Who approves remarketing lists and ad copy at your PPC agency?

Who should approve a remarketing list or advert?

The advertiser should approve each audience list before upload, while its marketing manager or named campaign owner signs off each advert before publication. The agency's PPC account lead prepares and checks both against instructions and platform rules, but does not give the advertiser's approval.

Consider a Manchester advertiser asking its agency to target 40,000 past enquirers. If the agency uploads the list without checking consent, the advertiser carries the regulatory risk as data controller. A written disclosure policy can make the approval points and responsibilities explicit before a campaign starts.

What needs to be recorded before a list is uploaded?

Record who collected the data, the lawful basis for using it, where the list is held and when it must be deleted. The policy should also name the advertiser-side approver for each audience and advert, the agency contact preparing and checking them, and the evidence required for sign-off.

Under the UK GDPR and the Privacy and Electronic Communications Regulations, the advertiser is usually the controller and the agency the processor. The UK rules and compliance guide for PPC agencies explains how that division sits within the wider UK regulatory picture. These are practical role assignments, not roles prescribed by law.

What checks apply to Google Customer Match?

Use only first-party customer data collected directly from customers for Google Customer Match.

Before upload, the advertiser should confirm it has the necessary rights and permissions, and has met applicable notice and consent requirements for using and sharing the data with Google. Do not upload a list if those checks cannot be evidenced.

The advertiser's data protection lead or privacy lead should confirm the list's source, lawful basis and any required consent or notice before upload. If there is no such lead, the policy should name the manager responsible for marketing data. The agency's PPC account lead checks the list against agreed instructions and platform rules, but cannot replace advertiser approval.

The ICO's direct marketing guidance explains how consent and legitimate interests apply to paid search and remarketing. The policy should address lists created through remarketing and customer match audiences, alongside the source, storage and deletion details recorded for each live campaign.

Which rules govern the list and the advert?

Three sources shape a PPC campaign: data protection law applies to lists and tracking, the CAP Code governs advertising copy, and Google sets platform rules that determine whether an advert can run.

A policy needs to account for all three, rather than treating platform approval as a substitute for legal or advertising checks.

The data protection rules apply to campaign data and tracking. The Committee of Advertising Practice writes the CAP Code, while the Advertising Standards Authority enforces it. Published ASA rulings show how the rules apply in practice, including to search ads, and offer examples for policy checks.

Yes, ASA rulings apply to paid search because the CAP Code covers search advertising copy. Google also applies its own policies on misrepresentation, restricted content and destination requirements. Quality Score depends partly on relevance and landing page experience, so breaches can increase costs as well as invite complaints; Google's Quality Score guidance explains how those components are assessed.

How can I keep approvals and evidence organised?

Make the policy an active process, not a document left untouched in a shared drive. Review new campaigns, audiences and advert copy each month, and keep a short decision log showing the date, campaign, decision and approver. That record provides evidence if a regulator or platform asks questions.

The agency contract should match the policy by setting out disclosure duties, audit rights and data-processing terms. If the contract and policy disagree, the contract usually wins in a dispute. The commercial contracts guide for PPC agencies identifies terms to check before signing, including termination and data return clauses.

This is general guidance, not legal advice; individual cases need a qualified adviser.

Who carries the risk, and when should we review the policy?

The advertiser is normally the data controller and platform account holder, so enforcement usually reaches it first. The agency may also be liable under the contract. A written policy is appropriate even for a small UK advertiser that runs remarketing, uses customer lists or makes performance claims.

The document can be only a few pages; the essential point is to record approvals and lawful bases. Review the policy at least once a year, and sooner if the agency changes sub-processors, platforms or targeting methods. A dated review note is sufficient to show when the check took place.

What should I do first?

Start by naming the people responsible for list approval, advert sign-off and agency checks. Then put those names and the evidence each person must check into the policy, so the responsibilities are clear before the next list is uploaded or advert goes live.