Use of Customer Data for Retargeting and Lookalike Audiences on Ad Platforms

The marketing team uploads customer email addresses and phone numbers to advertising platforms (Meta, Google) to create retargeting audiences and 'lookalike' audiences modelled on existing customers, in order to run more targeted acquisition and re-engagement campaigns.

1. Does uploading customer contact data to third-party advertising platforms for audience-matching constitute processing requiring specific consent under DPDP?
2. What risks arise from customer data being matched against an ad platform's own user data and used to build derived audiences?
3. What is the compliant approach to running retargeting and lookalike campaigns?

Not permissible without specific, disclosed consent for advertising use.

Customers typically provide their email and phone number for account creation, order confirmation, or service communication. Uploading that same data to a third-party advertising platform — where it is hashed and matched against the platform's own user base to enable targeted advertising, including building lookalike audiences from it — is a materially different and additional processing purpose that most privacy notices do not clearly disclose, and for which specific consent has generally not been obtained.

 

• Purpose extension without consent — Contact data collected for transactional or service purposes is repurposed for advertising targeting — a use the customer did not anticipate and, in most current implementations, was not specifically informed of or asked to consent to.
• Data leaves the organisation's environment and enters the platform's ecosystem — Once uploaded, even in hashed form, the data is processed within the advertising platform's infrastructure and matched against its own records — the organisation has limited visibility into or control over what the platform does with that hashed data beyond the immediate campaign.
• Lookalike audiences extend the impact beyond existing customers — A lookalike audience uses patterns derived from existing customer data to target entirely new individuals who have no relationship with the organisation at all — meaning the original customer's data is indirectly responsible for that stranger being targeted, a downstream effect the customer has no visibility into.
• No straightforward opt-out from ad-audience inclusion specifically — General marketing unsubscribe mechanisms typically stop email or SMS campaigns but do not necessarily remove the individual's data from an already-uploaded advertising audience list on the ad platform.
   

1. Obtain specific consent for advertising-platform use, separate from general marketing consent. Update consent language to distinctly cover use of contact data for building advertising audiences (retargeting and lookalike), rather than relying on a general marketing consent to cover this use implicitly.
2. Disclose the advertising platforms used in the privacy notice. Name the specific ad platforms customer data may be shared with for audience matching, and describe the hashing/matching process in plain terms.
3. Provide a specific opt-out from advertising audience use. Build a mechanism, distinct from general marketing unsubscribe, that removes an individual's data from all uploaded advertising audiences upon request, and periodically refresh uploaded audience lists to exclude opted-out individuals.
4. Avoid lookalike audiences built from sensitive customer segments. Do not build lookalike audiences from customer segments defined by sensitive characteristics (e.g., health-related purchases, financial distress indicators), as the resulting inference risk extends to entirely uninvolved third parties.

DPDP Risk Summary