How does podcast advertising data protection work in England?

What to take away

In a 2022 call for evidence, 60% of respondents said they had seen online ads that were not obviously identifiable as ads, which is why the Online Advertising Programme matters for host-read slots.
Where a podcast advertising campaign processes personal data, UK GDPR duties sit with the controller, so you need a lawful basis before you buy or share a listener list.
A host-read mention still needs a clear ad label, and the practical compliance advice for businesses running ad campaigns explains how the CAP Code applies to that disclosure.
Special category data, such as health or political interests inferred from listening behaviour, raises the bar and usually needs explicit consent.
The FTC's truth-in-advertising and disclosure guidance is useful context for cross-border campaigns, but it is not the UK rulebook.

Who is the controller

Under the UK GDPR, the controller decides why and how personal data is processed. In podcast advertising that is usually the advertiser, not the host or the network.

In England, the applicable framework is the UK GDPR and the Data Protection Act 2018; these apply across the UK, rather than forming a separate England-only data protection regime. Check the ICO's data protection fee checker and register of fee payers: controllers that are not exempt must pay the data protection fee, and an exemption from the fee does not remove UK GDPR duties.

Who is the controller?

Do you decide why and how data is processed?

Yes

You are the controller

Host or network may be controller

If you buy a sponsorship and the network sends you listener emails or a matched audience segment, both sides may be controllers or joint controllers. You need a written arrangement before any data moves.

This is separate from the commercial terms. The podcast advertising commercial contracts page covers the clauses that sit alongside a data processing agreement.

If a network processes data only on your documented instructions, put the arrangement in a written processor contract that meets Article 28 UK GDPR. It must state the subject matter and duration, nature and purpose of processing, types of personal data and categories of people, and the controller's rights and obligations; it must also cover confidentiality, security, sub-processors, assistance with rights requests and breaches, return or deletion of data, and audit information.

Lawful basis and consent

Consent is one option, not the only one. Legitimate interests can work for some analytics, but you must document the balancing test and offer an easy opt-out.

Article 6 UK GDPR lists six lawful bases: consent; contract; compliance with a legal obligation; protection of vital interests; performance of a task in the public interest or exercise of official authority; and legitimate interests. Choose and record the basis before processing; a commercial campaign cannot rely on a basis simply because it is convenient.

Valid consent checklist

Consent is specific and recorded
No pre-ticked boxes
No bundled privacy notice
Easy opt-out offered
Article 9 condition for special category data

For podcast advertising data protection, consent must be specific and recorded. If you rely on a pre-ticked box or a bundled privacy notice, the consent is unlikely to be valid.

Where you process special category data, you need an Article 9 condition as well as a lawful basis. Explicit consent is the most common route for health or political audiences.

Host-read disclosure rules

The CAP Code requires ads to be obviously identifiable. A host-read slot must be labelled as an ad, not just implied by a change in tone.

The 2022 Online Advertising Programme consultation considered whether regulatory changes for online advertising should tighten identification rules. It is a policy initiative, not the source of a campaign's data protection duties.

If a host also uses the product personally, that is still an ad when payment or free product is involved. Disclose it in the audio and in the show notes.

For data use in campaigns, consult the ICO's Direct Marketing Code of Practice and its direct marketing guidance. For ad identification, apply the CAP Code, administered by the Advertising Standards Authority (ASA); these sit alongside, rather than replace, the UK GDPR, Data Protection Act 2018 and PECR.

Audience data and targeting

Podcast advertising often uses audience data for targeting. That data is personal data if it can identify a listener, even indirectly.

The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) also apply to parts of digital advertising. PECR generally requires consent for unsolicited marketing emails to individual subscribers unless the soft opt-in applies, and for storing or accessing information on a device, such as through non-essential cookies, unless an exemption applies; check the ICO's direct marketing and cookies guidance before using listener lists or tracking technologies.

A network may offer a matched segment based on email hashes. You are still processing personal data, so you need a lawful basis and a retention limit.

Give listeners privacy information and a route to exercise their rights. Be ready to handle subject access requests (SARs, often called DSARs), as well as requests for rectification, erasure, restriction, portability and objection, and rights relating to solely automated decisions; check the conditions that apply to each request.

Do not assume that aggregate listening figures are exempt. If the dataset is small enough to single out a person, treat it as personal data.

A data protection impact assessment (DPIA) is mandatory before processing likely to result in a high risk to people's rights and freedoms. Screen proposed profiling, matching and targeting, document the decision, and follow the ICO's Data protection impact assessments guidance where a DPIA is required.

Retention and security

Keep campaign data only as long as you need it. A common approach is to delete raw listener data after the campaign report is signed off.

Access should be limited to people who need it. Shared spreadsheets sent to a media agency are a frequent weak point.

If a personal data breach is likely to pose a risk to people's rights and freedoms, the 72-hour reporting clock to the ICO starts when you become aware of it; notify the ICO without undue delay and, where feasible, within that period. Have a named person and a contact route before the campaign goes live, and record every breach.

Decision table

Choose

You want to email listeners who opted in to the podcast: Consent with a clear opt-in and a recorded timestamp
You want to target a health-related audience: Explicit consent plus an Article 9 condition
A host is paid for a mention: A spoken ad label plus a written disclosure
A network offers a matched email segment: A data processing agreement and a lawful basis
You need a campaign report: Aggregated, de-identified metrics

Avoid

You want to email listeners who opted in to the podcast: Buying a list from a third party
You want to target a health-related audience: Inferring health status from listening alone
A host is paid for a mention: Relying on tone or context
A network offers a matched email segment: Accepting hashed data with no contract
You need a campaign report: Raw listener-level exports kept indefinitely

Common questions

Do I need consent for podcast advertising data?

Not always. Consent is one lawful basis. Legitimate interests can apply to some analytics, but you must document the assessment and give listeners a clear opt-out.

Does a host-read ad need a label?

Yes. The CAP Code requires ads to be obviously identifiable. Say it is an ad in the audio and repeat the disclosure in the show notes.

What happens if a podcast campaign data breach occurs?

Notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach that is likely to pose a risk to people's rights and freedoms. Keep an internal log of every breach, even minor ones.

Is the FTC guidance relevant to England?

It is useful context for campaigns that also run in the United States, but the UK rulebook is the UK GDPR and the CAP Code. Take advice from a qualified adviser on your own facts.