A very experienced expert lawyer who should know, and knows adtech well says "Section 3 of the DPA? Advertising using data that would reveal an identifiable living individual ? It’s a bit more complex than that as processes to protect such data being used should also be included."

DPA is I assume Data Protection Act (UK): https://www.legislation.gov.uk/ukpga/2018/12/contents/enacte...