Who do UK baby sample packs share your data with?

Who did the ICO name in the baby-club cases?

Treat the official record as history, not as a live directory of who receives a 2026 sample claim. The ICO’s investigation into direct-marketing data broking lists two mother-and-baby monetary penalties under the old Data Protection Act 1998.

Privacy International’s later write-up of the Bounty file repeats those four largest names and notes that the ICO decision left the other recipients unnamed. A 2026 claim form does not revive that 2018 list by default.

How do I read today’s partner list?

Each club is its own controller. The live answer sits on that club’s privacy notice and any partner or preference page, not in a 2019 press release.

1. 1
   Open the privacy notice from the claim page Use the link on the form you actually submitted. Search for “share”, “partners”, “third part” or “disclose”. Note the date on the notice.
2. 2
   Split processors from marketing partners Processors post packs, take card payments or host email. Marketing partners use your details for their own offers. Only the second group is “who got a copy to write to me”.
3. 3
   Look for a named list or a “disclosed at consent” line SMA Nutrition’s UK notice says it does not license data for other companies’ marketing except where you have given consent, and that identity is disclosed when that consent is sought. If a club says “selected partners” with no names, the notice has not finished the job.
4. 4
   Ask who already received the claim If the page is vague, send a subject access request. In Underwood v Bounty the club’s SAR reply listed nine organisations that had received some or all of the family’s fields.

What fields did historic packs pass on?

The ICO and later court record are useful for what a pack file can contain, not for who holds it now. Privacy International summarised Bounty’s bedside and claim-card fields as the mother’s name, date of birth, address, email, place of birth and first-birth flag, plus the baby’s name, date of birth and gender.

In [Underwood v Bounty UK Ltd [2022] EWHC 888 (QB)](https://www.bailii.org/ew/cases/EWHC/QB/2022/888.html) the SAR reply listed the mother’s name, date of birth, home address and email, and the child’s name, gender and date of birth, and said some or all of that had gone to nine organisations. That is an illustration of what a SAR can reveal, not a statement of Bounty’s current practice.

Do not add broker names that the ICO did not publish. “39 organisations” is not a licence to guess the other 35.

Do sample packs still go to credit-reference firms?

The public ICO file shows that in 2017–18 Bounty’s largest named recipients included a credit-reference agency (Equifax) and marketing businesses (Acxiom, Indicia) plus Sky. The BBC report of the penalty said Bounty told the ICO it had ended relationships with data brokers and changed how long it kept records.

That is not the same as a 2026 assurance for every other club. A nappy or formula sample claimed this week is governed by this week’s notice. If the notice is silent, use a SAR rather than assuming Equifax or Acxiom still sit on the file.

In shortThe ICO named Equifax, Acxiom, Indicia and Sky on the historic Bounty file, and separately fined Emma’s Diary’s operator. For a claim you made this year, read that club’s partner list or send a SAR. Old headlines are not a current recipient list.