How UK GDPR and PECR rules shape short form video lead forms

What to take away

Why ICO consent and cookie rules decide whether your video lead form works

A short form video lead form rarely sits alone. A pixel fires when the video loads, a cookie drops when the viewer lands on your page, and the form itself captures a name and email. Each step is a separate processing operation with its own rules.

The Information Commissioner's Office (ICO) enforces both the UK GDPR and the Privacy and Electronic Communications Regulations 2003 (PECR). If your consent banner is vague or your pixel fires before consent, the lead you capture is built on shaky ground. The ICO can investigate complaints, issue reprimands and fine organisations.

Consent is not the only lawful basis. But for marketing cookies and similar technologies, PECR requires consent regardless of which UK GDPR basis you rely on for the form data itself. That is why the consent flow and the lawful basis choice must be designed together.

For England's marketing teams, the practical consequence is simple: a lead form that works commercially but fails consent rules is a liability, not an asset. Read more on short form video data protection to see how this plays out in practice.

The ICO's UK GDPR guidance and resources explains the principles of lawfulness, fairness and transparency that underpin every lead capture. Start there before you brief a developer.

How UK GDPR lawful basis choices apply to first-party data from vertical video

First-party data capture means you collect the data directly from the viewer, usually through a form on your landing page or a native lead form inside TikTok, Meta or YouTube. That data is still personal data under UK GDPR.

You must identify a lawful basis before you collect it. The six bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. For marketing lead forms, consent or legitimate interests are the usual candidates.

Any consent needs to be given freely, be specific, informed and clear in its meaning. A pre-ticked box is not consent. A blanket acceptance of terms and conditions is not consent for marketing. The ICO's direct marketing and privacy and electronic communications guidance covers how consent applies to electronic marketing.

Legitimate interests can work for some first-party data uses, but you must complete a legitimate interests assessment and give people a clear opt-out. It is harder to rely on for cold marketing to new leads.

Whichever basis you choose, tell people what you will do with their data. UK GDPR Article 13 sets out what a privacy notice must contain when you collect data directly from someone on your landing page; Article 14 applies when you obtain it from elsewhere, which is often the case with leads passed over by a platform. Both require the identity of the controller, the purposes and lawful basis for each purpose, the recipients, any transfers outside the UK and the safeguards used, how long you keep the data, and the rights available. A short notice linked from the form is the minimum: it should cover access, rectification, erasure, restriction, portability, objection, withdrawal of consent and the right to complain to the ICO.

Vertical video adds a twist: the form may be completed inside the platform, so the platform is a joint controller or processor for that data. Check the platform's terms and your own record of processing activities. That record is a formal duty, not a housekeeping habit: UK GDPR Article 30 requires most controllers to keep a record of processing activities, listing the purposes of processing, the categories of data and of data subjects, the recipients, any transfers outside the UK, the retention periods and the security measures in place.

When a DPIA or an ICO fee applies to video lead capture

A data protection impact assessment (DPIA) is required by UK GDPR Article 35 before processing that is likely to result in a high risk to individuals. Pixels that profile viewers across sites, large-scale lead capture, children's data and transfers outside the UK are all common triggers, so most short form video campaigns that track viewers should start with a DPIA.

The ICO publishes a list of processing operations that always require a DPIA, covering systematic profiling and the processing of children's data. A DPIA is a written exercise: describe the processing, assess its necessity and proportionality, identify the risks to individuals, and set out the measures that mitigate them. If you cannot reduce a high risk, you must consult the ICO before you start the campaign.

Separately, almost every UK controller must pay the ICO's annual data protection fee unless an exemption applies, and the tier depends on the size and turnover of the organisation. The fee is not the same as registering a company, and paying it does not excuse a missing lawful basis or a consent banner that fires tags too early.

What PECR says about pixels, cookies and storage on short form video landing pages

PECR implements the ePrivacy Directive in UK law. Regulation 6 covers cookies and similar technologies. It requires clear and comprehensive information and consent for storing or accessing information on a user's device, unless the storage is strictly necessary to provide the service.

Marketing pixels are not strictly necessary. Neither are analytics cookies that profile users across sites. So your video landing page needs a consent mechanism before those technologies run.

The ICO's guidance on the use of storage and access technologies explains what counts as storage and access, including pixels, local storage, device fingerprinting and SDKs in mobile apps. If your TikTok or Meta pixel writes to the device, PECR applies.

Consent must be granular. Users should be able to accept marketing cookies and reject analytics cookies, or vice versa. A single accept-all button does not meet the standard. Reject must be as easy as accept.

PECR also regulates electronic marketing. Regulation 22 covers unsolicited direct marketing by electronic mail, which includes email and SMS. You generally need consent before sending marketing to individuals, unless you can rely on the soft opt-in for existing customers.

Social media direct messages can count as electronic marketing. If your video campaign invites viewers to DM you and you then send promotional messages, PECR may apply. Keep records of consent, including what the person was told and when they opted in.

Building a consent flow for TikTok, Meta and YouTube lead forms in the United Kingdom

A consent flow is the sequence a viewer experiences from seeing your video to submitting their details. It must work on mobile, where most short form video is watched, and it must be fast enough not to kill conversion.

Here is a worked example for a UK fitness brand running a lead form on TikTok and a landing page of its own.

This flow meets PECR because consent is collected before storage. It meets UK GDPR because the privacy notice is clear and the consent record is stored.

For Meta lead forms, the data is collected inside Facebook or Instagram. Meta acts as the controller for the form data and shares it with you under its terms. You still need a lawful basis for your subsequent use of that data. Check the platform's transparency centre for current terms.

For TikTok's own lead generation forms, the data is captured inside the app and passed to you as a lead. TikTok sets out its controller and processor roles in its advertiser terms, and the consent a viewer gives in-app is not the same as consent for cookies on your landing page. Check the TikTok for Business transparency resources for the current UK position, and make sure your CRM receives the data under a lawful basis you identified, not the one the platform assumed.

For YouTube, Google's consent mode can help manage tags based on user consent. But you remain responsible for ensuring consent is valid under UK PECR. Do not assume the platform's banner covers your own cookies.

Before you approve any campaign, check UK ad disclosure and consent requirements, because the Advertising Standards Authority (ASA) and the CAP Code also apply to how you present the offer.

Age-appropriate design and children's data in short form video campaigns

Short form video platforms have large teenage audiences. If your campaign is likely to attract under-18s, you must consider the ICO's children's information guidance and the Age Appropriate Design Code.

The code applies to information society services likely to be accessed by children. It sets 15 standards, including best interests of the child, data minimisation and transparency. A lead form that asks for a child's email without a lawful basis is a problem.

Age assurance is not always required, but you need a risk assessment. If your video content features toys, gaming or school-related themes, the risk is higher. If it is aimed at business professionals, the risk is lower.

If you do collect data from children, you need consent from a parent or guardian for information society services offered directly to a child. The UK GDPR sets the age of digital consent at 13, and Article 8 requires you to make reasonable efforts to verify that the person giving consent holds parental responsibility. Those efforts must be proportionate to the risk, so a self-declaration tick box is not enough: use a verification step such as confirming a parent's email address and requiring a second confirmation, or an age-assurance service that checks the adult's identity. Document which method you chose and why.

Best practice is to avoid collecting children's data in lead forms unless you have a clear purpose and a lawful basis. Use age gating on the landing page and keep the data collection to the minimum.

International transfers when your video ad platform processes UK lead data

TikTok, Meta and YouTube are global platforms. When you send UK lead data to them, or when they process it outside the UK, you need a transfer mechanism under UK GDPR.

The UK has adequacy regulations for some countries, including the European Economic Area. For the United States, the UK Extension to the EU-US Data Privacy Framework allows transfers to certified organisations. Otherwise, you need the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

You also need a transfer risk assessment. The ICO provides a tool for this. The assessment looks at the laws of the destination country and whether they undermine the protections in the transfer mechanism.

In practice, most UK marketers rely on the platform's own transfer terms rather than negotiating separate clauses. Meta, TikTok and Google each publish advertiser-level transfer terms that incorporate the standard contractual clauses and the UK Addendum; check that the version you are signed up to names the UK, covers the lead data your form actually sends, and matches the role you hold as controller or processor. Do not assume a global terms of service is enough.

Record your transfers in your data map. If a regulator asks, you should be able to show what data leaves the UK, where it goes and what safeguards apply.

A compliance checklist for video lead capture under ICO guidance

Use this checklist before you launch or renew a short form video lead campaign.

Work through the items below before launch and keep the answers with your campaign records:

For a wider view of the rules, see short form video UK regulations. And before you plan next year's campaigns, review short form video 2027 trends to align compliance with where the market is going.

Common questions

For more on how disclosure rules interact with lead forms, see short form video disclosure policy.