Answer capsule
The ICO’s direct-marketing guidance makes the origin, lawful use, notice, and objection path of personal information part of campaign design. A CMO should not approve an AI-built audience merely because a platform can activate it.
What the source establishes
- The ICO’s direct-marketing guidance covers collecting information and generating leads as well as planning and sending marketing.
- The guidance directs organizations to identify applicable data-protection and electronic-marketing rules and build data protection into the activity.
- It emphasizes fair collection, transparency about intended use, a valid lawful basis, and respect for people’s direct-marketing objection and opt-out rights.
- The ICO guidance is United Kingdom regulatory guidance; the correct requirements depend on the information, channel, source, audience, and facts.
Require a provenance record before activation
The direct CMO question is where each audience attribute came from and why it may be used for this campaign. An AI model can infer, enrich, cluster, score, or expand a list without making the underlying collection fair or the intended marketing use transparent. Technical availability is not permission.
The campaign record should name first-party, partner, broker, public, and inferred inputs; collection context; applicable notice; lawful basis; permitted purpose; geography; age or vulnerability concerns; retention; exclusions; and the party responsible for honoring rights. Unknown origin should remain an approval blocker, not become a generic data-platform label.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Inspect the inference, not only the source list
Audience models can produce new personal information from apparently ordinary inputs. A segment such as likely health concern, financial pressure, job change, political interest, or vulnerability can alter risk even when no source field used that label. Marketing should document the intended inference, evidence, likely error, affected people, and consequence of inclusion or exclusion.
The CMO should ask whether the audience would reasonably expect the use and what explanation can be given without revealing trade secrets or creating a false account. A model score should not be represented as a fact about a person, and sensitive or high-consequence targeting requires a stricter route.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Carry objections through every activation partner
The ICO describes the right to object to direct marketing as absolute. An unsubscribe or suppression recorded in one system is ineffective if enrichment, lookalike creation, an agency export, or a platform upload silently reintroduces the person. The operating control must follow the identity and campaign across the actual stack.
Marketing operations should test receipt, propagation, timing, matching, deletion or suppression behavior, and proof across CRM, data platform, agency, media, messaging, and measurement partners. The record should also show how a person can object when the audience was inferred and no ordinary email unsubscribe exists.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Keep UK guidance and campaign law distinct
ICO guidance is authoritative for its UK regulatory context, but it does not decide every campaign, channel, jurisdiction, contract, platform rule, or sector duty. A multinational audience may require separate analysis, and the same list may have different permissions for email, text, calling, targeted advertising, or measurement.
Approve a bounded use with named evidence and conditions. If the source, purpose, audience, channel, geography, provider, model, or notice changes, reopen the decision. Do not describe provenance documentation as proof that the model is accurate, the creative is lawful, or the campaign will perform.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Decision test
Ask whether the source changes the decision itself, the evidence required, the implementation sequence, or only the language used to describe an existing capability. Record which claims are directly supported, which are provider statements, which require an independent test, and which remain unknown. A source-linked review should make uncertainty easier to see, not bury it inside a blended score.
Questions to take into review
- Which people and channels are represented?
- Can each insight be traced to evidence?
- What is the optimization target?
- Which placements and audiences can be excluded?
- What customer data and lawful basis support the decision?
- Which offers or messages are prohibited?
- Can the asset's origin and edits be reconstructed?
- Which disclosures apply by market and context?
The publication supports research and executive decision preparation. It does not provide legal, financial, accounting, employment, clinical, cybersecurity, investment, procurement, or implementation advice.