How ICO guidance shapes what a UK media kit says about follower data

What to take away

What UK GDPR and the ICO require when describing follower data

A media kit is a sales document, but the moment it describes who follows you, it becomes a data document too. Follower counts, audience locations, age bands and interest categories all relate to identifiable people. The ICO publishes UK GDPR guidance and resources that sets out the principles you are writing against.

Those principles are lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. A media kit usually trips over transparency and minimisation. Creators paste in every metric a platform exposes because it looks impressive, then cannot explain where it came from.

Transparency does not mean publishing a privacy notice inside your rate card. It means the claims you make about audience data are accurate, sourced and not misleading. If a brand asks how you know that 62 per cent of your audience is in Greater London, you should have an answer.

The ICO also expects accountability. In practice that means keeping a short record of which platform dashboards you pulled figures from, when, and what you did with the underlying export. A dashboard that tracks source dates makes this far easier than rebuilding the story from memory.

There is a second regulator in the room. The Advertising Standards Authority enforces the CAP Code, and the Competition and Markets Authority has published influencer disclosure guidance. Neither governs data protection, but both care about claims that cannot be substantiated. A follower figure you cannot evidence is a problem on two fronts.

Where a media kit sits in the data chain

You are usually a controller for your own audience analytics, even when the platform holds the raw data. The platform is a separate controller or processor depending on the relationship. Brands receiving your media kit are separate controllers for their own marketing.

That matters because a brand cannot rely on your lawful basis. If you tell a brand it can email your subscribers because you have consent, you are giving advice you are not positioned to give. Describe your own processing and leave theirs to them.

What to keep on file

A one page record is enough for most creators. Note the platform, the metric, the date you exported it and the period it covers. Note who prepared the media kit. Note where the file is stored and who can access it.

If you work with an agency, agree in writing who holds that record. Agency staff often rebuild media kits from screenshots with no dates, which is where accuracy problems start.

Lawful basis for processing audience analytics in a media kit

Every processing activity needs a lawful basis under UK GDPR. The ICO's A guide to lawful basis lists the six available: consent, contract, legal obligation, vital interests, public task and legitimate interests.

Most creators rely on legitimate interests for audience analytics. You are looking at aggregate performance data to run and promote a business, which is a genuine interest, and followers generally expect platform analytics to exist. That does not make it automatic. You still need to balance your interest against the follower's rights and expectations.

Consent is the other common choice, and it is harder than it looks. Consent must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as to give. A platform's default analytics setting is not your consent mechanism.

Contract is rarely the right basis for audience analytics. It applies when processing is necessary to deliver something the person asked for. A follower viewing your content is not entering a contract with you for analytics.

Choosing and recording a basis

Do not switch basis later because a different one becomes convenient. Changing basis mid stream is only acceptable in narrow circumstances, and you would need to tell people.

What this means for media kit wording

You do not have to name your lawful basis in a media kit. You do have to avoid statements that contradict it. Saying "we only use your data with your permission" is risky if you actually rely on legitimate interests for analytics.

A safer formulation is to describe the activity and stay silent on the legal machinery. "Audience figures are drawn from platform analytics and reported in aggregate" says what happens without overclaiming.

Anonymisation, personal information and what counts as follower data

The ICO's guidance on Personal information - what is it? | ICO explains that personal information means information relating to an identified or identifiable individual. Identifiability is the test, not whether a name is attached.

That is why a follower count is usually personal data in aggregate. The count itself is not about one person, but the dataset behind it is. You can describe the dataset in a media kit without publishing anything identifiable, which is the normal and sensible approach.

Anonymisation is different from pseudonymisation. Anonymised data cannot be linked back to an individual by anyone, taking account of all means reasonably likely to be used. Pseudonymised data can be linked back with additional information, so it remains personal data.

In practice, most media kit figures are aggregated statistics derived from personal data, not anonymised data. Calling them anonymous is usually wrong, and it is the kind of error that makes a careful brand pause.

The identifiability test in plain terms

Ask whether a determined person with access to your other records could single someone out. A follower count of 40,000 cannot. A list of the twelve people who bought your last digital product can.

Small audiences are the risk area. If your newsletter has 90 subscribers and you publish a breakdown by town, you may be describing individuals even without names.

Aggregated, anonymised or identifiable

Most creators are publishing aggregated figures. That is fine. The mistake is calling them anonymised, which claims a legal status they do not have.

What counts as follower data

Follower data includes handles, profile information, engagement records, direct messages, email addresses collected through a link in bio, and any segment you build from those. It also includes inferred data, such as a platform's guess at someone's interests.

If you have written about how much personal information a media kit really needs to disclose, the same logic applies here. Disclose the shape of the audience, not the people in it.

Consent, PECR and email or newsletter audience claims

Alongside UK GDPR, PECR also governs electronic marketing. The ICO's Guide to Privacy and Electronic Communications Regulations | ICO covers the rules on email, texts and cookies.

For email marketing to individuals, PECR generally requires consent. There is a limited soft opt in exception, but it applies to people whose details you obtained in the course of a sale or negotiations for a sale, and it comes with conditions.

A newsletter sign up form with a clear opt in tick box is the straightforward route. A pre ticked box is not consent. Neither is a statement that signing up to your content means agreeing to marketing.

If your media kit says you can email 8,000 subscribers, a brand may reasonably read that as an offer. Be precise about what you would actually do: a dedicated send, a mention in an existing newsletter, or nothing at all without fresh consent.

The soft opt in, briefly

It lets you email existing customers about similar products, with an opt out at every message and an opt out at the point of collection. It does not cover purchased lists, scraped addresses or people who merely follow you on a platform.

Following an account is not a customer relationship. Do not treat it as one in a media kit.

Consent records

Keep evidence of when and how each person opted in, what they were told, and what they opted into. If a brand asks for a newsletter placement, you should be able to show that your list was built properly.

A disclosure policy covering how you label paid placements and how you source audience figures is worth having as a single page. Brands increasingly ask for it.

Subject access requests

Followers can ask what you hold about them. The ICO's guidance on Subject access requests (also known as SARs or right of access) | ICO explains the one month response window and the limits on what you can refuse.

Most creators hold very little that is not already visible on the platform. But if someone has emailed you, messaged you or bought from you, you hold personal data and the right applies. Your media kit should not promise a level of privacy you cannot operationally deliver.

Cookies, tracking and storage technologies behind audience figures

PECR also governs cookies and similar technologies. You need clear and comprehensive information about what you store or access on a user's device, and consent for anything that is not strictly necessary.

This matters to media kits in two ways. First, your own website needs a compliant cookie banner if it sets analytics or advertising cookies. Second, if you run a link in bio page or a landing page, the tracking there feeds the numbers you quote.

Platform analytics are governed by the platform's own terms and notices, not yours. You do not need to reproduce them. You do need to avoid implying that you control tracking that happens inside an app.

If your media kit quotes click through rates from a link shortener, say so. A brand comparing your figures with its own will notice the difference in method.

A short checklist for the media kit page itself

Storage and retention

Do not keep audience exports longer than you need them. If you downloaded a follower list to build a media kit, delete it once the figures are recorded. Keep the summary, not the list.

Retention is easier to defend when it is deliberate. A sentence in your internal notes saying exports are deleted after 30 days is more useful than a vague promise to keep data secure.

Example sentences a creator can use in a media kit

These are written to be accurate, modest and easy to evidence. Adapt the numbers, keep the structure.

Audience source. "Audience figures are taken from Instagram Insights for the period 1 August to 31 August 2026 and reported in aggregate."

Geography. "Top audience locations are based on platform reported country and city data. Figures are rounded to the nearest whole percentage."

Age and gender. "Demographic breakdowns are platform estimates, not self reported data, and are shown to the nearest five per cent."

Engagement. "Engagement rate is calculated as total interactions divided by reach across the reporting period, using platform definitions."

Newsletter. "The newsletter list is built through a double opt in sign up. Subscribers can unsubscribe from every message."

Data questions. "Questions about how audience data is collected and used can be sent to the contact address below."

Third party data. "Follower data is held by the platform under its own terms. This media kit reports only aggregated outputs."

A worked example

Suppose a creator in Manchester has 34,000 Instagram followers and a newsletter of 2,100 subscribers. The platform reports 41 per cent of followers in the UK, with the largest city share in Greater London.

The media kit should say: figures from Instagram Insights, exported 3 September 2026, covering August 2026. UK share 41 per cent. Newsletter list of 2,100 built by double opt in, with an unsubscribe link in every send.

It should not say the audience is "mostly London based" when 41 per cent is UK wide and the city split is unverified. Nor should it offer the newsletter list for a brand send without confirming consent covers that use.

A checklist before you send

Example sentences a creator should avoid, and why

"We own your data." You do not. Followers have rights over their personal data, and the platform holds much of it. This sentence invites a complaint.

"All data is fully anonymised." Usually untrue for aggregated platform statistics. Anonymisation has a high bar, and this claim is easy to disprove.

"We can email our 15,000 subscribers for you." Only if consent covers that specific use. Otherwise it is a PECR problem waiting for a brand to test it.

"Your data is 100 per cent secure." No system is. Absolute security claims are both unverifiable and unwise.

"We comply with all applicable laws." Vague, unfalsifiable and adds nothing. Name the specific practice instead.

"By following us you agree to our privacy policy." Following is not agreement, and this is not how consent works.

"We share data with selected partners." If you do, say who and why. If you do not, delete the sentence.

Why these sentences cause trouble

Each one makes a promise the creator cannot control. Data ownership sits with the individual. Anonymisation depends on facts about the dataset. Consent depends on how the list was built. Security depends on systems outside the creator's hands.

Brands and agencies are getting more careful about this. A media kit that overclaims on data is a signal that other claims may be loose too.

What to write instead

The fix is almost always to describe the process rather than the legal status. "Figures are aggregated from platform analytics and rounded" is defensible. "Data is anonymised" is a conclusion someone else can challenge.

If you are reviewing your whole kit against UK rules on claims, permissions and personal data, start with the sentences that promise the most and evidence the least.

Common questions