northern Ireland, check the relevant regulator page first.

Common questions

Does a programmatic data protection review need to happen every year?

No fixed interval is set in law. Reviews follow change: new identifiers, vendors, audiences or guidance. Many teams pair a light quarterly check with a fuller annual review.

Who is responsible for consent signals in a programmatic chain?

Responsibility is shared, but sits most clearly with whoever sets the identifier and whoever relies on it. Contracts should state who collects consent and who verifies it.

What happens if an ad breaches the CAP codes?

The ASA can publish a ruling, require changes and, in some cases, refer the matter to other bodies. Repeated breaches can affect paid search eligibility.

Do we need a DPIA for programmatic targeting?

A data protection impact assessment is required where processing is likely to result in high risk, such as large-scale profiling. Record your decision either way. This is general guidance only, and individual cases need a qualified adviser.