Connected TV advertising data protection, consent or legitimate interests?

What to take away

A planner in England sending household-level segments to a CTV platform is processing personal data, even with no name attached.
PECR bars storing or reading information on a viewer's device, subject to its exceptions and conditions, which catches most TV and app identifiers.
Legitimate interests can cover other processing, but only with a written balancing test.
A DPIA, a privacy notice and a retention period are the first things a platform or regulator asks to see.
Data protection is reserved law, so these duties apply the same way in England, Scotland, Wales and Northern Ireland.

Who controls the data

An England campaign usually involves an advertiser, an agency, a platform, a publisher and a measurement vendor. Each touches the same identifiers and each holds a UK GDPR role.

The ICO defines a controller as the body that, alone or jointly with others, determines the purposes and means of the processing of personal data. A supplier acting only on documented instructions is a processor. Where both sides set the purpose, expect joint controllership.

Contracts should name the role, the retention period and the breach notification route. The commercial contracts review is worth reading while terms are still being drafted, and the compliance guide covers how roles and enforcement fit together.

Choosing a lawful basis

Connected TV advertising data protection turns on picking one lawful basis and sticking to it. Consent and legitimate interests do most of the work, and that choice shapes your notice wording and your retention rule.

Set the campaign objective before you collect any data. A written strategy framework keeps the purpose fixed, which is what the lawful basis, the notice and the retention period all depend on.

Legitimate interests is not a free pass. You need a genuine purpose, and you must show the processing is necessary and does not override the viewer's interests. Add the assessment to the quality checklist and record it before launch.

Consent and device identifiers

Regulation 6 of PECR sets the starting rule: subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user. Smart TV systems, apps and browsers all sit inside that wording.

For advertising identifiers, consent is the route most campaigns rely on. Valid consent must be freely given, specific, informed and unambiguous. Informed means saying what is stored, what it is matched against and for how long, and withdrawal must be as easy as agreeing.

Household screens should be treated as shared devices, not personal ones. One person's consent on a living-room television does not speak for the rest of the household, so design the consent prompt and the segment rules with that in mind.

Transparency and rights

A privacy notice needs the purpose, the lawful basis, the recipients, the retention period and the rights available. Vague wording about partners does not meet that test, and a notice that only a lawyer can follow will not satisfy the viewer.

Viewers can request a copy of their data, ask for deletion and object to direct marketing outright. One month is the statutory deadline for a response. Under UK GDPR, the maximum fines reach the higher of £17.5 million or 4% of global annual turnover.

The UK regulations in England explainer sets out the wider rules that apply to a campaign, so read it before your first campaign goes live.

Ad blocking and delivery

Ad blocking and refused consent both shrink the inventory you can measure, and both change the data you report on. Blocked impressions are not missing at random, so a report built only on measured impressions will lean towards the viewers who accepted tracking.

This is general guidance. Individual cases need a qualified adviser before you sign a data processing agreement.

Before you act

Name the controller, processor or joint controller role of every party in the campaign.
Choose one lawful basis for each purpose and write it down before collecting data.
Record the balancing test if you rely on legitimate interests.
Check PECR regulation 6 and its Schedule A1 for every device identifier you store or read.
Complete a DPIA where profiling is likely to be high risk.
Set the retention period and the one-month response route for viewer requests.

Glossary of key terms

Controller: the body that decides why and how personal data is used.
Processor: a supplier acting only on the controller's instructions.
PECR: the rules on cookies and similar device storage.
DPIA: a data protection impact assessment, expected for high-risk profiling.
UK GDPR: the retained regulation read with the Data Protection Act 2018.

Common questions

Does connected TV advertising need consent?

For storing or reading device identifiers, consent is the usual route, unless an exception in PECR Schedule A1 applies. Check the exception against the facts of the campaign before relying on it, and record the reasoning in the decision file.

Who is responsible if a platform mishandles data?

Usually the controller for that processing, often the advertiser and the platform jointly. The contract should say which before the campaign runs, and it should name who tells viewers and who answers their requests.

Do the rules differ in Scotland, Wales or Northern Ireland?

No. Data protection is reserved, so UK GDPR and PECR duties apply across all four nations. Advertising regulation differs; data law does not. Plan one set of data protection controls for every region you buy.

How long can we keep campaign data?

No fixed period applies. Tie retention to the purpose, review it annually, and delete or anonymise when that purpose ends. Write the period into the contract and the privacy notice so both say the same thing.