Rules and ethics
Part of When to check content agency rules and ethics before you brief
Content marketing: when to check UK agency ad rules
Content marketing teams: a pre-launch timeline for checking UK agency briefs against CAP, ASA, UK GDPR, PECR and consumer contract rules.
What to take away
What to take away
- Content marketing briefs should be checked at brief sign-off, before contract signature, before personal data is collected and before publication.
- UK advertising self-regulation covers brand-owned channels and paid creator posts when they are marketing communications (CAP Code rule 2.1).
- A paid partnership label must be obvious before a reader engages (CAP Code rule 2.3; ASA 'Influencer's guide', 2019).
- UK GDPR duties apply to audience data, including newsletter lists and retargeting pixels (ICO 'Guide to the UK GDPR', 2023). PECR also applies to email marketing and cookies.
- Consumer cancellation rights do not come from the Small Business, Enterprise and Employment Act 2015. Check the Consumer Contracts Regulations and Consumer Rights Act 2015 where relevant.
- This is general guidance for UK marketing and England consumer contracts; individual cases need a qualified adviser.
Agencies to assess
For readers using this agency directory, Brafton, Cedar and Velocity Partners are named content-agency options to assess. Treat these names as starting points, not endorsements, and apply the same advertising, data and contract checks to whichever agency you brief.
When to pause the brief
Use this sequence before the brief goes live:
- At brief sign-off:identify paid creator content, brand-owned marketing and factual claims; agree how any advertising label will be made clear.
- Before contract signature:check the scope, approvals, renewal and cancellation terms, and who is responsible for personal data.
- Before data collection or tracking begins:check the UK GDPR basis and notices, PECR requirements, retention arrangements and whether the ICO data protection fee applies.
- Before scheduling or publication:confirm labels are prominent where readers encounter the content and that evidence for claims is ready.
The moment a commercial relationship is implied
Any content a reader could mistake for independent editorial needs a clear label. The ASA and CAP regulation pages explain that UK advertising self-regulation covers non-broadcast content, including brand-owned channels, when it amounts to a marketing communication.
CAP Code rule 2.1 requires marketing communications to be obviously identifiable as such. Rule 2.3 prohibits falsely claiming or implying that the marketer is acting as a consumer. The ASA's 'Influencer's guide to making clear that ads are ads' (2019) sets out how to label.
Pause the brief?
Could a reader mistake this for independent editorial?
Apply clear label before click or fold
Check if personal data is processed
If the agency is placing paid creator posts, the label must be obvious before the reader engages with the post. A caption buried at the bottom of a long post may not meet that test. The same applies to affiliate links and gifted products, where the commercial arrangement is easy to miss.
Non-compliant: 'Thanks to @Brand for the freebies!' with #sp buried among 30 hashtags. Compliant: 'Ad. I'm working with @Brand. I was paid to create this post.'
For wider background beyond these pre-launch checks, see the Content agencies: UK rules and compliance guide for 2027.
When personal data enters the workflow
Newsletter sign-ups, gated PDFs and retargeting audiences all involve personal data processing. The ICO's UK GDPR guidance sets out duties on lawful basis, transparency and retention. Email marketing and cookies also need a separate check under PECR.
The ICO's 'Guide to the UK GDPR' (updated 2023) says retention periods must be justified. A 24-month period is a policy choice, not a universal ICO requirement; document why the period fits the purpose and review it.
If you rely on consent under Article 6(1)(a), you must show the exact wording and the date it was given.
Email, cookies and the ICO fee
Before sending direct marketing emails, check the Privacy and Electronic Communications Regulations 2003 (PECR). The rules distinguish between subscriber types; marketing to individual subscribers may require consent or a valid soft opt-in. For cookies or similar tracking technologies used for retargeting, obtain consent unless the technology is strictly necessary.
Before processing personal data, use the ICO's data protection fee self-assessment to check whether the agency or client must pay the fee; some organisations are exempt. If the agency processes personal data on a client's behalf, the contract should also set out the required processor terms under UK GDPR Article 28.
What to check in the contract
Before signature, check the scope and acceptance criteria, who approves copy and claims, ownership or licensing of the work, renewal and cancellation terms, and which party handles personal data. If the agency acts as a processor for the client, include the required UK GDPR processor terms in the written agreement. For consumer-facing work, provide the applicable contract information before the consumer agrees.
Auto-renewal and cancellation terms
The Small Business, Enterprise and Employment Act 2015 is not the source of consumer cancellation rights. Check consumer-facing contract terms under the Consumer Rights Act 2015; for distance or off-premises consumer sales, check the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and whether an exception applies.
Check whether the retainer renews automatically, what notice period applies, and how a client cancels. The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 provide a 14-day cancellation right for many distance and off-premises consumer contracts, subject to scope and exceptions. A 30-day notice period for auto-renewal is common, but do not assume it is automatically fair: assess the term under the Consumer Rights Act 2015.
Contract and claims checks
- Auto-renewal and notice period in main terms
- Cancellation route clear for consumers
- Evidence held for every factual claim
- Comparative claims use like-for-like data
- Testimonials have permission and typicality note
- Substantiation file names claim, source, date, approver
If the agency sells to consumers directly, those terms belong in the main contract, not in a schedule. For the England-specific position, the companion piece on Content agencies UK regulations in England sets out where the rules diverge from the rest of the UK.
Claims, evidence and substantiation
Before publication, hold evidence for every factual claim. Build a substantiation file naming the claim, source, date and approver. Check pricing comparisons on the day they run.
For consumer-facing claims and offers, also check Competition and Markets Authority (CMA) guidance on consumer protection and unfair commercial practices. Advertising-code checks and substantiation do not replace a consumer-law review.
Compliance checks: before and after the brief
Before
- Brief sign-off
- Label left to the creator
- Data capture
- Email list reused with no stated basis
- Retainer terms
- Auto-renewal buried in a schedule
- Claims
- Copy approved on style alone
After
- Brief sign-off
- Label position agreed in writing
- Data capture
- Lawful basis named in the brief
- Retainer terms
- Renewal and notice period in the main terms
- Claims
- Substantiation file held per campaign
Common questions
Does the CAP Code apply to organic social posts?
Yes, when the post is a marketing communication. CAP Code rule 2.1 applies.
Who is responsible if the agency gets it wrong?
The advertiser is normally responsible for the claim, and the agency for how it was produced and labelled.
How long should we keep evidence for a claim?
Align with your UK GDPR retention schedule. A practical default is the campaign life plus 24 months, or six years under the Limitation Act 1980 where a contract claim could arise.
Do we need a separate check for Scotland, Wales or Northern Ireland?
Advertising self-regulation applies across the UK. Confirm the position for the nation where your audience sits.
