The music industry talks constantly about owning masters, publishing and catalogues. It talks much less about owning the audience that makes those assets valuable.
By Deborah Oyedijo
For most music marketing campaigns, the answer seems obvious: the label or artiste has collected the data, so it must now have a valuable database of fans to market to. But that assumption becomes much less straightforward once you look at where that information actually lives, who controls it, what the fan agreed to, and whether the label can still use it after the campaign that collected it has ended.
This matters because a large part of modern music marketing happens on infrastructure that artistes and labels do not control. Meta knows who watched the advert, who clicked it, who interacted with it and how those users behaved on its platform. TikTok has its own record of engagement. Spotify controls what its advertising and analytics tools can tell a campaign manager. A label may receive reports, audience segments and performance statistics, but that is not necessarily the same thing as possessing a portable database of the individual fans who generated those insights.
The distinction is easy to miss because the marketing campaign still feels like the label’s property. The artiste’s name is on the advert. The label paid for it. The campaign manager can see the results. But much of the underlying relationship is happening somewhere else. And that creates a strange position for the African music industry: artistes are spending money to build audiences on platforms that can tell them a great deal about their fans without necessarily giving them the underlying fan relationship to take somewhere else.
Consider how an ordinary release campaign works. An artiste announces a new single and asks fans to pre-save it. A link collects names, email addresses or phone numbers. The label runs an Instagram or TikTok campaign. Fans click, watch, share and interact. A concert is announced, and a presale form collects another batch of email addresses and telephone numbers. The most committed fans might then be moved into a WhatsApp broadcast list or a private community. None of this looks particularly remarkable anymore. It is simply how music marketing works. But these activities produce different kinds of information, and they do not all belong to the same person or exist under the same legal relationship.
A Meta campaign, for instance, can tell a label how many people saw an advert, how many clicked and which audience segments performed best. It can help identify the characteristics of people most likely to engage with an artiste. But the label does not ordinarily receive a spreadsheet containing every Instagram user who watched the advert, together with their personal information, simply because the label paid for the campaign. The same basic dependency exists across other platforms. The platform supplies the infrastructure and controls much of the data generated within it. The label gets access to tools and insights under the platform’s terms.
This is why the phrase “rented infrastructure” is useful. The industry is building its fan relationships on digital property that belongs to somebody else. That is not necessarily a problem. Social platforms provide reach that an individual label could never build on its own. An emerging artiste can reach millions of people without owning a single piece of digital infrastructure.
The problem begins when an industry becomes so dependent on those platforms that it never builds a direct relationship with the people behind the numbers. A label can know that an artiste has 500,000 followers and still struggle to answer a much more useful question: how many of those people can the label directly reach outside Instagram? That is where HYBE offers a useful contrast.
Through Weverse, HYBE has spent years building a dedicated fan platform rather than leaving the entire fan relationship inside Instagram, TikTok or other third-party social networks. Weverse has developed into a broader ecosystem where fans can join artist communities, access content, communicate, participate in memberships and purchase merchandise.
HYBE’s own reporting describes Weverse as a global superfan platform, and by July 2026 it reported more than 14 million monthly active users across the service. The important distinction is not that HYBE somehow “owns” every piece of personal information on Weverse in the same way it owns a master recording. That would oversimplify data-protection law. Weverse itself operates under a privacy policy and shares certain information with HYBE and other partners under defined arrangements. The more important point is that HYBE has helped build the first-party environment in which a large part of the fan relationship takes place.
That changes the business possibilities. A fan buying BTS merchandise through Weverse is not simply a person who happened to see an Instagram advert. The purchase takes place inside an ecosystem that can connect fan membership, content, merchandise and concert activity. Weverse’s current operations include pre-purchasing merchandise for collection at concerts, for example, while HYBE’s own reporting links the platform’s engagement and spending activity with its wider artist-driven and merchandise businesses.
This is the larger lesson for African music. A label does not necessarily need to build the next Weverse tomorrow. But it does need to think about the difference between audience reach and fan ownership of the relationship. That distinction becomes even more complicated once privacy law enters the picture. In Nigeria, the Data Protection Act 2023 does not treat personal data as an ordinary commercial asset that a company can simply collect and keep because it has obtained it. Section 25 provides several lawful bases for processing personal data, including consent, contractual necessity and certain legitimate interests. Where consent is relied upon, section 26 places the burden of proving that consent on the data controller. Silence or inactivity does not constitute consent, and consent must be affirmative rather than based on a pre-selected confirmation. The person must also be informed of their right to withdraw it. That is particularly relevant to the seemingly harmless presale or ticket form.
If a fan enters their email address to receive access to a ticket presale, what exactly did they agree to? Did they agree to receive information about that particular concert? Did they agree to receive marketing for the artiste’s next album? Did they agree to have their information shared with the label’s marketing partner? Did they agree to receive WhatsApp messages six months later? Those are not necessarily the same purpose.
The NDPA requires a controller collecting personal data directly from a data subject to provide information including the purpose of processing, the lawful basis being relied upon, recipients or categories of recipients where applicable, retention information and the rights available to the data subject. And consent is not permanent simply because it was obtained once. Section 35 gives a data subject the right to withdraw consent at any time and requires the controller to make withdrawal as easy as giving consent. Section 36 goes further for direct marketing: a person can object at any time to the processing of their personal data for direct marketing, including profiling connected to that marketing, and once they object, the data should no longer be processed for that purpose.
So imagine an artiste’s label collects 20,000 email addresses during an album presale. The album campaign ends. Two years later, the label wants to use those same addresses to promote merchandise, another artiste on its roster or a new commercial partnership. The fact that the label still has the spreadsheet does not answer whether it can lawfully use it for that new purpose.
The same tension appears in South Africa. Section 69 of the Protection of Personal Information Act, or POPIA, specifically regulates direct marketing by electronic communication. It generally prohibits processing personal information for unsolicited electronic direct marketing unless the data subject has consented or falls within a defined existing-customer exception. A non-customer whose consent is required may be approached only once to request that consent.
Where the existing-customer exception applies, it is limited to the responsible party’s own similar products or services and requires a reasonable opportunity to object both when the information is collected and in subsequent marketing communications. Every electronic marketing communication must also identify the sender and provide a way for the recipient to request that the communications stop.
Kenya’s Data Protection Act takes a similarly serious approach to consent. Section 32 puts the burden of proving consent on the controller or processor and gives the data subject a right to withdraw consent. The Office of the Data Protection Commissioner has also emphasised that consent must be voluntary and purpose-specific, and that commercial processing cannot simply rely on implied consent. The convergence across these markets is important.
The details differ, but the underlying principle is remarkably consistent: a fan’s personal data is not a blank cheque. That complicates the language of “ownership”. A master recording is a recognisable property right. If a label owns a master, it can exploit that asset subject to the terms of its agreements and applicable law. Personal data is different. A label may be the data controller for information it collects and may have lawful authority to process it for particular purposes, but that does not give it unlimited ownership over the person’s identity, contact details or behavioural information. The better way to think about it is as a relationship of lawful control and permitted use, not simple ownership.
And that distinction matters enormously for music marketing. A label might spend ₦10 million promoting an album and conclude that the campaign has “generated” 100,000 fans. But if most of those people were reached through Meta and TikTok, the label may have generated attention without building a directly portable database. If it collected email addresses through a presale, meanwhile, it may have created a valuable first-party database, but that database still exists within the limits of the consent, purpose and other obligations that governed its collection.
The commercial opportunity is obvious. The compliance responsibility is too. This raises an uncomfortable question about how campaigns are actually being run across African music markets. When a fan enters a phone number for an exclusive release, is the label recording what they consented to? Is the purpose clearly stated? Is there a retention policy? Can the fan unsubscribe from the WhatsApp list without having to beg someone on a management team to remove them? If a third-party marketing agency collected the information, does the label know exactly what that agency is permitted to do with it?
And perhaps most importantly, does anyone know where the data is six months after the campaign ends? The answer cannot simply be that the data is useful. The law is increasingly asking a different question: useful for what, on what legal basis, for how long and under whose control? That is where the African music industry’s current dependence on rented platforms becomes more significant. The problem is not that labels use Instagram, TikTok, YouTube or other platforms. They should.
The problem is building an entire fan strategy around infrastructure that can change its rules, restrict access to audience data or disappear without leaving the label with a meaningful direct relationship with the people it spent years trying to reach.
HYBE’s Weverse demonstrates one possible answer, although its scale and resources make it unrealistic to simply copy the model wholesale. The lesson is not that every African label needs to build a giant proprietary platform. It is that the music business can treat fan relationships as infrastructure worth investing in rather than treating them as a by-product of social-media campaigns. For African music, that could mean smaller, more deliberate systems: properly consented email databases, fan clubs, ticketing databases, artiste-owned communities, membership programmes and direct commerce channels that allow an artiste to recognise and communicate with genuine fans without depending entirely on an algorithmic feed. But building those systems responsibly requires something the industry cannot afford to treat as an afterthought: data governance.
The future of music marketing will not simply belong to the artiste with the biggest following. Increasingly, it may belong to the artiste who knows which part of that following they can actually reach, what they are legally permitted to do with that relationship and whether the fan can walk away from it at any time. The African music industry has become very good at renting attention. The next stage is learning how to build lasting fan infrastructure of its own. And if it wants the commercial benefits of that relationship, it will have to understand something even more fundamental: a fan may join your database, but that does not mean you own the fan.
Deborah Oyedijo is a music business writer and entertainment lawyer-in-training with a focus on the African music industry. When she is not writing about music rights and culture, she is watching K-dramas or absorbing yet another documentary. Connect with her on IG and X: ayooyedijo
Cover ph0to credit: @afronation