Rules and ethics
Part of Out of home advertising rules and ethics without the guesswork
How to handle out of home advertising data protection
How to handle out of home advertising data protection in England: lawful bases, consent for programmatic screens, B2B rules and a pre-publication checklist.
What to take away
Out of home advertising data protection covers the UK GDPR, Data Protection Act 2018 and PECR duties that apply when a campaign collects or uses information about people.
- A static poster with no tracking usually processes no personal data.
- Programmatic digital OOH, mobile location data and audience measurement normally do.
- The rules apply UK-wide, so an England brief follows the same standard as one in Scotland or Wales.
- B2B targeting is still marketing in the ICO's view.
- A pre-publication check is the cheapest control available.
Where the rules apply
Data protection law here comes from the UK GDPR, the Data Protection Act 2018 and PECR. Those instruments apply across the United Kingdom, so England has no separate regime. Planning consent for a large format structure is a different question, and the guide to OOH regulations in England sets out how local approval works.
What counts as personal data
Plain print is not personal data. The regime starts when a person can be singled out, even indirectly. A hashed device identifier from a mobile exchange, a number plate captured by a camera, or a partial postcode paired with a time stamp can each qualify.
Aggregated footfall totals that cannot be traced back to an individual fall outside it. The practical test is whether re-identification is realistically possible, not whether anyone intends to attempt it.
Choosing a lawful basis
Legitimate interests suits most measurement work, provided you complete a legitimate interests assessment and record it. Consent is the safer basis when you track a device across sites or serve a screen in response to someone's location.
A location signal that reveals a visit to a health clinic, a place of worship or a trade union office can create inferred data about health, religion or membership. Do not build that inference into a targeting rule. If you need it for a genuine purpose, take advice from a qualified adviser.
Consent and programmatic buying
Programmatic digital OOH usually blends inventory data with audience data inside an exchange. The IAB UK's Back to Basics Guide to Programmatic explains how that chain works. Your task is to establish whether personal data reaches the screen or only the buying decision.
If the data shapes who sees the ad, you need a lawful basis for that use and a contract that passes the right permissions down the chain. Ask the seller for the source, the basis and the retention period in writing.
Business to business campaigns
Corporate subscribers sit outside PECR's consent rule, so an email to a named limited company is treated differently from one to a sole trader. The ICO's guidance on business-to-business marketing sets out where the line falls. Sole traders and some partnerships count as individuals.
For place-based work the risk is usually a list built from venue Wi-Fi sign-ins or badge scans at an event. Check how the list was gathered before you buy media against it. The UK rules and compliance guide covers the wider disclosure duties that sit alongside data protection.
Pre-publication checklist
- Confirm whether personal data enters the campaign at all.
- Name the lawful basis for each use, and record the assessment.
- Ask the screen owner or exchange where audience data came from.
- Check that consents travel with the data through every contract.
- Remove special category inferences from targeting rules.
- Send the creative to the ASA Copy Advice service before publication.
- Log the date, the decision and the person who signed it off.
Common questions
Does a digital billboard need consent?
Only if it processes personal data. A screen that plays a fixed loop to everyone needs no consent. One that changes its message because a device is nearby almost certainly does, and a lawful basis must be in place first.
Is footfall data personal data?
Not on its own. A count with no route back to a person sits outside the UK GDPR. Add a device identifier or a camera image and the position changes.
Do B2B place-based campaigns need consent?
For electronic marketing to corporate subscribers, no. Sole traders and unincorporated partnerships need consent, unless a soft opt-in applies. Keep that line visible when you build a list.
Who enforces data protection for OOH?
The Information Commissioner's Office covers the whole UK, so the same regulator applies in all four nations. Local planning authorities handle site consent in England. Individual cases need a qualified adviser.
