5 ICO checks for UGC platform audience data under UK GDPR and the DPA

What to take away

Check one: lawful basis for UGC platform audience data under UK GDPR

Every UGC platform that tracks viewers, readers or listeners needs a lawful basis before the first cookie drops. The ICO sets out six lawful bases, and audience data usually sits under legitimate interests or consent. Picking one is not a formality: the basis determines what you can do with the data and what rights people can exercise.

The ICO guide to lawful basis explains that legitimate interests requires a three-part test: identify the interest, show the processing is necessary, and balance it against the individual's rights. For audience measurement, that balance usually passes if the data is aggregated and not used to make decisions about individuals. For personalised advertising, it often fails.

Consent is the safer basis for anything that involves tracking people across sites or building profiles. UK GDPR requires that consent is freely given, specific, informed and unambiguous. Pre-ticked boxes and silence do not count. If a brand asks you to share audience segments for its own targeting, that is a new purpose and needs its own basis.

A common mistake is to name legitimate interests in the privacy notice but then use the data for something else, such as selling audience insights to third parties. That breaks the purpose limitation principle. Document the basis for each processing activity, and keep the record of processing activities up to date.

For agencies running commissions across Greater London, the North West or Scotland, the same basis must cover every region. A platform cannot apply one basis in England and another in Wales for the same audience data. The ICO expects consistency across the UK.

The lawful basis also affects how you handle objections. If you rely on legitimate interests, people have an absolute right to object to direct marketing and a qualified right to object to other processing. You must stop unless you can show compelling grounds. With consent, withdrawal is as easy as giving it, and you must stop immediately.

A practical way to map this is to list each audience data flow, from collection to deletion, and write the basis beside it. That exercise also feeds the retention schedule and the DPIA. The lawful basis to deletion walkthrough shows how one commission moves through those stages.

Under the Data Protection Act 2018, the ICO can enforce against platforms that process without a basis. Fines are not the only risk: reputational damage with brands and creators can be worse. The Act provides the statutory framework for those penalties, as set out in the Data Protection Act 2018.

Special category data in audience research

Audience data sometimes reveals more than page views. If a UGC campaign touches on health, politics, religion or sexual orientation, that is special category data and needs a separate condition under Article 9. Consent is the usual route, but it must be explicit.

Avoid inferring special category data from browsing habits unless you have a clear basis and a DPIA.

Check two: consent, cookies and storage and access technologies under PECR

PECR sits alongside UK GDPR and governs cookies, pixels and other storage and access technologies. The ICO guidance on cookies and storage and access technologies makes clear that consent is needed before any non-essential cookie is set. That includes analytics cookies, advertising pixels and social media tracking.

The consent must meet the UK GDPR standard: a clear affirmative action, granular choices, and no cookie walls that block access unless someone accepts. The ICO has taken action against sites that make acceptance the only way in. For UGC platforms, the banner must let people reject as easily as they accept.

Essential cookies are exempt. These cover things like login sessions, security tokens and load balancing. Anything used to build audience profiles, measure engagement over time or retarget users is not essential. The distinction matters because many platforms label analytics as essential by mistake.

Consent records must be kept. You need to show what someone was told, when they consented, and what they consented to. If a brand asks for proof of consent for a joint campaign, you should be able to produce it. The same applies to withdrawal: if someone opts out, the record must show it and the tracking must stop.

Where a UGC platform runs audience research, it often needs several permissions at once: one for analytics, one for advertising, one for sharing with brands, one for research panels, and one for any re-contact. Keeping those separate is the only way to stay compliant. The five permissions kept apart approach is a useful model.

PECR fines can reach £500,000, and the ICO can also issue enforcement notices. The regulator has focused on cookie banners that nudge people into accepting. If your banner uses dark patterns, such as a prominent accept button and a hidden reject link, you are exposed.

Children's data raises the bar. If your UGC platform is likely to be accessed by children, you must comply with the Age Appropriate Design Code. That means high privacy defaults, no nudging, and no profiling of children for advertising. Consent from a child under 13 is generally invalid without parental consent.

Consent or legitimate interests for analytics?

The ICO has signalled that analytics cookies still need consent under PECR, even if the processing itself could rely on legitimate interests under UK GDPR. The two regimes are separate. You cannot use a UK GDPR basis to override the PECR consent requirement for storage and access technologies.

The ICO guidance on cookies and storage and access technologies sets out the standard the regulator expects.

Check three: retention, individual rights and subject access requests

Retention is where many UGC platforms are weakest. Audience data often sits in analytics tools, CRM systems and spreadsheets long after the campaign ends. UK GDPR requires that personal data is kept no longer than necessary. That means a written retention schedule with defined periods for each data type.

A practical schedule might keep raw audience logs for 30 days, aggregated reports for 24 months, and consent records for the life of the relationship plus six years. These periods should be justified by business need or legal obligation, not habit. The schedule must be enforced, not just published.

Subject access requests (SARs) are the other pressure point. A viewer can ask for a copy of their personal data, and you must respond within one month. The clock starts when you receive enough information to identify them. You can extend by two months for complex requests, but you must explain why.

You can refuse a SAR if it is manifestly unfounded or excessive, but the bar is high. You cannot charge a fee unless the request is clearly unfounded or repetitive. For UGC platforms, the challenge is finding data across multiple systems, including those run by processors.

Other rights matter too. People can ask for rectification, erasure, restriction and portability. Erasure is not absolute: if you have a legal reason to keep the data, you can refuse. But you must tell the person what you have done and why.

A dashboard that shows where every audience figure came from makes SARs easier. If you can trace a number back to its source, you can answer a request without a manual hunt. The provenance beside every value approach is one way to build that in.

Retention also affects brands. If a brand asks you to keep audience data for its own use, that is a new retention purpose and needs a lawful basis. Joint arrangements must be documented in a contract that sets out who is responsible for what.

Handling SARs from creators and audiences

Creators are data subjects too. If a creator asks for a copy of their contract data, that is a SAR. The same one-month deadline applies. Keep creator records separate from audience records so you can respond without exposing other people's data.

Check four: DPIAs, controllers and processors, and data sharing with brands

A Data Protection Impact Assessment (DPIA) is required when processing is likely to result in a high risk to individuals. For UGC platforms, that includes large-scale audience tracking, profiling, and any use of new technologies. The ICO DPIA guidance expects you to describe the processing, assess necessity and proportionality, and identify mitigations.

A DPIA is not a one-off document. It should be reviewed when the processing changes, such as when you add a new tracking pixel or share data with a new brand. If you cannot mitigate the risks, you must consult the ICO before proceeding.

Controllers and processors must be clearly identified. The UGC platform is usually the controller for its own audience data. If a brand decides why and how the data is used, it may be a joint controller or a separate controller. Processors, such as analytics providers, act on written instructions.

Contracts must reflect those roles. A processor agreement needs to cover the subject matter, duration, nature and purpose of processing, the type of personal data, and the obligations of both parties. If a brand is a joint controller, the arrangement must be transparent to individuals.

Data sharing with brands is where DPIAs often fail. If you share audience segments, you need a lawful basis, a clear purpose, and a data sharing agreement. The brand must not use the data for its own purposes unless that was disclosed and consented to.

International transfers add another layer. If a brand or processor is outside the UK, you need a transfer mechanism, such as the UK adequacy regulations or the International Data Transfer Agreement. The DPIA should record which mechanism applies.

A DPIA also helps with accountability. If the ICO asks how you assessed risk, the DPIA is your evidence. Without it, you are relying on assertions. The ICO expects DPIAs to be living documents that inform decisions, not paperwork filed away.

When a DPIA is mandatory

The ICO lists nine criteria for a mandatory DPIA. If you meet two or more, you must do one. Large-scale profiling, innovative technology and matching data from different sources are common triggers for UGC platforms.

Check five: security, breach reporting and the ICO data protection fee

Security is a legal requirement, not just good practice. UK GDPR requires appropriate technical and organisational measures. For UGC platforms, that means access controls, encryption, pseudonymisation where possible, and regular testing. The measures must be proportionate to the risk.

A personal data breach must be reported to the ICO within 72 hours if it is likely to result in a risk to people's rights and freedoms. If the risk is high, you must also tell the individuals affected without undue delay. You should keep an internal breach log, even for incidents that you do not report.

Breach reporting is not just about hacking. Sending audience data to the wrong brand, losing a laptop, or a misconfigured database all count. The 72-hour clock starts when you become aware, not when you finish investigating. You can report in phases if you do not have all the facts.

The ICO data protection fee applies to most controllers who process personal data. It is a yearly charge, and the tier depends on the size and turnover of the organisation. Failure to pay can lead to a fine of up to £4,350. Check whether you are exempt, but most UGC platforms are not.

Security also covers processors. If your analytics provider has a breach, you need to know quickly so you can meet your own reporting duty. Contracts should require processors to notify you without undue delay.

Staff training is part of the measure. Phishing and accidental sharing are common causes of breaches. A short annual refresher, with a test, is usually enough to show you take it seriously.

The data protection fee in practice

The fee is separate from any fines. You pay it to the ICO, and it funds the regulator's work. If you are unsure which tier applies, use the ICO's self-assessment tool. Paying late can trigger a penalty, so diarise it.

Where the DPA 2018 and the Data (Use and Access) Act 2025 change things

The Data Protection Act 2018 provides the statutory basis for ICO enforcement and fills in the gaps in UK GDPR. It sets out the offences, the powers of the Commissioner, and the rules on processing for law enforcement and intelligence purposes. For UGC platforms, the most relevant parts are the enforcement powers and the provisions on consent.

The Data (Use and Access) Act 2025 is the current UK data reform statute. It adjusts some rules, including those on automated decision-making, research purposes and international transfers. It does not remove the core duties: lawful basis, consent, retention, DPIAs and breach reporting all remain.

One change is a more flexible approach to purpose limitation for research and statistics. If you use audience data for research, you may be able to rely on a broader purpose, provided you have appropriate safeguards. That could help UGC platforms that produce audience insight reports.

The Act also clarifies the rules on cookies, but it does not remove the need for consent for non-essential storage. PECR still applies, and the ICO's guidance remains the benchmark. Some low-risk analytics may benefit from exceptions, but the detail matters.

For international transfers, the Act aims to make it easier to rely on adequacy and approved mechanisms. It also gives the Secretary of State power to make new regulations. Until those are made, the existing transfer rules apply. The text sits at Data (Use and Access) Act 2025.

The ICO remains the regulator. Its guidance on lawful basis, DPIAs and cookies is still the first place to check. The Act changes some processes, not the principles.

A useful checklist for UK GDPR and DPA 2018 compliance:

What to watch next

The ICO will publish more guidance as the Data (Use and Access) Act 2025 is implemented. Watch for consultations on cookies and research purposes. Platforms that keep their records current will find the transition easier.

Common questions

Do I need consent for analytics cookies on a UGC platform?

Yes, unless the cookie is strictly necessary for a service the user requested. Analytics cookies that track behaviour over time need PECR consent. The ICO has been clear that analytics is not essential by default.

How long can I keep audience data?

Only as long as necessary for the purpose. A common approach is 30 days for raw logs and up to 24 months for aggregated reports. Document the reason for each period and delete on schedule.

When is a DPIA mandatory?

When processing is likely to result in a high risk. The ICO lists criteria such as large-scale profiling, innovative technology and matching data. Meeting two or more usually triggers the requirement.

What is the ICO data protection fee?

It is an annual charge for most controllers. The tier depends on size and turnover. Non-payment can lead to a fine of up to £4,350, so check your tier and pay on time.

Does the Data (Use and Access) Act 2025 remove consent requirements?

No. It adjusts some rules, but consent for cookies and non-essential tracking remains. The core duties under UK GDPR and the Data Protection Act 2018 still apply.

How quickly must I report a breach?

Within 72 hours of becoming aware, if it risks people's rights and freedoms. If the risk is high, tell affected individuals without undue delay. Keep a log of all incidents.