Advisory Case on Drafting Personal Data Collection Notices for YouTube Marketing Videos

Client Information

Corporate Client / Principal
 

Case Details

As YouTube has evolved beyond a content platform into a key channel driving phone, text, and messenger-based inquiries, legal inquiries regarding compliance with personal data protection laws have increased rapidly among channel operators and marketing agencies.

The Corporate Legal Team at Decent Law Firm represented the CEO of a marketing agency operating multiple YouTube channels. The engagement involved reviewing the legal structure of personal data collection and use arising from YouTube marketing videos, and designing a standardized Personal Data Collection and Use Notice (Disclaimer) to be posted in video descriptions and pinned comments.

The core issue was whether legal responsibility could extend to the channel operator, even when the operator does not directly collect or manage personal data, but viewers initiate contact during the inquiry process.

1. Preventing Expansion of Personal Data Liability

Under the Personal Information Protection Act, legal responsibility begins with identifying the party that actually collects, uses, and manages personal data.

In this structure, the entity that directly collects viewers’ phone numbers and uses them for consultation or sales activities is the advertiser (the contact information operator). As a matter of principle, the advertiser—not the YouTube channel operator—qualifies as the personal data controller.

However, from the viewer’s perspective, inquiries are often perceived as originating from the YouTube channel itself (“I contacted them after watching this channel”). As a result, in the event of data leakage or unlawful marketing practices, there was a risk that the channel operator could be exposed to allegations of aiding, abetting, or joint liability.


2. Clear Notice of Voluntary Provision by the Data Subject

When a viewer voluntarily calls a phone number displayed in a video, such conduct may legally be regarded as the data subject’s voluntary provision of personal data.

That legal interpretation, however, only applies safely when it is clearly disclosed that:
- the channel operator is not involved in collecting or managing personal data, and
- the party receiving the inquiry is a separate advertiser or business entity.

Without such disclosure, authorities may interpret the situation as the channel effectively inducing personal data provision, thereby expanding legal risk to the channel operator.