[Enforcement library](/enforcement)

# Experian v ICO: limits on telling people about offline marketing data

The ICO's 2020 enforcement notice targeted Experian's use of UK adults' data for direct marketing. The First-tier Tribunal upheld only parts, and the Upper Tribunal dismissed the ICO's appeal.

## Key facts

- **Regulator or court:** ICO; First-tier Tribunal; Upper Tribunal
- **Jurisdiction:** United Kingdom
- **Framework:** GDPR, processing for direct marketing
- **Record date:** 2024-04-24
- **Procedural status:** Final; ICO appeal dismissed and no further appeal sought

The ICO ordered Experian to change how it used UK adults' data for direct marketing. The tribunals backed only parts of the order. This is an offline data broker case with little direct bearing on website tracking.

ICO, First-tier and Upper Tribunals · GDPR · Upper Tribunal ruling 24 April 2024

- The problem
- Case record
- What the tribunals decided
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

Credit reference agencies hold data on almost every UK adult. After a two-year investigation into how Experian and two other agencies used that data for direct marketing, the ICO issued Experian with an enforcement notice. Experian appealed, and the regulator ended up winning only part of its case.

## Case record

| Field | Record |
| --- | --- |
| Regulator | Information Commissioner's Office (ICO) |
| Organisation | Experian Limited |
| Action | Enforcement notice, October 2020 |
| Tribunals | First-tier Tribunal, 20 February 2023; Upper Tribunal, \[2024\] UKUT 105 (AAC), 24 April 2024 |
| Result | Notice upheld in part; ICO's appeal dismissed |
| Stage | Final. The ICO decided not to seek permission to appeal further. No fine |

## What the tribunals decided

These are tribunal outcomes as the ICO reported them in its [statement](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/04/ico-statement-on-upper-tribunal-ruling/). Inth has not summarised the full reasoning; read the [Upper Tribunal decision](https://www.gov.uk/administrative-appeals-tribunal-decisions/information-commissioner-v-experian-ltd-2024-ukut-105-aac) for that.

- The First-tier Tribunal "supported aspects" of the ICO's decision but allowed Experian's appeal in other areas.
- The Upper Tribunal dismissed the ICO's appeal against that ruling. The ICO said the flaws the Upper Tribunal identified "did not extend to overturning" the First-tier judgment, but that it had gained "clarity" on several points.

## Technical issue

The ICO describes the data as "screened, traded, profiled and enhanced to provide direct marketing services". **Inth's technical interpretation:** this is back-office data processing by a broker that never met most of the people involved. There is no website, banner or tag at the centre of it.

## Timeline

| Date | Event |
| --- | --- |
| October 2020 | ICO enforcement notice after a two-year investigation |
| 20 February 2023 | First-tier Tribunal ruling |
| 6 to 8 February 2024 | Upper Tribunal hearing |
| 24 April 2024 | Upper Tribunal dismisses the ICO's appeal |
| 24 May 2024 | ICO confirms it will not seek permission to appeal further |

## Outcome

The ICO's order stands only to the extent the First-tier Tribunal upheld it. The case is final. There was no fine; an enforcement notice orders changes rather than imposing a penalty.

## What it cost

No fine. The cost was the changes the tribunal upheld and more than three years of litigation.

## Why it matters

For most website owners, this case matters less than the others in the library. It concerns how far an offline data broker must go to tell people about processing they never saw, not how a site handles tags or cookies. It is useful mainly as a reminder that the ICO can lose, and that tribunals will test how far transparency duties reach.

## How Inth catches this

Little of Inth applies here. Website audit and the Consent banner deal with what loads on your site, and this case involved no site. Code audit can map reviewed data ingestion and onward-sharing routes in your own code, which helps if you buy or sell marketing data, but it cannot tell you what a broker does with it.

## Checks for your own systems

### In the repository

- List imports of third-party marketing data and where each one is used.

### In the browser and network

- Not applicable to this case; it involved no website.

### With the people responsible

- Ask suppliers of marketing lists how the people on them were told about the use.

## Sources and limits

- [ICO statement on the Upper Tribunal ruling, updated 24 May 2024](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/04/ico-statement-on-upper-tribunal-ruling/)
- \[Upper Tribunal decision, \[2024\] UKUT 105 (AAC)\](https://www.gov.uk/administrative-appeals-tribunal-decisions/information-commissioner-v-experian-ltd-2024-ukut-105-aac)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not summarise the full tribunal reasoning or audit Experian's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Bounty (UK)](/enforcement/bounty-uk), [Easylife](/enforcement/easylife)