How the ICO expects UK creative asset libraries to handle consent and retention

What to take away

What the ICO expects of consent records inside a creative asset library

A creative asset library is not a neutral filing cabinet. Every file that shows a recognisable person, carries a testimonial, or links to a contact list is personal data. The ICO expects you to show what happened, not just assert that consent exists.

Start with the record itself. A usable consent record ties a named individual to a specific purpose, a specific wording, a timestamp and the channel used. If the wording changes, the old record stays as it was. A library that overwrites consent text loses the evidence.

The ICO's lawful basis guidance sets out the accountability test: you must be able to demonstrate the basis you relied on. In practice that means the asset record and the consent record point at each other.

What a consent record should contain

Keep the source. A model who signed a release for a print shoot in 2023 has not agreed to a paid social cut in 2026. The record should show the scope, and the scope should be narrow enough to be meaningful.

Withdrawal has to work. If someone pulls consent, the library should flag every asset that uses them, not just the original file. Tagging assets by person makes that possible.

Where libraries usually fail

Most failures are structural rather than deliberate. Consent sits in a spreadsheet, assets sit in a digital asset management system, and nothing joins them. The result is a library that cannot answer a subject access request without manual detective work.

One common gap is inherited consent. An agency wins a client account and imports the old library, releases and all. The consent records stay with the previous agency, so the new team holds assets it cannot lawfully use.

Another is the shoot day. Releases get signed on paper, scanned, and filed by shoot date rather than by person. Six months later nobody can find the release for the one frame the client wants.

The fix is dull but effective. Treat the consent record as a required field on every asset that needs one, and block publication when it is missing. That is how personal data quietly travels through a creative software workflow, and it is also how you stop it.

Retention schedules for campaign assets, model releases and raw footage

UK GDPR does not set fixed retention periods. It sets a principle: keep personal data no longer than necessary. The ICO's direct marketing guidance applies the same logic to marketing data, and expects a defined period rather than an indefinite archive.

That means you decide the period, write it down, and follow it. A retention schedule is the written decision.

Build the schedule by asset type

Different assets carry different risk. Raw footage is the highest risk because it is unedited and often contains bystanders, background conversation and location detail. Finished campaign assets are lower risk but live longer in market.

Model releases sit in between. The release itself is evidence, so it usually outlives the campaign. Keep it for as long as you might need to prove the terms, then review.

A workable starting schedule

These are starting points, not a legal standard. A children's brand, a health client or a financial services campaign will justify shorter periods and tighter controls.

Make deletion real

A schedule that relies on someone remembering is not a schedule. Configure automatic review dates, and require a named owner to approve any extension. Log the deletion.

Watch the backups. Deleting an asset from the live library while it persists in three backup generations is a common finding. Set backup rotation to match the schedule, or document why it cannot.

For a wider view of how assets move between tools, teams and clients, this guide to ad creative asset management covers the workflow side.

Lawful basis choices under UK GDPR and PECR for marketing creatives

UK GDPR gives you six lawful bases. PECR sits alongside it and governs electronic marketing specifically. Both apply, and passing one does not excuse you from the other.

Consent is the safest basis for most marketing creatives, but it is not the only one. Legitimate interests can work for some business to business activity and for certain soft opt-in situations, provided you complete and record a legitimate interests assessment.

PECR is the stricter gate

The ICO's Guide to Privacy and Electronic Communications Regulations sets out the consent rules for UK marketing communications. For email and SMS to individuals, you generally need specific consent, or the soft opt-in where someone bought from you and you offer an opt-out.

The soft opt-in is narrow. It covers similar products, requires an opt-out at collection and in every message, and does not cover a new brand or a different product line.

Map basis to asset type

A single campaign can use several bases. The hero film may rest on consent from the featured talent. The email that promotes it rests on PECR consent from the recipient. The website landing page rests on your cookie choices.

Write the mapping down. When a complaint arrives, the mapping is what you produce.

A checklist for each campaign

Special category and children's data

Some creative work touches health, ethnicity, sexuality or political views. That is special category data, and it needs an additional condition under UK GDPR. A model release alone will not cover it.

Children's data needs its own assessment. If a campaign features under-18s, or targets them, expect a higher standard of consent and shorter retention.

Storage and access technologies: cookies, pixels and asset libraries

Creative tools sit inside a wider tracking estate. Preview links, approval portals, embedded video players and analytics dashboards all store or read information on a device.

The ICO's guidance on the use of storage and access technologies covers this ground. The key point for creative teams is that non-essential storage requires consent, and the exceptions are narrow.

Where pixels hide in creative work

A pixel on a client landing page is usually the media agency's problem. A pixel inside a creative preview environment is often nobody's problem, which is exactly the risk.

Access control inside the library

Consent is not the only control. Who can see raw footage matters too. Apply role-based access so that freelancers, client stakeholders and external partners see only what their work requires.

Expiring share links are the practical tool here. Set a default expiry, and require a reason for anything longer than 30 days.

Data residency and transfers

Many creative tools host outside the UK. Transfers to the EEA can rely on adequacy. Transfers elsewhere need a transfer mechanism and a transfer risk assessment.

Check where previews, thumbnails and transcoded files are processed. A UK-hosted library that sends every frame to a US transcoding service is not a UK-hosted library. Our map of privacy and copyright rules covers the clearance and rights side that sits alongside this.

Where UK practice diverges from the EU on consent and retention

Since the UK left the EU, the regimes have drifted. They remain close enough that EU templates look usable, which is the trap.

Cookie consent

The UK has moved toward a narrower set of exceptions for some low-risk analytics cookies. The EU, and individual member states, have not followed in the same way. A consent banner written for a German audience will over-ask in the UK and under-document for UK purposes.

Legitimate interests

The UK has signalled more openness to legitimate interests in some contexts, including certain business to business marketing. That does not remove the need for a balancing assessment, and PECR still bites.

Retention culture

EU supervisory authorities have been more prescriptive about retention periods in some sectors. UK practice is more principle-based, which puts more weight on your own documented schedule. Being less prescriptive is not permission to keep everything.

Practical implications for a UK library

One library, two rulebooks

If you run campaigns in both markets, tag assets by market and store the consent wording per market. Do not assume a single consent covers both.

Privacy by design for ad creative software products

The ICO's designing products that protect privacy guidance applies to software products, not just to campaigns. If you build or buy ad creative software, the defaults decide most of your compliance.

Defaults that do the work

Make deletion propagate. A delete action that removes the asset but leaves the thumbnail, the preview cache and the search index is not a delete.

Design decisions to make early

The disclosure question

Creative work often raises a separate question: will the audience recognise this as an advert? That is an ASA and CAP Code matter, but it belongs in the same design conversation. A workable disclosure policy starts with recognisability, and the tooling should let teams tag and evidence it.

AI features in creative tools and the ICO's expectations

AI features have moved from novelty to default in a short time. They also change the data map, because training, inference and output generation all touch personal data.

Training on customer assets

The ICO's position on generative AI has been consistent: you need a lawful basis for training, transparency about what is used, and a way for people to object where legitimate interests is the basis. Consent is not the only route, but it must be a real choice.

If your tool trains on customer assets by default, that default is the problem. Opt-in is the safer design, and it is what enterprise buyers now ask for.

Likeness and voice

AI features that generate a person's likeness or voice touch identity in a way a stock photo does not. A model release signed before generative tools existed may not cover synthetic use. Re-paper the releases, or exclude those assets.

Outputs and provenance

Record what model produced an output, when, and from what inputs. Provenance records help with ASA clearance, with client disputes, and with any later complaint.

A worked example

A Leeds agency uploads 400 hours of raw footage from a retail shoot. The library is set to retain raw footage for 90 days after sign-off and to require a model release reference on any clip containing a person.

At day 90 the system flags 62 clips with no release reference. The producer either adds the release or the clips are deleted. The final 30-second cut carries three releases, each scoped to paid social in the UK for 12 months.

When a talent asks for deletion at month eight, the team searches by person, finds the three assets and the consent record, and withdraws the paid social usage. The library flags the campaign, and the media team pauses the ads. Total time: under an hour, because the structure was there from the start.

Common questions