Co-promoting a show: share audiences without breaking data rules
In this guide
You can co-promote a show and both grow your lists, but you can't simply swap or merge your mailing lists. Under UK GDPR and PECR, each promoter can only send marketing to people who agreed to hear from them specifically, or who bought from them directly under the soft opt-in. The legal way to share an audience is for each partner to market to their own list, and to collect new sign-ups and ticket buyer data with both names clearly on the consent.
This is general guidance, not legal advice.
Key takeaways
- Consent doesn't travel. A fan who opted in to your partner's emails has not opted in to yours, so list swaps are off the table.
- The soft opt-in only covers the business that made the sale. If your partner's account sold the ticket, only your partner can rely on it.
- Joint sign-up forms and ticket checkouts with a separate, named tick box for each promoter are the cleanest way to build both lists from one show.
- Agree in writing who controls which data, how opt-outs are shared and what happens to the data after the show.
- Each partner can still promote to their own list, run their own ads and use tracked links, so you get the combined reach without moving personal data around.
Who owns the data in a co-promotion?
Before sharing anything, work out each partner's role using three UK GDPR terms:
- A controller is the organisation that decides why and how personal data is used. If you run your own mailing list, you're its controller.
- Joint controllers are two or more organisations that decide the purposes and means of processing together. If you and your partner design one sign-up form and both use the data for your own marketing, you're likely joint controllers for that form. UK GDPR (Article 26) requires joint controllers to have an arrangement setting out who does what, and the essence of it should be available to the people whose data it is.
- A processor handles data only on another controller's instructions. If your partner runs the door check-in for your guestlist and uses the names for nothing else, they're acting as your processor, and you need a written contract covering that.
In a typical co-promotion, the answer is a mix. You each remain sole controller of your existing lists. Data collected for the show itself (ticket buyers, guestlist, sign-ups at the event) depends on whose ticketing account, whose form and whose consent wording was used.
The core rule: consent doesn't travel
PECR (the Privacy and Electronic Communications Regulations) covers marketing by email, text and similar electronic messages to individuals. You need either consent or the soft opt-in for each person you message, and both are tied to a specific sender.
Consent must name you. The ICO's guidance is clear that consent obtained by someone else (indirect or third-party consent) only counts for electronic marketing if the person specifically consented to messages from you, with your organisation named. "We may share your details with our partners" or "selected third parties" isn't enough.
The soft opt-in belongs to the seller. The soft opt-in lets a business email or text people whose details it collected during a sale (or negotiations for a sale), about its own similar products, provided they were given a simple way to opt out at the time and in every message. It only applies to the organisation that made the sale. If your partner's ticketing account sold the ticket, you can't rely on their soft opt-in to market to that buyer.
UK GDPR applies on top. Even sharing a list (before anyone sends anything) is processing personal data. You need a lawful basis, and people need to have been told it would happen. Most fans who signed up to one promoter's list would not expect their details to turn up in another promoter's inbox.
For a fuller run-through of consent and the soft opt-in, see our guide to PECR and marketing consent in the UK.
Five legal ways to share an audience
1. Each promoter mails their own list
This is the simplest option and needs no data sharing at all. Agree a shared announcement time, shared artwork and copy, then each send to your own subscribers. Give each partner their own tracked ticket link so you can see which list drove which sales.
2. A joint sign-up form with a tick box per promoter
For presale registration or a "get first access" page, use one form with a separate, unticked box for each promoter:
- "Email me about future events from [Promoter A]"
- "Email me about future events from [Promoter B]"
The fan picks either, both or neither. Each promoter receives only the people who ticked their box, along with a record of when they signed up and the wording they saw. Your privacy notice should name both organisations and explain what each will do with the data. Our guide to fan sign-up forms has more on wording and layout.
3. Ticket checkout opt-ins for each promoter
Most ticket platforms let the event organiser add a marketing opt-in at checkout, and some let you add more than one. Whoever holds the event on their account controls what's asked. If you can, add a named opt-in for each co-promoter. If the platform only allows one opt-in for the account holder, agree that the account holder is the only one who can market to buyers, and that the other partner builds their list through their own channels.
Remember that the soft opt-in only covers the account holder. How you then get the data out of the platform is covered in getting customer data out of ticketing platforms.
4. Sharing data for running the show, not marketing
Some sharing is needed just to put the show on: guestlists, artist plus-ones, accessibility requests, door check-in lists. That's fine as long as the data is used for that purpose only and deleted or returned afterwards. If one partner is handling the data purely on the other's behalf, put a short processor agreement in place. Accessibility details can reveal health information, which is special category data under UK GDPR, so share only what the door team needs.
5. Ads and lookalikes from your own data
Each partner can upload their own consented list to Meta to build a custom audience or lookalike, then run ads for the show. What you shouldn't do is upload your partner's list to your ad account, because that's sharing their data with you and with the ad platform without a basis. Our guide to custom audiences for events covers the transparency you need for your own uploads.
What not to do
| Practice | Why it's a problem | Do this instead |
|---|---|---|
| Swapping mailing lists as a spreadsheet | The fans never consented to hear from the other promoter | Each mail your own list with a shared announcement |
| "We may share your details with partners" | Not specific enough for electronic marketing consent | Name each promoter with its own tick box |
| Emailing buyers from your partner's ticket account | Soft opt-in only covers the seller | Add your own named opt-in at checkout |
| Adding the other promoter's contacts to a WhatsApp group | Exposes phone numbers to everyone in the group, no consent | Each invite your own opted-in fans to your own channel |
| Keeping the guestlist "for next time" | Collected for door entry, not marketing | Delete or return it after the show |
Agree it in writing before you announce
A one or two page data sharing agreement saves arguments later. It isn't always legally required for controller-to-controller sharing, but the ICO's data sharing code of practice recommends one, and joint controllers need an arrangement anyway. Cover:
- Which ticket account the event sits on, and which opt-ins appear at checkout.
- Which forms and landing pages collect sign-ups, and the exact consent wording.
- Who controls which data: each partner's existing lists, joint sign-ups, ticket buyers, guestlist.
- How data reaches each partner: export method, timing, and only the fields each needs.
- How opt-outs are passed on, so that someone who unsubscribes from a joint list isn't emailed by the other partner if they withdrew consent for both.
- Who answers questions and access requests from fans about the joint data.
- What happens after the show: deletion dates for operational data like guestlists.
- What to do if there's a data breach, including who notifies whom, and the 72-hour deadline for reporting notifiable breaches to the ICO.
Handling opt-outs and complaints with two promoters
A fan who ticked both boxes and then unsubscribes from Promoter A's email has only told Promoter A. That's fine, as long as Promoter B's emails also carry a working unsubscribe link. Problems start when a fan says "take me off everything" to one partner, or replies "STOP" to a text sent on behalf of both.
Agree that any "remove me from everything" request is forwarded to the other partner within a couple of days, and that both of you act on it. If you use a CRM with consent tracking, log the opt-out against the contact so it can't be overwritten by a later import. In Backline, each contact carries its own consent record and source, which makes it easier to show where a sign-up came from if a fan asks.
Tracking who sold what
If your deal depends on who drove sales, you can track it without sharing any personal data:
- Give each partner their own tracked link or code for the ticket page.
- Use separate links or QR codes on each partner's posters and flyers.
- If you run a street team, give each rep a referral link and agree in advance which partner's tally they count towards.
Most ticket platforms report sales by tracking link, so no names change hands.
Frequently asked questions
Can I email my co-promoter's ticket buyers?
Not unless those buyers specifically consented to marketing from you, with your organisation named. The soft opt-in only covers the organisation that made the sale, so if the ticket was sold on your partner's account, only your partner can rely on it. Add your own named opt-in at checkout if the platform allows it.
Do we need a data sharing agreement to co-promote?
If you each only mail your own lists, you're not sharing data and don't need one. If you collect data together (a joint sign-up form, shared ticket account or shared guestlist), you should agree the arrangements in writing. Joint controllers are required to have an arrangement under UK GDPR, and the ICO recommends written agreements for other sharing too.
Can a joint sign-up form use one tick box for both promoters?
It's safer to use a separate tick box for each promoter. Consent under UK GDPR should be granular, and one box for both forces fans to accept marketing from a promoter they may not want to hear from. Separate boxes also make it obvious who can contact whom.
Can the venue share its mailing list with us for a show?
Only if the venue's subscribers specifically agreed to hear from you, which is unlikely. The venue can promote the show to its own list instead, using your copy and a tracked link. That gives you the reach without anyone sharing personal data.
What should happen to the guestlist after a co-promoted show?
Guestlist names collected to get people through the door should be used for that purpose only. Delete them, or return them to whoever owns them, once the show is settled. If you want guestlist names on your mailing list, ask for marketing consent separately when you collect them.