How UK GDPR lawful basis works for paid-social custom audiences

What to take away

Why lawful basis is decided before a custom audience is uploaded

A custom audience is personal data the moment you match it to platform profiles. The lawful basis question is not a compliance afterthought, it is the first design decision. Get it wrong and every later step, from pixel firing to reporting, inherits the fault.

The ICO guidance on choosing a lawful basis for direct marketing sets out the sequence: identify your purpose, pick one basis, document it, then honour the individual's rights. Paid social audience building sits inside that sequence.

Uploading a customer list is processing for direct marketing. That means the UK GDPR sits alongside PECR, and the two do different jobs. UK GDPR asks why you may hold and use the data. PECR asks whether you may store or read information on someone's device.

Agencies often receive a list as a CSV and treat it as a creative asset. Treat it as a data set with a provenance trail instead. Who collected it, on what notice, with what opt-in wording, and for which brands.

If the answer is unclear, the audience should not be built. That is a commercial decision as much as a legal one, because a badly sourced seed can taint every lookalike expanded from it.

The sequence matters because consent cannot be bolted on later. If you relied on legitimate interests to build a seed, you cannot switch to consent for the same people without fresh contact and a fresh record.

For a wider view of how these duties split across a campaign, Mapping data protection across roles is a useful companion to this article.

The six lawful bases under UK GDPR and which ones survive ICO scrutiny

UK GDPR Article 6 lists six bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. The ICO's lawful basis guidance treats them as equal in law, but not equally practical for advertising.

Consent works when the sign-up wording names advertising, names the channels and is not bundled with terms acceptance. It also needs a withdrawal route that actually reaches the platform suppression list.

Legitimate interests can work for existing customers where the message is relevant and expected. It fails when the data was bought, when the audience is sensitive, or when the individual would be surprised.

Contract is occasionally argued for subscription businesses, on the theory that marketing is part of the service. ICO scrutiny tends to reject that reading for paid social retargeting, which is a distinct purpose.

Whichever you choose, the basis must be named in your privacy information before the first upload. A basis chosen in hindsight is a basis you cannot defend.

Consent, legitimate interests and PECR when pixels fire on a UK site

Pixels are the technical layer that makes retargeting possible. The Meta pixel, TikTok pixel and Google tag all store or read information on a device, which brings them under PECR regulation 6.

The ICO's Direct marketing guidance covers the marketing side, and the storage and access technologies rules cover the cookie and pixel side. Two regimes, one user path.

In practice this means non-essential pixels need consent before they fire on a UK site. A cookie banner that only mentions cookies, while silently loading advertising pixels, is the most common failure we see.

Consent for PECR purposes must meet the UK GDPR standard: freely given, specific, informed and unambiguous. Pre-ticked boxes, scroll-to-accept and continued-browsing banners do not qualify.

Legitimate interests do not rescue pixel firing. PECR consent is separate from the Article 6 basis, and the softer legitimate interests route for cookies applies to limited analytics purposes, not advertising.

Server-side tagging changes where the data flows, not whether consent is needed. If the tag still reads or writes to the device, the rule applies.

Consent mode signals help platforms model conversions, but they are not a substitute for a compliant consent record. Keep the audit trail of what each user agreed to and when.

For the order in which these regimes bite, see Which UK regulatory layers apply to agency work.

Special category data in lookalike seeds and the Article 9 condition problem

Special category data under Article 9 includes health, sexual orientation, religion, race, politics and trade union membership. It reaches advertising through inference, not just through explicit fields.

A seed list of supplement buyers is ordinary data. A seed list of customers from a fertility clinic, a religious publisher or a political donor list is not, and neither is a list that reveals any of those things by implication.

Platforms build lookalikes from patterns, so a seed that correlates with a protected characteristic can expand into audiences that effectively target it. That is the risk ICO cares about, not just the label on the file.

Article 9 requires a separate condition on top of the Article 6 basis. Explicit consent is the most usable one for marketing, and it must be separate from the general marketing opt-in.

Substantial public interest conditions exist, but they are drafted for functions like preventing crime or safeguarding, not for audience expansion. Do not stretch them.

If you cannot identify a valid Article 9 condition, the answer is to drop the seed, not to anonymise it on paper. Pseudonymised data is still personal data.

Run this checklist before any seed list moves into a platform:

Controller and processor roles between a UK brand and its paid-social agency

The brand is almost always the controller for its own customer data. The agency is almost always the processor when it builds audiences on the brand's instructions.

That split is not automatic. If the agency decides which audiences to build, which platforms to use and how long to keep them, it may be acting as a controller for those decisions.

A written contract must set out the subject matter, duration, nature and purpose of processing, plus the agency's obligations under Article 28. Without it, both parties are exposed.

Practical duties for the agency as processor include acting only on documented instructions, assisting with data subject requests, and not engaging a sub-processor without authorisation.

Platforms are separate controllers for their own advertising purposes. That is why a joint controller or independent controller relationship with Meta or TikTok sits alongside the brand and agency contract.

Data subject requests are the pressure point. If a user asks for deletion, the brand must pass that to the agency, which must pass it to the platform, within the statutory window.

Having a written disclosure policy that names who handles requests and how they reach each platform shortens that chain considerably.

Platform terms, data brokers and audience sourcing under ICO guidance

Platform terms for custom and lookalike audiences are contractual rules layered on top of the law. Meta, Google and TikTok each require you to have rights to the data you upload.

Those terms typically prohibit uploading data collected without permission, data from third parties without consent, and sensitive data. Breaking them can cost the ad account, separately from any ICO action.

Buying audiences from a broker is where this gets dangerous. The ICO has published specific guidance for organisations using marketing services of data brokers, covering due diligence and the limits of what a broker's assurances can do for you.

Broker assurances do not transfer liability. If the underlying consent does not cover your brand, your purpose and your channel, the upload is unlawful regardless of what the contract says.

Due diligence means asking for the source of the data, the notice shown at collection, the consent wording, the date and the categories of third parties named. Vague answers are a red flag.

A worked example helps here. A UK homeware brand buys a list of 40,000 "recent movers" from a broker, uploads it as a custom audience, and expands a 1% lookalike.

Step by step, the failure points stack up:

Four separate failures, one campaign. Each could have been caught by a single documented assessment before upload.

Documenting the lawful basis assessment for each custom audience

Documentation is what turns a defensible decision into evidence. ICO expects a record of the basis, the reasoning and the safeguards, not a paragraph recycled across every campaign.

A legitimate interests assessment has three parts: the legitimate interest, the necessity test and the balancing test. Write it for the specific audience, not for marketing in general.

The record should name the audience, the source, the fields, the basis, the Article 9 condition if relevant, the retention period and the objection route. One page per audience is usually enough.

Keep the assessment with the campaign brief so it travels with the work. An assessment stored in a legal folder nobody opens is functionally absent during an audit.

For a practical evidence set covering claims, access and data, the claims, access, data checklist maps well onto audience documentation.

Review the assessment when the seed changes, when the platform changes or when the purpose changes. A stale assessment is a liability, not a defence.

Retention is the forgotten limb. Set a deletion date for the uploaded audience, the expanded lookalike and the platform-side match list, and actually action it.

What the Data (Use and Access) Act 2025 changes for marketers

The Data (Use and Access) Act 2025 reforms parts of the UK's data protection framework. It amends rather than replaces UK GDPR, so the Article 6 and Article 9 structure stays.

For marketers, the practical effects sit around recognised legitimate interests, clearer rules for some automated decisions, and a revised approach to subject access and complaints handling.

The Act also touches PECR, including provisions on cookies and similar technologies that may widen the exceptions for some purposes. Read the detail rather than the headlines, because the exceptions are narrow.

Assessments written before the Act came into force should be reviewed against the new provisions. The reasoning may still hold, but the citation and the safeguards may need updating.

Nothing in the Act removes the need for a lawful basis, a PECR consent where pixels fire, or an Article 9 condition for sensitive seeds. Those fundamentals are unchanged.

Agency contracts and data processing agreements should be checked for references to the old framework. Small drafting updates now avoid arguments later.

Common questions

Do we need consent to upload a customer list as a custom audience?

Not always. Consent is one route, and legitimate interests can work for existing customers where the marketing is expected and an assessment is documented. What you cannot do is upload first and pick a basis afterwards.

Does a cookie banner cover pixel consent?

Only if it names advertising and similar technologies, offers a genuine reject option, and blocks non-essential pixels until consent is given. A cookies-only banner that loads advertising tags by default does not comply.

Can we use legitimate interests for lookalike audiences?

Sometimes, but the balancing test is harder because the expanded audience includes people with no prior relationship with the brand. Document why they would expect it, and provide an easy objection route.

Who is liable if a bought list turns out to be non-compliant?

The brand as controller carries the primary liability, and the agency may share it if it chose the source or ignored red flags. A broker's assurances do not transfer responsibility to the broker.

Does the Data (Use and Access) Act 2025 remove the need for a lawful basis?

No. It amends UK GDPR and PECR rather than replacing them, so Article 6 and Article 9 continue to apply to custom and lookalike audiences.

How long should we keep a lawful basis assessment?

At least as long as the audience exists and the campaign runs, plus a period that lets you answer a complaint. Tie the retention date to your general data retention schedule.