Rules and ethics
Part of What the 2024 UK consumer law changes mean for beauty influencers
Data protection: who controls audience data in beauty creator deals
Who controls audience data in beauty creator partnerships? Data protection roles, joint controllership, platform terms and practical contract steps.
What to take away
- Your first decision is who controls the personal datathe brand, the creator, or both as joint controllers.
- Consent for email, SMS or direct message marketing must be specific, recorded and easy to withdraw.
- Paid partnership disclosure is a consumer law duty in the UK, and a separate FTC duty for US audiences.
- Keep creator and audience data only as long as you can justify, with a deletion date written into the contract.
When data protection law applies to creator campaigns
Beauty creators handle audience data long before a post goes live. Seeding lists, direct message sign-ups and giveaway entries create personal data.
UK GDPR and the Data Protection Act 2018 apply to that processing, whether the brand, the agency or the creator runs it.
For duties beyond data, from platform terms to tax, the rules and compliance guide for beauty creator partnerships maps them out.
When UK GDPR Applies
- Seeding lists create personal data
- DM sign-ups create personal data
- Giveaway entries create personal data
- UK GDPR and DPA 2018 apply
- Brand, agency or creator responsible
Who is the controller, processor or joint controller?
Under UK GDPR, the controller is the person or organisation that decides why and how personal data is processed (Article 4(7)). The processor acts only on the controller's documented instructions. If a brand sets the campaign purpose and the creator only sends the emails, the brand is likely the controller and the creator a processor. If the creator chooses the audience and the message while the brand pays, they may be joint controllers.
Joint controllership is not a label you can add later. Article 26 UK GDPR requires joint controllers to have a transparent arrangement setting out who does what, especially for data subject rights and privacy information. The ICO's controllers and processors guidance and joint controllers guidance explain how to assess the facts.
Factors include who decides the purpose of the processing, who chooses the audience, who sets retention, who handles complaints and subject access requests, and whose privacy notice is shown at sign-up. An agency can be a controller, a processor or a joint controller depending on whether it decides campaign purposes or simply acts for the brand.
Audience data held inside Instagram, TikTok or YouTube is also governed by the platform's own terms. Meta/Instagram, TikTok and YouTube set their own controller roles for platform data; the brand or creator is usually controller for data they export and use elsewhere. Check the platform terms before relying on insights or direct messages.
Consent needs a record, not a memory
Where a creator emails a subscriber list or sends marketing messages, the consent standard applies. The ICO's direct marketing and electronic communications guidance sets out what that means: clear affirmative action, a named organisation, and no bundled terms. Store the timestamp, source and exact wording. A screenshot of a sign-up form is stronger evidence than a creator's recollection.
Gifted and paid partnerships rest on different bases
A gifted-only arrangement still processes data if the creator receives a mailing list or audience insights. Paid campaigns usually bring in analytics, audience demographics and conversion data. Decide the lawful basis for each purpose, and write it down before the brief is signed.
Disclosure duties that sit alongside data protection
Data rules cover the audience; disclosure rules cover the promotion. Both fall on the same campaign, so plan them together. A single brief therefore carries two duties that fail in different ways.
Consumer law bans misleading creator content
The Digital Markets, Competition and Consumers Act 2024 strengthens the UK regime against unfair commercial practices, which includes hidden advertising. The Competition and Markets Authority (CMA) enforces that regime. The Advertising Standards Authority (ASA) also applies the CAP Code, which requires paid partnerships to be obviously identifiable as marketing. A creator who buries an ad label, or a brand that instructs them to, is exposed under both systems. The same rules apply in England, Scotland, Wales and Northern Ireland.
US audiences bring FTC rules into scope
Where a campaign reaches US consumers, the FTC's guidance on disclosures for social media influencers applies. It asks for clear and conspicuous disclosure, placed where viewers will see it. One campaign can carry both UK and US expectations.
Contracts, retention and a worked example
The contract is where data protection becomes practical. Vague clauses push the risk onto whoever holds the list.
Clauses that keep the campaign lawful
Set out the purpose, lawful basis, retention period and who answers subject access requests. Name deletion dates for audience lists and analytics exports. Retention should reflect why the data was collected, not how easy it is to keep.
Require creators to report a breach within an agreed window. If the campaign spans more than one nation, beauty creator partnerships UK regulations sets out where the rules diverge.
Worked example: seeding 400 creators
For example, a brand sends 400 creators a £45 bundle each: £18,000 of stock plus £6,000 in fees.
If those creators also receive a 12,000 address subscriber list for a follow-up send, that list is personal data. Consent must come from those subscribers, not the creators. Budget around £400 for legal review of the clause set.
On the facts, the brand is likely the controller of the 12,000-name list because it decides the follow-up send, the message and the retention period. The creator is a processor if they send only on the brand's documented instructions. If the creator also chooses the audience segment or the offer, the brand and creator are joint controllers under Article 26 and need a joint controller arrangement. Consent must be captured from the subscribers, naming the brand or creator who will send the marketing; a list passed between parties without that consent is not a lawful shortcut.
Common questions
Does a creator need their own privacy notice?
Usually yes, where the creator decides how audience data is used. A short notice naming purposes, retention and a contact address is enough for most campaigns.
Do we need a data processing agreement?
UK GDPR Article 28 requires a written contract where someone processes data on your behalf. It must set the subject matter, duration, nature and purpose of the processing, the type of personal data, security, sub-processors, breach and subject access support, and deletion or return of data. Cover instructions, security and deletion, then check the wording against the campaign.
Who answers if a subscriber complains?
Whoever controls the data, or both parties under an Article 26 joint controller arrangement. The contract should name who responds, and within what period, and the joint controller arrangement should make that clear to subscribers.
How long can we keep creator records?
UK law sets no fixed period. Keep proof of consent while the marketing runs and for a short, stated time after, then delete it. Individual cases need a qualified adviser.
