FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Marketing and PR agencies
AI ad targeting runs on personal data, so UK GDPR and PECR apply to the audiences agencies build and the data they upload. With PECR fines now up to £17.5m or 4% of turnover, mistakes are expensive for clients and their agencies.
Part of: AI in Marketing and PR agencies
In short
Agencies use AI to model audiences, build lookalikes and personalise ads, which means processing personal data under UK GDPR and, for electronic marketing, PECR. DUAA raised the maximum PECR fine to £17.5m or 4% of global turnover, and new automated decision rules from 5 February 2026 apply to significant decisions. IPA/ISBA principles expect agencies to avoid bias and respect data rights. Fines are generally uninsurable, but a client's claim that the agency negligently handled targeting may fall within PI or cyber cover, depending on the wording.
Media and performance agencies may rely on AI to build audiences: modelling likely buyers from a client's customer list, creating lookalike audiences on ad platforms, scoring prospects, choosing which creative each person sees and adjusting bids in real time. Much of this runs inside platform tools, but the agency may choose the inputs, uploads the data and sets the parameters. That makes the agency a central actor if the data was not lawfully obtained, if the targeting is discriminatory or intrusive, or if the campaign reaches people it should not.
The ICO enforces UK GDPR and PECR. Uploading customer lists for matching, profiling people and serving them tailored ads all involve personal data and need a lawful basis, transparency and, for some activities, consent. The Data (Use and Access) Act introduced new rules on automated decision-making in Articles 22A to 22D, in force from 5 February 2026. Those rules apply to "significant decisions", which most ad targeting will not be, but agencies should consider whether a use case, such as excluding people from offers, could reach that threshold.
The penalties for direct marketing breaches have risen sharply. According to the ICO, DUAA raised the maximum PECR fine to £17.5m or 4% of global turnover. The IPA/ISBA principles add expectations to avoid bias (principle 5), respect personal data rights (principle 6) and carry out due diligence on tools (principle 9).
Illustrative scenario: an agency uploads a retailer's full customer database to build lookalike audiences, including people who had opted out of marketing. It also excludes certain postcodes from a credit offer because the model predicted lower conversion. Complaints reach the ICO, which contacts the retailer. The retailer faces an investigation and reputational damage, terminates the agency and claims its costs, saying the agency advised that the upload was compliant.
Responsibility in these cases is rarely clear cut. The client usually owns the customer data and is the advertiser, the platform runs the matching, and the agency chooses what goes in and who is excluded. That middle position is exactly why clients may look to the agency when something goes wrong, especially where the agency advised on the approach.
Other risks include targeting vulnerable people with gambling or high-cost credit ads, using sensitive inferences such as health or ethnicity, and lookalike models that quietly exclude protected groups from housing, job or financial offers.
Fines imposed by the ICO on a client or on the agency are generally uninsurable and may be excluded; see GDPR and ICO fines for professional firms. A client's civil claim alleging the agency negligently advised on or carried out targeting may fall within PI, subject to the wording and any data protection exclusion. Some PI policies limit data claims and leave them to cyber cover, so it is worth checking how the two fit together; see GDPR and data breach cover within PI and PI or media liability for AI claims.
Email and text campaigns raise separate PECR consent issues, covered in AI email personalisation and automation. For PECR basics see our glossary note on PECR. The marketing and PR agencies hub brings the series together.
How Apex helps: Apex arranges PI for media and performance agencies. A broker checks how your policies treat data protection claims arising from AI targeting work.
Articles 22A to 22D, in force from 5 February 2026, apply only to "significant decisions". Most routine ad targeting is unlikely to reach that threshold, but excluding people from important offers could raise the question and should be assessed.
According to the ICO, the Data (Use and Access) Act raised the maximum PECR fine to £17.5m or 4% of global turnover. Fines are generally uninsurable, so prevention matters more than insurance here.
IPA/ISBA principle 5 asks agencies to avoid bias. In targeting, that means checking whether models or exclusions systematically disadvantage groups of people, for example by keeping them away from financial, housing or job offers, and correcting it before the campaign runs.
Possibly. Responsibility depends on the data roles agreed and what the agency did with the data. If you advised that a use was compliant, or processed data beyond instructions, the client may look to you for its losses.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
