Cross border podcast campaigns into Ireland: UK GDPR and PECR checks

What to take away

Controller status for a London campaign heard in Dublin

A campaign sold from London and heard in Dublin is not automatically outside UK law. The test is control: does your business decide why and how listener data is processed?

If it does, you are a controller under the UK GDPR and the ICO is your regulator. Article 3 also catches overseas controllers offering goods or services to UK listeners, so a Dublin network selling host-read slots to UK audiences sits inside UK GDPR for that work.

Accountability means showing compliance, not intending it. List each data field the campaign touches, from download counts to promo-code redemptions, and name a lawful basis for each.

Our note on podcast advertising data protection takes the same controller questions to campaign level, which helps before you sign a sales house contract.

Consent, lawful basis and PECR rules for podcast ad tracking

Measurement creates personal data whenever downloads, completion rates or promo-code use can be linked to a person. Your chosen basis sets what you may do next.

PECR sits on top of the UK GDPR. The Privacy and Electronic Communications Regulations 2003 require clear consent before storing or reading information on a listener's device, unless that storage is strictly necessary.

Ad pixels, fingerprinting scripts and most analytics cookies are not strictly necessary. Pre-ticked boxes and cookie walls that block content fail the test.

Ireland's ePrivacy Regulations, S.I. 336/2011, impose a comparable regime for Irish listeners. Where a podcast app runs the prompt, get written assurance its flow meets both standards, since your brand carries the risk.

Transfers to Ireland and the paperwork that proves compliance

Moving listener data from the UK to Ireland is a restricted transfer. The UK recognises the EU, including Ireland, as adequate, so most campaign data crosses without extra safeguards.

Keep an International Data Transfer Agreement and the UK Addendum in the file as contingency. Adequacy findings are reviewed, and a change would leave you needing a transfer risk assessment at short notice. Map onward hops too: if your Irish partner sends data to a processor outside the EU, flow the same protections down the contract.

Our guide to podcast advertising vendor due diligence lists the questions that close those gaps before signature.

Retention periods to write into contracts

Where CAP Code jurisdiction stops

The CAP Code covers ads in UK media and ads aimed mainly at UK consumers, wherever they were made. It addresses misleading claims, substantiation, offence and social responsibility. The ASA cannot fine; it publishes rulings and can refer persistent cases to Trading Standards or Ofcom.

Jurisdiction stops at the border in practice. An ad aimed mainly at Irish listeners, placed in Irish media, is a matter for the Advertising Standards Authority for Ireland under the ASAI Code of Standards for Advertising and Marketing Communications in Ireland. Irish data protection complaints go to the Data Protection Commission in Dublin.

Our guide to podcast advertising UK regulations covers the pre-contract checks for dual-market buys.

ICO enforcement as a risk signal

The ICO publishes enforcement action, and marketing breaches recur: direct marketing without valid consent, cookies set before consent, consent records that cannot be produced. In 2021 the ICO fined We Buy Any Car £200,000 over 191 million nuisance emails.

Reprimands, enforcement notices and audits consume campaign time even without a penalty. Read recent cases as a checklist:

Common questions

Does UK GDPR still apply to a UK advertiser running podcast ads into Ireland?

Yes, for processing your business controls. You set purposes and means, so you are a controller and the ICO regulates that work.

Is sending listener data from the UK to Ireland a restricted transfer?

It is a restricted transfer, and the UK adequacy finding for the EU covers it. Hold an IDTA or the UK Addendum as contingency.

What retention periods should a cross-border campaign use?

Thirteen months for download logs, 90 days for promo-code data, and consent records while consent is relied on.

Who regulates an ad heard only by Irish listeners?

The Advertising Standards Authority for Ireland applies the ASAI Code. Data protection complaints go to the Data Protection Commission.