Podcast SEO data protection: consent and privacy

What to take away

Podcast SEO data protection turns on the ICO's direct marketing and privacy and electronic communications rules, which apply across the UK rather than England alone.
A download or a follower is not a marketing consent, and building a list from either is a common failure.
Consent records need source, date and wording, because the sender carries the burden of proving opt-in.
Security and accessibility checks can improve the listener experience without collecting extra personal data.
For wider context, see the Podcast SEOUK rules and compliance guide for 2027.

Which data does podcast SEO actually collect?

Podcast SEO work touches four data sets: listening analytics, keyword research, CRM contacts, and cookie or pixel data on the show's site.

Personal vs non-personal data

Personal data

Download counts: No
Named subscriber email: Yes
Hashed ID + timestamp: Yes
Keyword rank outputs: No
Tracking script IDs: Yes

Not personal data

Download counts: Yes
Named subscriber email: No
Hashed ID + timestamp: No
Keyword rank outputs: Yes
Tracking script IDs: No

Only some of this is personal data. Aggregate download counts are not. An email address tied to a named subscriber is.

The practical test is whether a person can be identified, directly or indirectly. A hashed listener ID plus a timestamp can identify someone when combined with other records.

Keyword research and rank tracking usually sit outside data protection law, because the outputs are aggregate. The risk arrives with the tooling: a browser extension or a tracking script on your pages can collect identifiers you never planned for.

Write down what you collect, why, and how long you keep it. That record is your starting point for any subject access request or complaint.

Aim to collect less, and to name a retention period for each set you keep.

Do you need consent to build a podcast marketing list?

Yes, for electronic marketing to individuals in most cases. PECR requires prior consent for unsolicited marketing by email or text to individual subscribers, with limited exceptions.

Consent or soft opt-in?

Is the recipient an individual subscriber?

Yes

prior consent required

corporate subscriber rules apply

The soft opt-in is narrower than many marketers assume. It covers existing customers, similar products, and an opt-out at the point of collection and in every message.

A podcast listener is not automatically a customer, and a free subscriber usually is not.

Corporate subscribers sit under different rules, and the analysis turns on the recipient's status.

Consent records need to show what the listener actually saw. Save the wording and the date, plus the page it appeared on, and keep that evidence for as long as you rely on the consent.

A privacy notice on your show page should explain what personal data you collect, why you use it, how long you retain it, and how listeners can exercise their rights.

What should a data protection policy cover for a podcast?

A short policy beats a long template. Cover lawful basis, retention periods, processors, and how you handle requests from listeners.

Your hosting platform, email provider and analytics vendor may act as processors when they handle personal data on your behalf; their role depends on how the service uses the data. Where a provider is your processor, you need a written contract with it, and you remain responsible for overseeing the processing.

Security controls matter as much as paperwork. Ask suppliers to explain the information-security controls they use and provide evidence proportionate to the personal data they handle.

Accessibility belongs in the same policy because unusable transcripts and players push personal data into your inbox as support email.

Before launch, check that transcripts are available and accurate, captions are provided where needed, and embedded players can be operated by listeners.

Answer listener requests within one month, and keep a log of each one. If you cannot find the data, say so in writing and set out what you checked.

Set a deletion date for every list you hold, and honour it rather than renewing it by default.

How should you choose between consent and legitimate interests?

The table below sets out the calls that come up most often. Document your reasoning either way, since a regulator can ask. This is general guidance, and an individual case needs a qualified adviser.

Consent vs legitimate interests

Choose

Email newsletter to listeners: Opt-in consent, dated record
Cookie analytics on the show site: Consent for non-essential cookies, or privacy-first analytics
Marketing to a role at a limited company: Documented legitimate interests assessment
Guest and contributor records: Written agreement on use and retention
Buyers who opt out: Suppression across every tool

Avoid

Email newsletter to listeners: Scraping addresses from guest lists
Cookie analytics on the show site: Pixels that load before a choice
Marketing to a role at a limited company: Assuming corporate status
Guest and contributor records: Keeping details indefinitely
Buyers who opt out: Re-adding after a migration

Legitimate interests is not a fallback for weak consent. You need a specific purpose, a documented balancing test, and an easy way for people to object.

Common questions

Does UK GDPR apply to a podcast made in England?

Yes. UK GDPR and the Data Protection Act 2018 apply across all four UK nations, so a show in Manchester has the same duties as one in Cardiff.

Is a download count personal data?

Usually not, because an aggregate figure identifies nobody. It becomes personal data when it can be linked to a named person.

How long should you keep listener data?

No fixed period exists in law. Keep it only as long as the purpose requires, then delete or anonymise it.

Do you need consent to use podcast SEO tools?

Not for aggregate keyword data. It matters when a tool places cookies on a listener's device, or when you upload a contact list to an ad platform.