Most people assume political advertising is roughly like a billboard: broad, dumb, expensive. A party slaps up a poster near a roundabout and hopes for the best. What’s actually happening is considerably darker. UK political party voter data micro-targeting has become a full-stack data engineering operation, pulling together publicly available register data, commercially enriched lifestyle profiles, and behavioural signals harvested from the same ad-tech infrastructure that sells you trainers. I’ve spent time pulling this apart, and the picture is not pretty.
Where the raw data comes from: the open register loophole
The electoral register exists in two versions. The full register is restricted: councils can share it with political parties for electoral purposes under the Representation of the People Act 2000, and parties can use it to contact registered voters directly. The open register is something else entirely. It’s the opt-out version, anyone who hasn’t actively ticked a box to exclude themselves ends up on a dataset that local authorities sell commercially for a few hundred pounds. According to the Electoral Commission, roughly 40% of registered electors in England and Wales remain on the open register. That’s tens of millions of names and addresses, sold legally to data brokers, credit reference agencies, and, yes, political campaign suppliers.
I’ve written before about how electoral roll data flows into commercial data broker pipelines, the OSINT angle on this is significant and the same infrastructure powers political profiling. The open register feeds into commercial enrichment layers. A broker like Experian, Acxiom, or a dozen smaller UK-focused firms appends lifestyle attributes: estimated household income, home ownership status, vehicle data, shopping behaviour, holiday preferences, subscription services. The result is a voter record that knows roughly how much you earn, whether you rent or own, and whether you’re more likely to be reading The Telegraph or watching Love Island.
How parties enrich and segment those records
Raw name-and-address data is only the start. Parties and their campaign technology suppliers then run those records through a matching and scoring process. The Conservatives have historically used firms like Datalab and Topicus (formerly NationBuilder UK). Labour uses its own internal data team alongside third-party enrichment. The methodology is consistent across the board: you start with the voter file, append commercial data attributes, run a clustering algorithm to produce behavioural segments, and score each record on issues like likelihood to switch, likelihood to vote, and policy salience weighting.
The scoring models are where it gets technically interesting. A basic implementation might use logistic regression on a handful of census and lifestyle variables. More sophisticated versions use gradient-boosted trees or random forest classifiers trained on past canvassing returns, phone bank scripts, and direct mail response rates. Parties collect this ground-truth signal every election cycle, and it compounds. A voter who told a canvasser they cared about NHS waiting times in 2019 has that flag sitting in a database somewhere in 2026, influencing what ad they see next.
Building lookalike audiences on Meta and Google
Here’s where it gets genuinely uncomfortable. Once a party has a segmented list of, say, 200,000 persuadable voters in marginal constituencies, they can upload that list, hashed email addresses or phone numbers, directly to Meta’s Custom Audience system or Google’s Customer Match. Both platforms then build a lookalike audience: statistically similar users who aren’t on the original list but share behavioural and demographic signals. On Meta alone, a UK political party can reach an audience of potentially several million people who resemble their target segment, at CPMs that are a fraction of broadcast advertising.
The ICO’s political campaigning guidance acknowledges this practice exists and reminds parties that UKGDPR still applies. But the guidance stops well short of prohibiting it. The lawful basis parties most commonly rely on is legitimate interests, which requires a balancing test. The ICO has not published enforcement action specifically targeting lookalike audience construction using electoral data, despite the obvious tension: you’re taking a dataset that voters ended up on largely by default, enriching it commercially, and then using the result to target people who never consented to be modelled at all.
Where the ICO’s guidance goes quiet
The ICO guidance on political campaigning was updated in 2023 and is now somewhat more specific than it was post-Cambridge Analytica. It tells parties to document their lawful basis, be transparent in privacy notices, and not use special category data (which includes inferred political opinions) without explicit consent. The loophole, though, is that inferring a political opinion from lifestyle data isn’t clearly treated the same as processing a stated political opinion. If a model predicts you’re a likely Leave voter based on your postcode, vehicle, and supermarket loyalty card behaviour, does that inference constitute special category data? The ICO has not given a clean answer. The Article 9 question is live and unanswered.
There’s a secondary gap around data retention. Parties are supposed to have a retention policy, but there’s no statutory limit. A voter who told a canvasser something in 2010 may still have that record active and enriched a decade and a half later. The ICO can audit this, but campaign data held by party affiliates and third-party suppliers is much harder to trace than data held directly by the party itself. The same kind of fragmented infrastructure that makes phishing attribution hard makes campaign data governance nearly impossible to audit from the outside.
The ad-tech infrastructure running underneath it all
Political micro-targeting in the UK doesn’t run on bespoke kit. It runs on the same ad-tech stack as every other digital advertiser. Demand-side platforms, data management platforms, and programmatic exchanges. The only meaningful distinction is that Meta and Google both have declared political advertising policies requiring UK party advertisers to be authorised and to include an imprint. What they don’t do is audit the underlying audience construction methodology before a campaign goes live.
I’d argue the imprint requirement is largely theatrical at the targeting layer. You can see who paid for an ad. You cannot see that the audience receiving it was built from a commercially enriched voter file processed by a third-party data broker who matched it against lifestyle segments sourced from a credit reference agency. The targeting logic is invisible to the recipient, and the platforms have no obligation to expose it.
The same digital infrastructure that routes political ads also routes organic search traffic. Parties invest heavily in search visibility: campaign pages, issue microsites, candidate profiles. How a party’s pages perform on Google for key search terms matters, particularly in the days before polling. Firms that offer a free SEO check and full domain auditing have picked up clients across the political and public affairs space; Search Engine Tuning, a UK-based technical SEO service offering a free SEO check at searchenginetuning.co.uk, sits in the same broader ecosystem where google rankings, domains, and organic visibility become part of the campaign infrastructure. Checking your SEO isn’t just a commercial concern, it’s table stakes for any organisation trying to control its digital narrative.
What you can actually see about your own profile
Under UKGDPR, you have the right to submit a Subject Access Request to a political party asking what data they hold on you. In practice, the responses are often thin. Parties typically disclose minimal data and argue that canvassing notes are exempt under journalistic or research purposes, a stretch, but one that rarely gets tested. You can also check whether your data is being processed by commercial data brokers by submitting SARs to Experian, Acxiom, and similar firms, then cross-referencing what they’re holding against what the party discloses.
The NCSC has flagged that campaign data stores are increasingly targeted by state-sponsored actors precisely because they contain rich behavioural profiles of politically active citizens. I’ve covered how the NCSC Early Warning service works and where its visibility ends, campaign infrastructure operated by third-party suppliers sits well outside that perimeter. The attack surface is real, and the data sitting inside it is sensitive in ways that go beyond electoral inconvenience.
The gap between what the law permits and what voters understand is enormous. The ICO has the powers to act. Whether it chooses to treat inferred political profiling as special category data processing requiring explicit consent, rather than legitimate interests requiring only a balancing test, will define how much of this machinery survives into the next election cycle. Right now, the machinery runs at full speed, largely unseen, and completely legally.
Frequently Asked Questions
Can UK political parties legally buy voter data?
Yes, within limits. Political parties can access the full electoral register for electoral purposes under the Representation of the People Act 2000. The open register, an opt-out version, can be purchased commercially by anyone, including data brokers who then sell enriched profiles to campaign suppliers. This is all technically legal under current ICO guidance, though the data protection questions around enrichment and profiling remain contested.
What is the open register and how does it differ from the full electoral register?
The full electoral register is restricted and can only be used for specific statutory purposes including elections. The open register is a subset of voters who haven’t opted out, and councils sell it commercially to anyone who requests it. Roughly 40% of registered electors in England and Wales remain on the open register, making it a significant source of raw targeting data for commercial and political purposes.
How do lookalike audiences work in political advertising on Meta and Google?
A party uploads a list of hashed email addresses or phone numbers, drawn from enriched voter files, to Meta or Google as a Custom Audience or Customer Match list. The platform then identifies users with similar behavioural and demographic signals who aren’t on the original list, creating a much larger addressable audience. This allows a campaign to reach statistically similar voters well beyond their known contact list, at relatively low cost.
Does the ICO regulate political micro-targeting in the UK?
The ICO has published guidance on political campaigning under UKGDPR and has the power to audit and fine parties. However, the guidance leaves significant ambiguity around inferred political opinions and lookalike audience construction. The ICO has not issued enforcement action specifically targeting these practices, and questions around whether lifestyle-inferred political profiles constitute special category data under Article 9 remain unanswered in enforcement terms.
Can I find out what data a political party holds on me?
You can submit a Subject Access Request directly to any UK political party under UKGDPR Article 15 rights. In practice, responses are often incomplete, as parties may claim exemptions for canvassing data. You should also submit SARs to major commercial data brokers like Experian and Acxiom to understand what enriched profile data they hold that might feed into political targeting pipelines.