UK GDPR and PECR consent for connected TV audience data

What to take away

Why consent for connected TV advertising starts with device identifiers

A connected TV is not a browser. It has no cookie jar in the usual sense. It has a device ID, an advertising ID, or a hashed identifier that the platform exposes to apps and ad servers.

That identifier is the join key. It links a viewing session to a household, a programme, a time of day and, often, a postcode-level location. Without it, most CTV audience segmentation cannot happen.

Under PECR, storing information on a user's device or accessing information already stored there requires clear consent, unless an exception applies. The ICO treats device identifiers as within scope of that rule.

So the first compliance question for any CTV campaign is not "what data do we hold" but "how did we get access to this device". That framing matters for data protection, consent work across the campaign lifecycle.

What counts as a CTV device identifier

Device identifiers for CTV include the advertising ID issued by the operating system, a platform-specific viewer ID, a hashed email address used for matching, and any persistent token that survives an app session.

Some identifiers are resettable by the viewer. Some are not. Some are shared across apps on the same television. The ICO's Guidance on the use of storage and access technologies explains how the rules apply to cookies and similar technologies; assess an identifier by whether it stores or accesses information on the device.

If the identifier is read or written without consent, the processing that follows is exposed. That is true even if the data is pseudonymised rather than obviously personal.

Why the household matters

A television is often shared. One device ID may represent several people, including children. UK GDPR requires controllers to consider the rights of data subjects, and a shared living room complicates notice and consent.

Consent must be specific and informed. A single tap on a smart TV remote is unlikely to meet that bar unless the notice is clear, prominent and covers the purposes actually used.

ICO guidance on consent under UK GDPR and PECR

The ICO (Information Commissioner's Office) is the UK's data protection regulator. Useful ICO materials for this subject include its Guide to PECR, Guidance on the use of storage and access technologies, consent guidance such as “What is valid consent?”, online tracking guidance and guidance on lawful basis for processing.

Consent under UK GDPR must be freely given, specific, informed and unambiguous. It must be a clear affirmative action. Silence, pre-ticked boxes and inactivity do not count.

The ICO's Guide to PECR explains the rules for storage and access on a device, including regulation 6. Its consent guidance explains the UK GDPR standard: Article 4(11) defines consent, while Article 7 sets out the conditions for it. PECR consent and a UK GDPR lawful basis are separate requirements where the resulting data is personal data.

That means a CTV campaign may need two consents: one to access the device identifier under PECR, and one to process the resulting personal data under UK GDPR. In practice, a single well-drafted notice can capture both if the purposes are described accurately.

What good consent looks like on a television screen

Television interfaces constrain notice. Text is read at distance. Remote controls are clumsy. The ICO's online tracking guidance and its guidance on storage and access technologies are useful references, although their examples often concern web and app contexts.

A workable CTV consent flow usually has:

If any of those steps is missing, the consent is weak. Regulators and counterparties will ask for the record, not the intention.

The transparency problem with programmatic CTV

Programmatic CTV often involves dozens of intermediaries. Each may enrich the identifier. The viewer sees one screen but many controllers and processors may touch the data.

The ICO expects transparency about recipients or categories of recipients. A long partner list on a television is poor practice. A layered notice with a web-hosted partner list is better, provided the television notice points to it clearly.

Legitimate interests for CTV audience data: where it still works

Legitimate interests is not dead for CTV. It is narrow. It works best where the processing is expected, low risk and not reliant on reading or writing a device identifier without consent.

An example is fraud prevention: detecting invalid traffic or bot activity on a CTV ad request. That processing is hard to run on consent alone and is unlikely to surprise the viewer.

Another example is frequency capping within a single service the viewer has signed into, where the processing is part of delivering that service.

The legitimate interests test

For CTV, the third part is where most claims fail. A viewer who has not signed in, has not seen a notice and has no relationship with the advertiser is unlikely to expect their viewing to be profiled for ad targeting.

The ICO's guidance on lawful basis for processing explains that legitimate interests requires a documented assessment. The relevant UK GDPR provisions include Article 6(1)(f) for the lawful basis and Article 5(2) for accountability. A one-line entry in a data map is not an assessment.

Where consent is the only realistic basis

Cross-context behavioural targeting, precise location inference and matching to third-party data all sit awkwardly under legitimate interests. Consent is the safer basis.

That does not mean every CTV impression needs a fresh consent prompt. It means the identifier must have been obtained lawfully, and the purpose must be covered by the consent that was given.

Where consent is the basis, the record must show it. Where legitimate interests is the basis, the balancing test must be written down before the campaign runs, not after a complaint.

Storage and access technologies: cookies, SDKs and CTV identifiers

PECR regulation 6—the storage and access rule in the Privacy and Electronic Communications (EC Directive) Regulations 2003—applies to information stored on or accessed from a user's device. It covers more than traditional cookies: SDKs in streaming apps and identifiers held in television firmware may also fall within it.

The ICO's Guide to PECR and its Guidance on the use of storage and access technologies explain the exceptions to regulation 6. The Data (Use and Access) Act 2025 also amended the exceptions, so teams should check the current statutory wording and the conditions for the particular activity.

The amended rules include narrowly defined exceptions, including for certain statistical purposes and appearance-related settings, subject to statutory conditions. They do not create a general exemption for advertising targeting or measurement: assess the activity and its purpose before relying on an exception.

SDKs are the practical battleground

Most CTV inventory is bought through apps, and most apps embed advertising SDKs. Each SDK may read the device identifier, call an ad server and write a local cache.

Each of those actions is a storage or access event. The app publisher is usually the controller for the consent, but the buyer relies on it. If the publisher's consent is defective, the buyer inherits the risk.

Due diligence should ask which SDKs are present, what they read, and how consent is passed to them at runtime. The IAB Europe Transparency and Consent Framework (TCF) can provide a consent string for passing choices through the ad supply chain where the relevant parties implement it. The string is a signal, not proof by itself that valid consent was obtained. A signed contract is not a substitute for a working consent signal.

Identifiers that survive a reset

Some television platforms allow viewers to reset or delete an advertising ID. Others do not. Where reset is impossible, the identifier behaves more like a persistent cookie, and the case for consent is stronger.

Examples of UK CTV environments include Samsung Tizen TVs, Roku devices, Sky platforms and ITVX. Buyers should ask each supply partner which identifier its app or platform exposes, whether viewers can reset it, and how consent choices are passed through the supply chain.

How UK GDPR differs from EU GDPR for CTV campaigns

UK GDPR and EU GDPR share a common text, but they are separate regimes. The UK version sits alongside the Data Protection Act 2018, which supplements it on matters such as law enforcement and exemptions.

For CTV, the practical differences matter in three places: transfers, supervision and national derogations.

The ICO supervises UK GDPR. A campaign aimed at viewers in the UK is answerable to the ICO, not to a lead supervisory authority in another member state. A campaign aimed at viewers in the EU is answerable to EU authorities.

Transfers and adequacy

The EU has adopted an adequacy decision for the UK. It allows personal data to flow from the EU to the UK without extra safeguards while it remains in force. The decision is subject to review and can be changed, so check its current status before relying on it.

UK controllers sending data to the EU rely on the UK's own adequacy regulations. Both directions are workable today, but neither is permanent.

For CTV, the risk is operational. A campaign that stitches together UK and EU audiences may need two transfer analyses and two sets of contractual terms.

Consent standards are close but not identical

Both regimes require consent to be freely given, specific, informed and unambiguous. The ICO's guidance and the EDPB's guidance are aligned on the core test.

Differences appear in enforcement posture and in national rules on cookies and marketing. The UK has not adopted the EU's Digital Services Act obligations in the same form, and the UK's online safety regime follows a different path.

That means an EU consent management platform configured for the EU may not match UK expectations on withdrawal, complaint routes or records.

What to do about divergence

Treat the UK as its own jurisdiction. Keep UK consent records separate. Do not assume an EU legal basis memo covers UK viewers, and do not assume the reverse.

Where a campaign runs in both, document the basis for each audience. The statute, codes and consent that apply to UK CTV advertising are not the same set that apply in Germany or France.

How the UK approach differs from US consent models

The United States relies heavily on sectoral and state law. There is no single federal consent standard for advertising identifiers. State privacy laws create opt-out rights, often for targeted advertising, rather than opt-in consent.

That is a structural difference. In the UK, consent is the default basis for reading or writing a device identifier for advertising. In the US, several states allow processing until the consumer opts out.

A CTV campaign built for US state opt-out signals will not satisfy UK PECR. The absence of an objection is not consent.

Global privacy signals and their limits

US frameworks use signals such as Global Privacy Control to express an opt-out. UK law has no equivalent statutory signal. The ICO has not treated browser signals as a substitute for consent under PECR.

Vendors sometimes market a single consent string as globally sufficient. It is not. A UK viewer needs a UK-valid consent, and the record must show what was presented.

Practical implications for buyers

Buyers should ask suppliers two questions. Which jurisdiction is the consent built for, and can the record be produced for a UK audience?

If the answer is a US state opt-out model, the inventory is not UK-ready. That is a commercial issue as much as a legal one, because UK broadcasters and publishers will not pass on inventory with defective consent.

Data Protection Act 2018 and the Data (Use and Access) Act 2025 in practice

The Data Protection Act 2018 is the UK's framework statute. It supplements UK GDPR, sets out exemptions and creates the ICO's powers. It is the reason UK data protection is not simply copied EU law.

The Data (Use and Access) Act 2025 is the newer piece. It amends UK data protection law, including UK GDPR and PECR, and provides for changes to some processing rules and the regulator.

For CTV teams, the Act makes changes that warrant a specific review. It introduces a recognised legitimate interests basis for specified purposes, a controller complaints-handling duty and provision for the ICO to be restructured as the Information Commission. The recognised-interest basis is limited and does not make advertising targeting automatically lawful. The provisions have commencement arrangements, so check which changes are in force before revising policies and procedures.

What to check in your own documents

A short review will catch most of the gaps. Check whether your privacy notice, your consent record schema and your processor contracts reflect the current text.

Check whether your legitimate interests assessments still describe the law correctly. Check whether your retention schedule is still defensible under the amended rules.

Where the ICO sits now

The ICO remains the UK's data protection regulator, with powers to investigate, fine and audit. The Data (Use and Access) Act 2025 provides for a restructured regulator, the Information Commission; check the implementation status when reviewing current responsibilities. ICO guidance is not law, but it is a practical reference for understanding the regulator's expectations.

For UK CTV advertising, the ICO's Guide to PECR, Guidance on the use of storage and access technologies, consent guidance and online tracking guidance are useful working references. Teams should also check the current legislation, as guidance does not replace it.

Building a consent record buyers and sellers can defend

A consent record is not a screenshot of a banner. It is a structured set of facts that lets a reviewer reconstruct what happened. For CTV, that means tying the record to the device identifier and the purpose.

A defensible record usually contains the identifier or a reference to it, the time of consent, the notice version, the purposes accepted, the partners disclosed and the method of withdrawal.

Without those elements, a buyer cannot verify the basis and a seller cannot prove it. The record is the product of the consent flow, so the flow has to be designed to produce it.

A worked example: a broadcaster selling CTV inventory

Consider a UK broadcaster selling addressable CTV inventory to an agency. The broadcaster operates the app, presents a consent notice and passes a consent signal to bidders. A compliant flow could work as follows:

If step three is missing or vague, the agency is bidding blind. If step five is missing, the broadcaster cannot answer an ICO query.

Checklist for UK CTV consent readiness

Matching consent to the audience you actually bought

Consent is purpose-limited. A record that covers measurement does not cover targeting. A record that covers one app does not cover another.

Buyers should map the consent purposes to the audience segments they are activating. If the segment relies on cross-context data, the consent must say so. This is the same discipline used to define a target audience in any other channel.

Where the mapping fails, the segment should not run. That is a commercial decision, and it is cheaper than a complaint.

Common questions