Rules and ethics
Part of Do you need a paid social retargeting agency in the UK?
Do you need a paid social retargeting agency in the UK?
Paid social retargeting in the UK depends on cookie consent, PECR and UK GDPR. See what a retargeting agency should evidence before you brief one.
What to take away
- A paid social retargeting agency is most useful when it can show how consent, audience build and measurement fit together.
- Cookie consent under the Privacy and Electronic Communications Regulations (PECR) controls whether you can drop ad pixels, not just what you write in a privacy notice.
- UK GDPR governs the lawful basis, minimisation and retention of the audience data behind any retargeting list.
- Basic retargeting is workable in-house on a single platform; the case for an agency grows with each extra platform, consent state and reporting demand.
- Ask for a written retargeting plan with consent states, platform limits and an exit route before you sign anything.
Why retargeting needs a consent-first plan
Retargeting asks a simple question: can we show an ad to someone who visited but did not buy? In the UK, the answer starts with cookies and similar technologies. PECR rules apply when you store or read information on a user's device. That means the ad pixel often needs consent before it fires.
A retargeting agency that treats consent as a legal afterthought will build lists you cannot lawfully use. The ICO's direct marketing and privacy guidance explains the electronic communications rules that sit alongside data protection.
Consent is not the only gate. UK GDPR requires a lawful basis, a clear purpose and data minimisation. The ICO's UK GDPR guide sets out those principles for organisations.
The legislation itself remains the reference point for rights, retention and international transfers. The retained EU GDPR text on legislation.gov.uk is the version UK organisations work from.
Before you appoint anyone, vendor due diligence for paid-social suppliers, from identity to exit helps you check data roles, platform access and exit terms.
What the cookie choices mean for retargeting
The practical effect is a short decision table. It stops the common mistake of treating a banner click as blanket permission for every platform, and it keeps the cookie question separate from the data protection question.
| Consent state | Pixel behaviour | Retargeting consequence |
|---|
Cookie consent to pixel action
Consent accepted for advertising?
Ad pixel may fire for agreed purposes
Non-essential pixel should not fire
| Consent state | Pixel behaviour | Retargeting consequence |
|---|---|---|
| Advertising consent given | The ad tag and audience tools may fire for the purposes the banner named | An audience can be built and used within the stated retention period |
| Consent refused | The ad tag must not fire; only strictly necessary scripts run | No audience membership, so retargeting runs only on visitors who consented |
| Consent withdrawn | New events stop and the identifier is removed from the audience | A platform-side deletion request follows and that list can no longer deliver ads |
| No choice recorded | Treated as no consent, so the tag stays suppressed | The visitor stays out of every retargeting audience |
Each platform is separate. A visitor can accept one purpose and refuse another, so the tag configuration has to match what the banner actually recorded.
How to brief a retargeting agency on UK cookie consent
- Map every ad tag against the consent state that allows it. In the UK that usually means Meta's pixel and Conversions API, TikTok's pixel, LinkedIn's Insight Tag and Pinterest's tag, with one consent tool — OneTrust, Cookiebot by Usercentrics, CookieYes, Quantcast Choice or Sourcepoint — gating all of them.
- Record the lawful basis for each retargeting audience, including any legitimate interests assessment where used.
- Set retention limits for audience membership and document who deletes or refreshes a list.
- Agree what happens when a user withdraws consent, including platform-side deletion requests inside Meta, TikTok and LinkedIn.
- Test the live site with consent accepted, refused and withdrawn on every platform tag before spending.
- Keep a dated change log for tags, consent tool settings, privacy text and platform settings.
A useful agency will not promise unlimited audience pools. It will show the size and source of each list, then explain which platform rules limit use.
Retargeting agency briefing checklist
- Map every ad pixel against consent state
- Record lawful basis for each audience
- Set retention limits and deletion owner
- Agree consent withdrawal and platform deletion
- Test live site accepted, refused, withdrawn
- Keep dated change log for tags and settings
Where a retargeting agency adds value beyond setup
The service line usually covers pixel governance, audience architecture, creative rotation and frequency caps. That work sits close to media buying, so a retargeting brief should not be separated from the wider paid social plan.
Scope, not the headline retainer, is where the surprises sit. Setup, consent tooling, creative variants and reporting time are commonly charged outside the monthly management fee. Ask for a written list that marks each item as included or excluded, then compare agencies on that list rather than on a single monthly figure.
Measurement needs the same discipline. A retargeting audience will usually convert better than cold traffic, but that gap may reflect intent rather than the ad. Paid social measurement with reconciled sources and a line between attribution and impact sets out how to separate those claims.
Do you need a retargeting agency, or can you run it in-house?
Short answer: most UK advertisers can run basic retargeting in-house on one platform. You need an agency when the work stops fitting one person's week, or when consent wiring and audience governance have to hold across several platforms at once.
Signs you can stay in-house:
- One platform carries the retargeting, and one person already owns the pixel, the consent tool and the ad account.
- Audiences come from site visits only, with no product feed, CRM list or offline data involved.
- You are content reading each platform's own reporting without reconciling it against other sources.
Signs the work needs an agency:
- Retargeting runs across Meta, Instagram, TikTok and LinkedIn at once, each with its own consent wiring.
- You need audience governancedocumented sources, retention limits and a deletion route when someone opts out.
- Creative volume is the constraintseveral variants a month, refreshed before fatigue sets in.
- Reporting has to reconcile platform numbers with your own site and CRM data.
UK paid-social agencies that sell retargeting as part of a paid-social retainer include Brainlabs, Impression, Journey Further and Jellyfish. Treat that as a starting list rather than a recommendation, and ask which platforms each one is certified on and who administers the pixel and the audience data.
What to put in the contract or working agreement
The agreement should name the consent tool — OneTrust, Cookiebot by Usercentrics, CookieYes and Quantcast Choice are common UK choices — the platform accounts (Meta Business Suite, TikTok Ads Manager, LinkedIn Campaign Manager and Pinterest Ads Manager) and the data controller. It should also state who owns the pixel, the audiences and the historical reports if the relationship ends.
For regulated sectors or health data, retargeting may be inappropriate even with consent. A short data protection impact assessment can expose that before creative work starts.
Common questions
Is retargeting allowed without cookie consent in the UK?
Usually no for non-essential advertising cookies. PECR requires consent before storing or reading information on a device unless an exemption applies, so a retargeting pixel should wait for a positive choice.
What is the difference between PECR and UK GDPR for retargeting?
PECR governs the cookie or device access, while UK GDPR governs the personal data and lawful basis behind the audience. You normally need to satisfy both, not choose one.
Do I need a paid social retargeting agency or can I run it in-house?
You can run basic retargeting in-house if you control the site, the consent tool and one ad account, and you work on a single platform such as Meta or Pinterest. An agency earns its fee when audience governance, creative testing and measurement have to run across Meta, Instagram, TikTok and LinkedIn at the same time.
How long should a UK retargeting audience be kept?
Set a defined retention period and review it. Shorter windows reduce privacy risk, while longer windows may be harder to justify under the storage limitation principle.
