Corporate & Biz

Advisory Case on Drafting Personal Data Collection Notices for YouTube Marketing Videos

Provision of a Personal Data Collection and Use Notice

사건 개요

Client Information: Corporate Client / Principal

Case Details: As YouTube has evolved beyond a content platform into a key channel driving phone, text, and messenger-based inquiries, legal inquiries regarding compliance with personal data protection laws have increased rapidly among channel operators and marketing agencies.

The Corporate Legal Team at Decent Law Firm represented the CEO of a marketing agency operating multiple YouTube channels. The engagement involved reviewing the legal structure of personal data collection and use arising from YouTube marketing videos, and designing a standardized Personal Data Collection and Use Notice (Disclaimer) to be posted in video descriptions and pinned comments.

The core issue was whether legal responsibility could extend to the channel operator, even when the operator does not directly collect or manage personal data, but viewers initiate contact during the inquiry process.

디센트 전략

1. Preventing Expansion of Personal Data Liability

Under the Personal Information Protection Act, legal responsibility begins with identifying the party that actually collects, uses, and manages personal data.

In this structure, the entity that directly collects viewers’ phone numbers and uses them for consultation or sales activities is the advertiser (the contact information operator). As a matter of principle, the advertiser—not the YouTube channel operator—qualifies as the personal data controller.

However, from the viewer’s perspective, inquiries are often perceived as originating from the YouTube channel itself (“I contacted them after watching this channel”). As a result, in the event of data leakage or unlawful marketing practices, there was a risk that the channel operator could be exposed to allegations of aiding, abetting, or joint liability.

2. Clear Notice of Voluntary Provision by the Data Subject

When a viewer voluntarily calls a phone number displayed in a video, such conduct may legally be regarded as the data subject’s voluntary provision of personal data.

That legal interpretation, however, only applies safely when it is clearly disclosed that:
- the channel operator is not involved in collecting or managing personal data, and
- the party receiving the inquiry is a separate advertiser or business entity.

Without such disclosure, authorities may interpret the situation as the channel effectively inducing personal data provision, thereby expanding legal risk to the channel operator.

결과 및 의의

"Provision of a Personal Data Collection and Use Notice"

Decent Law Firm’s corporate law attorneys designed a disclaimer that structurally separates the party responsible for personal data processing from the channel operator.

The notice was drafted in a highly adaptable format, not limited to any specific industry, and structured for immediate use in YouTube video descriptions and pinned comments. It also clearly referenced the relevant provisions of the Personal Information Protection Act.

Through this approach, the advisory clarified:
- the identity of the actual personal data controller, and
- that viewers’ direct contact with the displayed phone number constitutes voluntary provision of personal data and valid consent by the data subject.

This structure significantly reduced the risk of liability expansion to the channel operator while maintaining compliance with Korean personal data protection laws.