How UK GDPR and PECR consent rules change PPC remarketing

What to take away

How UK GDPR, PECR and the ICO frame PPC remarketing consent

Remarketing in the UK sits under two overlapping regimes. UK GDPR and the Data Protection Act 2018 govern personal data processing. PECR 2003 governs cookies and electronic marketing separately, so a lawful basis under UK GDPR does not excuse a missing cookie consent.

The ICO enforces both. Its Guide to Privacy and Electronic Communications Regulations sets out the core PECR rules on cookies and electronic marketing that PPC tracking depends on. Read it before you sign off any tag plan.

For a PPC agency, the practical effect is that audience building is a data protection activity, not a media buying one. The data protection duties attach at the point you collect an identifier, not at the point you upload it.

For consent to be valid, it has to be given freely and must be specific, informed and clear. A banner that says "we and our partners use cookies" with a single accept button does not meet that bar for remarketing tags.

Legitimate interests can sometimes support analytics, but the ICO's Direct marketing guidance makes clear that electronic marketing to individuals normally needs consent. Treat remarketing as marketing.

Region matters less than people assume. A client in Greater London, the North West or Wales faces the same ICO rules, though CMA attention is heavier in consumer markets with national reach.

What the ICO says about Google Ads customer match and lawful basis

Customer match uploads hashed email addresses or phone numbers to Google Ads so you can target those users across Google properties. Hashing is a security measure, not an anonymisation one. The data is still personal data under UK GDPR.

That means you need a lawful basis before upload. In most cases that is consent, because the purpose is direct marketing. The ICO's direct marketing guidance covers lawful basis and consent for exactly this kind of activity.

Consent for customer match must be specific to that use. A general "we may share your data with partners" clause in a privacy notice is not enough. The person must have agreed to receive marketing, and the list must reflect that.

Google's own customer match policy requires you to comply with applicable law and to have the necessary rights. It does not replace your UK GDPR obligations. The ICO can still ask you to prove consent.

Suppression matters too. If someone withdraws consent or objects, they must come off the list before the next upload. Build a refresh cycle into your paid search management so lists are not stale.

Who signs off the list is an internal control, not a legal one, but it matters for accountability. Decide in advance who approves remarketing lists and record that decision.

Cookie consent and conversion tracking under the storage and access technologies rules

Conversion tracking usually relies on cookies or similar storage. PECR regulates that storage and access, and the ICO's Guidance on the use of storage and access technologies explains what counts and what consent requires.

The rule is simple to state and hard to implement: non-essential cookies and similar technologies must not be set or read before consent. That includes Google Ads conversion tags, remarketing tags and most analytics.

Strictly necessary cookies are exempt, but the exemption is narrow. A cookie that measures ad performance is not strictly necessary for the service the user asked for.

Consent must be granular where purposes differ. If you use one tag for conversion measurement and another for remarketing, the user should be able to accept one and reject the other.

Rejecting must be as easy as accepting. A prominent accept button with a hidden reject link fails the standard the ICO has set in its cookie enforcement work.

Consent mode and similar tools can help you model conversions, but they do not create consent. They manage the consequences of its absence.

Test the tag behaviour yourself. Load the site with a clean browser profile, reject consent, and confirm no marketing tags fire. Do this after every site release.

Building remarketing lists without breaching data subject rights

Remarketing lists are built from personal data, so data subject rights apply. The ICO's guide to individual rights sets out the rights that constrain audience targeting, including access, erasure, objection and portability.

Access requests are the common failure point. If someone asks what data you hold, you must be able to show which lists their identifier appears in and where it came from.

Erasure is harder than it sounds because data sits in platform accounts as well as your CRM. Document how you remove a person from Google Ads and Microsoft Advertising audiences, and how you confirm it.

Objection to direct marketing is absolute. Once someone objects, you must stop using their data for that purpose. There is no balancing test to run.

Retention limits help. Keep lists only as long as the consent and the campaign justify, then delete. Long-lived lists accumulate risk and stale consent.

Special category data needs extra care. If a list implies health, religion or similar, you need a condition for processing beyond ordinary consent.

Your rules and ethics should cover list provenance, refresh cycles and the route for handling rights requests from platform audiences.

Where the CMA and the Digital Markets, Competition and Consumers Act 2024 fit in

The CMA is not a data protection regulator, but it regulates consumer-facing commercial practices. The Digital Markets, Competition and Consumers Act 2024 gives it stronger tools over unfair commercial practices, including some online advertising conduct.

For PPC teams, the overlap is real. A remarketing ad that misleads about price, availability or the nature of an offer can attract CMA attention as well as ASA scrutiny.

Targeting can itself be a consumer protection issue. Advertising a credit product to people whose data suggests financial difficulty, without care, invites both ICO and CMA interest.

The Act also sits alongside the CMA's digital markets work, which affects how large platforms deal with advertisers. That can change what data platforms make available for targeting.

Keep the two regimes separate in your documentation. Data protection compliance does not answer a consumer law question, and vice versa.

If a client operates in a regulated sector, such as financial services or gambling, check sector rules before launching a remarketing campaign. The CMA framework adds to, rather than replaces, those rules.

A consent checklist for PPC agency client accounts

Use this before any remarketing or customer match launch. It is deliberately blunt.

Then follow these steps for each new campaign:

If any step fails, pause the campaign. A delayed launch is cheaper than an ICO complaint.

How to evidence compliance in your paid search management reporting

Reporting should show compliance, not just performance. Build a short section into the monthly client report covering consent, list provenance and rights requests.

Include the number of consent withdrawals actioned and the time taken. This demonstrates that objection handling works.

Record tag audit results. A dated screenshot of a rejected-consent test is stronger evidence than a written assurance.

Keep a list register: source, lawful basis, consent wording version, upload date and deletion date. This is the document an ICO query will ask for first.

For cross-border clients, note where data is processed. UK GDPR still applies to UK data subjects, and transfers need a lawful mechanism.

Review the ICO's PECR guide and storage guidance at least annually, because enforcement emphasis shifts. Assign an owner for that review.

Finally, align internal approvals with the client's own governance. If the client cannot show consent, your agency cannot rely on it.

Common questions