Can UK brands use surnames to target multicultural ads?

Using surnames to infer ethnicity is a high-risk shortcut for UK multicultural advertising, not a sound default targeting method. If a brand deliberately infers someone’s racial or ethnic origin, it is processing special category data under UK GDPR and needs both a lawful basis and a separate special category condition. Build relevance through customer-chosen preferences and contextual placements instead, without turning either into hidden ethnicity labels.

Why surname-based targeting is the wrong starting point

A familiar brief lands in a CRM team’s inbox: “Find customers likely to celebrate this festival, then send them the relevant offer.” Someone proposes matching surnames against a database of ethnic origins.

That changes the task from finding a relevant audience to assigning sensitive identities to identifiable people.

A name is not permission, and it is not a reliable account of someone’s identity. Names can reflect marriage, adoption, migration, mixed heritage or family history. They do not establish someone’s faith, language, cultural interests or willingness to receive a particular message.

Even a correctly inferred ethnic background would not establish campaign relevance. Interests and practices vary by generation, faith, region and individual. Two people with the same surname may want entirely different products and communications.

The better question is: What customer need are we trying to serve, and can we identify it without guessing ethnicity?

What UK data protection rules mean for the brief

The Information Commissioner’s Office guidance on special category data explains the additional protection attached to personal data revealing racial or ethnic origin, religious beliefs and other sensitive characteristics.

A surname is not automatically special category data in every context. Holding it to address an order is different from running it through a model designed to classify the customer’s ethnicity.

When you deliberately make that inference about an identifiable person, treating the result as merely a “probability” does not remove the issue. Nor does buying the classification from a supplier transfer your responsibilities away.

Legitimate interests alone is not enough

Processing special category data requires an Article 6 lawful basis and an Article 9 condition. Legitimate interests is an Article 6 basis; it is not an Article 9 condition.

For ordinary commercial ethnicity-based targeting, explicit consent may be the relevant special category condition to investigate. Other conditions are narrow and should not be assumed to cover marketing. Explicit consent must be specific, informed and freely given; a generic newsletter opt-in is not consent to ethnicity profiling.

Electronic marketing also has its own rules under PECR. Permission to send an email and permission to process sensitive identity data are separate questions. One does not automatically answer the other.

Have your privacy lead review the proposed processing before anyone builds the segment. The ICO’s direct marketing guidance is a useful starting point, not a substitute for assessing your actual data flows.

Separate cultural relevance from identity classification

Consider three hypothetical campaign decisions.

“Send this offer to everyone with a likely South Asian surname”

This deliberately creates an ethnicity-based audience. It also combines many different communities, languages and preferences into one unreliable marketing assumption.

Renaming the segment “festival shoppers” does not change how it was built. Assess the underlying logic, not the friendly label in the dashboard.

“Let customers choose seasonal gifting updates”

This starts with an expressed interest rather than an inferred identity. Make the choice clear and optional, explain how it affects communications, and provide an easy way to change it.

Do not quietly translate “interested in Diwali gifts” into “Hindu customer”. People buy gifts for friends, colleagues and relatives, and participation does not establish religious identity. Assess the preference field itself too: wording and intended use can determine whether it reveals sensitive information.

“Place the campaign beside relevant editorial content”

A contextual placement can reach readers engaging with a topic without the brand classifying each reader’s ethnicity. For example, a retailer could sponsor a seasonal gifting guide in a community publication.

However, a contextual brief does not guarantee a contextual delivery system. Ask whether the publisher or advertising supplier uses page content alone, individual profiles, tracking technologies or inferred sensitive characteristics.

Build a needs-led audience plan

Replace “Which ethnicity is this customer?” with a campaign-specific need that can be addressed directly.

For a grocery campaign, that might mean a product interest, delivery area or chosen recipe theme. For a travel campaign, it might mean a customer-selected destination alert. For a financial service, it might mean a clearly requested guide to a particular service.

Use these signals only for explained, proportionate purposes. A destination preference is not permission to infer nationality; a vegetarian purchase is not proof of religion.

A practical plan has three layers:

• Reach: relevant publications, programmes, events or contextual environments, with the buying method checked.
• Choice: optional content, product or language preferences that customers can control.
• Creative: messages that explain the offer without claiming to know the recipient’s identity.

Language preference can be useful for delivering understandable communications. It should not become a covert ethnicity field. Someone choosing Polish copy has requested Polish copy, not necessarily declared their nationality or ethnic origin.

Check suppliers and platform activation

An enrichment supplier may promise cultural audience segments using names, postcodes, browsing behaviour or purchase history. Ask what each output actually means and how it was produced.

A segment described as “community affinity” could represent a declared interest, a contextual opportunity or an inferred ethnic identity. Those are materially different products.

Before procurement, request:

• The input data, collection sources and classification method.
• The purposes communicated to the people concerned.
• The proposed lawful basis and any special category condition.
• Retention, correction, deletion and objection arrangements.
• Evidence supporting any consent the service relies on.
• Details of onward sharing and the organisations involved.

A supplier’s accuracy claim is not a compliance assessment. Check platform rules separately; an advertising service may prohibit targeting practices even where a supplier claims a legal route exists.

Uploading hashed customer email addresses does not make the activity anonymous. Hashing used for matching generally leaves personal data within the process. Review what audience membership reveals, who receives it and whether the upload is necessary.

Practical pre-launch checklist

Use this as a go/no-go check for the audience brief:

• Define the need: Can we explain campaign relevance without assigning ethnicity or religion?
• Inspect every input: Have we checked names, location, behaviour, supplier fields and model outputs?
• Identify inference: Are we deliberately creating or using a sensitive identity classification?
• Document the route: Has the privacy lead confirmed the lawful basis and, where needed, special category condition?
• Check channel permission: Have we assessed applicable PECR requirements separately?
• Assess risk: Have we considered whether a data protection impact assessment is required?
• Limit collection: Are we collecting only what the campaign needs, for a defined period?
• Check suppliers: Do contracts and actual delivery methods match the approved plan?
• Enable control: Can people understand, change or withdraw preferences and exercise their rights?
• Review measurement: Can we evaluate performance without adding ethnicity labels to customer records?

If the team cannot explain a segment’s origin, pause activation. “The agency supplied it” is not an adequate answer.

Measure response, not presumed identity

Use campaign-specific links, placement reporting, completed purchases and appropriate consented analytics to assess performance. Compare creative or contextual environments against the same commercial objective.

A strong result in a community publication shows that the placement generated a response. It does not prove that every purchaser belongs to that community.

If understanding ethnic differences is genuinely necessary for research, design that as a separate, properly governed project. Do not retrofit sensitive identity guesses into a sales dashboard.

Review creative for cultural risk before launch

A sound audience plan can still carry presumptuous copy. Check for lines such as “Celebrate your festival” when the recipient has only browsed a product, or images that present one family structure, faith practice or appearance as universal.

Review the copy, imagery, landing page and delivery context together, using reviewers with relevant lived experience while recognising differences within communities. Kulture adapts ad copy, images and video for UK communities and runs cultural risk reviews. Pair that cultural assessment with privacy approval: respectful creative cannot repair an unjustified targeting method.