Before you brief radio advertising data protection, read this

What to take away

Most teams treat data protection as a final sign-off, then find consent records were never documented.
UK GDPR covers personal data used for targeting, measurement and attribution across broadcast radio, online radio and podcasts.
PECR also matters for electronic marketing and for cookies or similar technologies used to track online-radio and podcast audiences.
If AI builds audiences or measures response, the ICO expects transparency, fairness and human review.
The Tobacco and Vapes Act 2026 adds restrictions that can catch radio and digital audio spots.
The CAP Code governs non-broadcast audio, including podcast and online radio ads; broadcast radio ads are subject to the BCAP Code.

Leaving data protection until the campaign is nearly live is the mistake.

Pre-briefing checklist

Map the personal data, its source, purpose, recipients and identifiers, including any IP addresses or device IDs used for targeting or measurement.
Decide whether the advertiser, agency, podcast network and AI vendor act as controllers, joint controllers or processors for each activity. Do not assume their roles from their job titles. Where a supplier processes personal data on your behalf, put the required Article 28 UK GDPR terms in a written contract.
Record the UK GDPR lawful basis for each activity and check whether the activity is direct marketing. Follow the ICO's Direct marketing guidance; PECR requirements apply separately where relevant.
Ask whether measurement uses cookies or similar technologies to store information on, or access information from, a listener's device. Obtain PECR consent unless an exemption applies. An IP address alone does not trigger that device-storage/access rule, but it may be personal data under UK GDPR.
Assess whether a DPIA is required before processing begins, and check whether the organisation must pay the ICO data protection fee or qualifies for an exemption.
Confirm which advertising rules applythe CAP Code for non-broadcast audio, or the BCAP Code for broadcast radio, with Ofcom's regulatory role.

UK GDPR, DPA 2018 and ICO guidance

In the UK the framework is the UK GDPR and the Data Protection Act 2018, regulated by the ICO. The ICO's Guidance on AI and data protection covers AI-driven targeting and measurement, including transparency, fairness and accountability, and explaining decisions. For profiling, consult the ICO's Automated decision-making and profiling guidance.

Data protection duties per activity

Identify each processing activity
Assign a lawful basis
Set a retention period
Check ICO AI guidance
Explain automated decisions

Lawful basis and consent

PECR applies alongside UK GDPR. For direct marketing by electronic mail or text, PECR generally requires consent, subject to limited exceptions; a UK GDPR lawful basis does not replace that requirement. For online radio and podcast measurement, obtain PECR consent before using cookies or similar technologies to store information on, or access information from, a listener's device, unless an exemption applies. An IP address alone does not trigger that device-storage/access rule, though IP addresses and device IDs may be personal data under UK GDPR. Identify and document a UK GDPR lawful basis for other processing; legitimate interests can cover some measurement, but complete an assessment and respect objections. Follow the ICO's Direct marketing guidance.

Consent evidence checklist

Consent is specific and informed
Consent is recorded
Keep what listener was told
Record when consent was given
Check competition tick box covers targeting
Complete legitimate interests assessment
Respect objections

A consent record template should capture: listener ID, date, source, wording version, purposes, lawful basis, withdrawal route and retention date. A tick box on a competition entry may not cover ad targeting.

For how the regulators fit together, see our radio advertising UK rules and compliance guide for 2027.

AI, profiling and automated decisions

AI tools score listeners, predict response and optimise creative in real time. Article 35 requires a data protection impact assessment where the risk is high.

The DPIA trigger is not a headcount. It applies before processing likely to result in high risk, including systematic and extensive profiling with significant effects, large scale special category data, and systematic monitoring of public areas on a large scale.

Profiling that infers health, politics or sexuality from listening habits is likely to be special category data, which needs an additional condition and usually explicit consent. A station's own consent will not cover your use.

Tobacco, vapes and ad restrictions

The Tobacco and Vapes Act 2026 tightens advertising restrictions in England. It restricts advertising and promotion for tobacco, cigarette papers, herbal smoking products, vapes and nicotine products. The restrictions cover paid promotion in broadcast and on-demand audio, including radio and podcast spots, and online audio. They also limit sponsorship and free distribution.

If the spot promotes a vape or nicotine product, it is likely within scope. Youth appeal and audience targeting are central to enforcement. Check the Tobacco and Vapes Act 2026 before you book.

Non-broadcast audio and the CAP Code

Podcast and online radio ads fall under the CAP Code (the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing), administered by the ASA. It requires ads to be legal, decent, honest and truthful. The relevant rules include 3.1 (misleading advertising), 3.3 (omissions) and 3.7 (evidence for claims), plus the privacy rules in Section 6.

A host-read podcast ad is not exempt because it sounds informal. The advertiser stays responsible for the claim and for lawful data use.

Worked example: podcast campaign

A team in Manchester runs a podcast campaign with a £4,000 media budget and a £1,500 production budget. Its AI tool matches downloads to website visits, processing IP addresses and device IDs, which are personal data.

Before launch, the team checks whether the podcast network obtains valid consent for any cookies or similar tracking technologies, documents its lawful basis for measurement, completes a legitimate interests assessment if it relies on that basis, and sets a 90-day retention period.

A £300 legal review of the consent wording is cheaper than rebuilding the campaign after a complaint. A DPIA has no fixed public price: cost depends on processing activities, data types and suppliers. The £300 review is illustrative.

If the same team promoted a nicotine product, the data protection work would not cure a breach of the advertising restrictions.

For the England-specific rules on placement and licensing, our article on radio advertising UK regulations in England explains what changes when you buy airtime outside the national networks.

Common questions

Does UK GDPR apply to radio advertising?

Yes, when the campaign uses personal data such as names, contact details, device identifiers or IP addresses. The duties apply to broadcast and online audio.

Can we rely on legitimate interests for ad targeting?

Sometimes, but complete a legitimate interests assessment and offer a clear right to object.

What does the Tobacco and Vapes Act 2026 mean for audio ads?

It restricts tobacco, vape and nicotine ads across broadcast and on-demand audio.

Do podcast ads follow the same rules as radio?

No. Podcast and online audio ads generally fall under the CAP Code; broadcast radio ads fall under the BCAP Code. The ASA administers the codes under its regulatory arrangements with Ofcom.

This is general guidance, not legal advice. Individual campaigns need a qualified adviser.