ICO makes audience-list provenance a CMO approval question

Require a provenance record before activation

The direct CMO question is where each audience attribute came from and why it may be used for this campaign. An AI model can infer, enrich, cluster, score, or expand a list without making the underlying collection fair or the intended marketing use transparent. Technical availability is not permission.

The campaign record should name first-party, partner, broker, public, and inferred inputs; collection context; applicable notice; lawful basis; permitted purpose; geography; age or vulnerability concerns; retention; exclusions; and the party responsible for honoring rights. Unknown origin should remain an approval blocker, not become a generic data-platform label.

Inspect the inference, not only the source list

Audience models can produce new personal information from apparently ordinary inputs. A segment such as likely health concern, financial pressure, job change, political interest, or vulnerability can alter risk even when no source field used that label. Marketing should document the intended inference, evidence, likely error, affected people, and consequence of inclusion or exclusion.

The CMO should ask whether the audience would reasonably expect the use and what explanation can be given without revealing trade secrets or creating a false account. A model score should not be represented as a fact about a person, and sensitive or high-consequence targeting requires a stricter route.

Carry objections through every activation partner

The ICO describes the right to object to direct marketing as absolute. An unsubscribe or suppression recorded in one system is ineffective if enrichment, lookalike creation, an agency export, or a platform upload silently reintroduces the person. The operating control must follow the identity and campaign across the actual stack.

Marketing operations should test receipt, propagation, timing, matching, deletion or suppression behavior, and proof across CRM, data platform, agency, media, messaging, and measurement partners. The record should also show how a person can object when the audience was inferred and no ordinary email unsubscribe exists.

Keep UK guidance and campaign law distinct

ICO guidance is authoritative for its UK regulatory context, but it does not decide every campaign, channel, jurisdiction, contract, platform rule, or sector duty. A multinational audience may require separate analysis, and the same list may have different permissions for email, text, calling, targeted advertising, or measurement.

Approve a bounded use with named evidence and conditions. If the source, purpose, audience, channel, geography, provider, model, or notice changes, reopen the decision. Do not describe provenance documentation as proof that the model is accurate, the creative is lawful, or the campaign will perform.

Turn this source into a reviewable decision

For AI for CMOs, use this briefing as a dated decision record rather than a substitute for the source. Preserve Information Commissioner's Office, the exact URL, the July 30, 2026 review date, the supported facts above, the editorial interpretation, the limitations, and any buyer-specific evidence. Link that record to the decisions most directly affected: Audience and market insight; Media planning and activation; Customer journeys and personalization; Brand, disclosure, and synthetic-media risk. State whether the source changes the scope, evidence requirement, control, sequence, or only the language used to describe the decision.

Before action, name the accountable owner, affected population and workflow, exact offering or configuration, source data and rights, human decision point, exception and appeal path, complete cost, expected benefit, failure and stop conditions, retained evidence, and next review date. Keep official facts, provider statements, buyer observations, representative tests, measured outcomes, editorial inferences, and unknowns visibly separate. Reopen the record when the source, offer, model, integration, data, policy, population, responsible person, or measured result changes.

Limitations and unknowns

This briefing summarizes current ICO direct-marketing guidance at a high level and does not determine UK GDPR, PECR, other-jurisdiction, sector, contract, or platform obligations for a campaign. It does not validate an audience model, lawful basis, consent, notice, suppression process, accuracy, fairness, or outcome. Qualified current review is required.