Advertising Law
Labelling advertising: what the law requires
The commercial purpose of a communication must be recognisable. That single principle explains almost every labelling rule in advertising.
2 min readJun 7, 2025
Advertising Law
Data protection in ad campaigns
Every campaign that touches personal data needs a lawful basis, documentation and a defined retention period. Most have none of the three.
Key points
- Every processing purpose needs its own lawful basis, decided before the campaign starts.
- Advertising platforms are usually joint controllers or processors; the paperwork matters.
- Retention periods must be defined and enforced, not left open.
Advertising involves personal data at almost every step: audience lists, tracking identifiers, form submissions, customer matching, measurement.
The basics that are usually missing
A lawful basis per purpose. Not one basis for marketing generally. Analytics, advertising personalisation, customer matching and email marketing are separate purposes.
Records of processing. A written record of what data, for what purpose, on what basis, shared with whom, retained how long.
A retention period. Defined and actually enforced. Audience lists uploaded to platforms years ago and never deleted are a common finding.
The agreements. Processor agreements with suppliers, joint controller arrangements with platforms where applicable.
The question in an investigation is not whether you meant well. It is whether you can produce the record. Organisations that cannot produce it are treated as not having had one.
Where the risk concentrates
| Activity | Basis usually needed |
|---|---|
| Website analytics with identifiers | consent |
| Advertising tracking pixels | consent |
| Uploading customer lists for matching | consent, generally |
| Email marketing to individuals | consent, or the narrow customer exception |
| Postal advertising | often legitimate interest |
| Business contact for relevant offers | often legitimate interest |
| Profiling for personalised advertising | consent |
Customer list uploads to advertising platforms are frequently done without a basis. The customer consented to receive email; they did not consent to their address being shared with an advertising platform for matching.
The platform relationships
Advertising platforms are not neutral tools. Depending on the function they act as processors or as joint controllers, and the arrangements differ.
Where joint controllership applies, both parties are responsible for the processing and must have an arrangement setting out responsibilities and provide the required information to individuals.
Check what your platforms' terms actually say about their role. Several have been the subject of decisions finding joint responsibility where advertisers assumed otherwise.
International transfers
Data transferred outside the region requires a transfer mechanism. Most major platforms rely on standard contractual clauses supplemented by additional measures, or on adequacy arrangements where they exist.
This area has been legally unstable for years. The practical requirement is to know which mechanism each supplier relies on and to record it.
Individual rights
People can request access to their data, correction, deletion and objection to direct marketing. Objection to direct marketing is absolute; there is no balancing test.
You need a process that can find a person's data across every system, including advertising platform audiences, and act within the statutory period.
The practical minimum
- A record of processing covering every marketing activity.
- A named person responsible.
- Defined retention periods with actual deletion.
- Processor and joint controller agreements on file.
- A privacy notice that describes what actually happens.
- An annual review of what fires on the website before consent.
Frequently asked questions
Is legitimate interest available for advertising?
For some postal and business contexts, often yes. For tracking-based online advertising, consent is generally required.
Who is responsible when a platform processes the data?
Usually both parties, in a defined relationship. The agreements are not optional paperwork.
More from Advertising Law
Keep reading
Advertising Law
Influencer advertising: the legal basics
The rules are settled and routinely breached. The exposure sits with the brand as much as the creator, and the contract is where it is managed.
2 min readJun 5, 2025
Advertising Law
Avoiding misleading advertising
A claim does not have to be false to be misleading. It only has to create an impression that does not correspond to reality.
2 min readJun 3, 2025