When to check content agency rules and ethics before you brief

What to take away

Why the rules moved

Three shifts pushed compliance up the agenda for content agencies. The Data Protection Act 2018 and UK GDPR enforcement matured. The ICO began publishing more granular marketing guidance. The advertising codes were updated for influencer marketing, affiliate content and environmental claims. Accessibility expectations hardened as public sector bodies applied the Web Content Accessibility Guidelines to agency-produced content.

The practical effect is that an agency is no longer just a supplier of words and images. It is a processor of personal data, a publisher of regulated claims, and often a co-author of accessible public information. Each role carries its own rulebook.

That matters commercially. A client procuring content in 2027 is more likely to ask for compliance evidence during the pitch than after the contract is signed. Agencies that answer those questions quickly win work that others lose at the proposal stage.

For how these duties land on day-to-day workflows, the content agencies operations and delivery guide for 2027 sets out the practical steps.

Check before you brief: data protection

Data protection checks start before the brief is written. At pitch or intake, ask who decides why personal data is used. An agency that sets the purpose is a controller. One that follows client instructions is a processor. Many agencies are both on different projects.

A written contract must set out the subject matter, duration, nature and purpose of processing. It also has to specify the types of personal data and the categories of data subject. Security measures, sub-processor rules, breach notification and assistance with data subject rights belong in the same document.

Consent is one of six lawful bases, and it is not always the right one. A newsletter built on consent needs a clear affirmative action, a record of what was agreed, and an easy way to withdraw. Legitimate interests can cover some B2B content marketing, but only with a documented balancing test.

Retention is the duty agencies overlook most often. Webinar sign-up data, event lists and gated download records should carry a stated deletion date. Data minimisation is a legal principle, not a preference. A lead magnet that collects job titles, company size and phone numbers needs a reason for each field.

Subject access requests have a one-month deadline. An agency acting as a processor must pass them to the client without delay and assist with the response. Records of processing activities are expected where processing is regular. They should name every system that holds personal data.

Joint controllership is possible when an agency and client settle the purposes together. That arrangement needs its own written terms. The client's privacy notice has to reflect it.

Controller status also brings an administrative duty. An agency that decides how personal data is used must register with the Information Commissioner's Office and pay the annual data protection fee set by the Data Protection (Charges and Information) Regulations 2018. The tier depends on staff numbers and turnover, and the registration has to be renewed each year.

International transfers add a further step. Sending personal data to a sub-processor outside the UK requires a lawful transfer mechanism. Examples include an adequacy finding or the International Data Transfer Agreement.

The ICO's guide to data protection for organisations explains the principles, lawful bases and individual rights in plain terms. The governing statute is the Data Protection Act 2018. It republishes the UK GDPR text alongside domestic provisions.

Project-level steps, including how to handle a subject access request from a client's customer, are covered in content agencies data protection in England.

Check while drafting the brief: advertising

The advertising codes, written by the Committee of Advertising Practice and enforced by the Advertising Standards Authority, apply to content that counts as a marketing communication. That includes social posts, native articles, affiliate reviews and paid partnerships. The central requirement is that ads must be obviously identifiable as ads.

Disclosure has to appear upfront. A hashtag at the end of a caption or a note in a bio usually fails the test. A platform's own label, such as Instagram's paid partnership tag, helps, but it is not always enough on its own. If the commercial relationship is unclear from the content itself, the disclosure needs to be clearer still.

Agencies often write the words that appear in a client's sponsored output. That places the agency inside the chain of responsibility. The ASA can name an agency in a ruling. Repeated breaches can be referred to Trading Standards.

Health, beauty, finance and food clients carry extra rules. Claims need evidence before publication. Comparative claims need substantiation at the point of complaint, not after it. Environmental terms such as carbon neutral require a credible basis, a defined scope and a date.

Prize promotions fall under a separate part of the CAP code. Rules cover how winners are chosen, how prizes are described, and how entry data is used afterwards. An agency running a giveaway for a client should check those rules before the first post goes live.

The content agencies advertising rules in England guide covers the sector-specific codes in more detail. For cross-border campaigns, the competition and consumer protection guidance documents from the Federal Trade Commission explain US disclosure expectations, which differ from UK practice.

Check before commissioning assets: copyright

Copyright in a photograph or illustration normally belongs to the creator, not the client and not the agency, unless there is a written assignment. A licence to use an image on a website does not automatically extend to social media, print or paid advertising. Each channel may need its own permission.

Moral rights sit separately from ownership. An author can object to derogatory treatment of their work even after assigning copyright. Agencies should not assume that a full assignment removes every obligation.

Images featuring identifiable people need more than a copyright licence. A model release or similar permission is a separate document. Stock libraries usually flag whether one exists. Publishing a portrait without that permission creates a risk the licence alone does not cover.

Stock library terms vary widely. Getty Images offers rights-managed and royalty-free licences. Shutterstock sells standard and enhanced licences. Adobe Stock has standard and extended licences. Some licences cover unlimited web use, while others cap impressions or exclude paid media. The licence travels with the asset. A client's assumption about reuse does not override the terms the agency accepted.

Creative Commons licences are not a shortcut. Most require attribution, and some forbid commercial use or adaptations. An agency that removes a credit line from a CC image is in breach of the licence, even if the client asked for a cleaner layout.

Records resolve most disputes before they start. A simple asset register noting the source, licence type, permitted channels and expiry date gives the agency something to show a client.

The GOV.UK copyright notice on digital images, photographs and the internet explains the difference between assigning copyright and granting a licence. It also sets out the position for digital images.

AI-assisted content adds a layer. Copyright protects human authorship, and the position on purely machine-generated output remains unsettled. Agencies should agree in writing how AI tools may be used, who owns the output, and what indemnity applies if a client is challenged.

Check before sign-off and publication: accessibility

Public sector bodies across the UK, including those in England, must meet accessibility standards for their websites and apps under the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018. That duty flows through to agencies producing content for them. The published page must comply regardless of who drafted it. The standard is the Web Content Accessibility Guidelines, published by the W3C.

The public sector accessibility regulations reference the EN 301 549 standard, which draws on the W3C guidelines. Agencies delivering into government or NHS clients may be asked to supply an accessibility statement. That statement has to be accurate.

The W3C accessibility standards overview explains the conformance levels and what each one requires.

Accessibility also helps private clients. Alt text, logical heading order, descriptive link text and readable contrast help search engines as well as screen readers. Accessible pages tend to attract fewer complaints and perform better in search results.

Testing matters as much as drafting. A page following guidelines can fail when a template adds an unlabelled form or a carousel lacking keyboard support.

Deque axe DevTools and WebAIM WAVE are browser tools for finding issues, while Pa11y is an open source command line tool. Agencies should ask who tests the finished page and what happens when something fails.

How England rules sit within the wider UK framework, and where Scotland, Wales and Northern Ireland differ, is covered in content agencies UK regulations in England.

Check at intake and at sign-off: ethics

Rules set the floor. Ethics cover the judgements a client will ask about even when no rule has been broken: honesty about what content can achieve, fairness to the audience, transparency about who paid for the message, and accountability when something goes wrong.

The first ethical check belongs at intake, before the brief is written. Ask which professional codes the agency has signed up to, because membership brings obligations that sit alongside the law. The Chartered Institute of Public Relations publishes a Code of Conduct for its members, the Chartered Institute of Marketing sets professional standards for marketers, and the Data & Marketing Association publishes a Code of Practice for direct and digital marketing. The International Chamber of Commerce Advertising and Marketing Communications Code is the framework the UK advertising codes draw on, and breaching a code the agency has signed up to can cost membership as well as the client relationship.

Conflicts of interest come next. An agency writing for two competing clients in the same category should declare the position at intake and agree in writing how it will be handled, including who else on the team sees the work.

Disclosure is the third check. The CAP code requires ads to be identifiable, and ethics push the same point further: where an audience could be misled about who is speaking, the answer is more transparency, not less.

AI use belongs in the same conversation. A written policy should say which tools are permitted, whether their use is disclosed to the client and to the audience, and who checks the output before it is published. Undisclosed AI use is the quickest way to lose a client's trust, whatever the contract says.

Environmental claims need evidence as well as good intentions. The Competition and Markets Authority's Green Claims Code asks businesses to back up green claims and to be clear about what is being compared.

At sign-off the same questions return: who approved the claim, what evidence is on file, and would the agency be comfortable explaining the decision publicly? Recording that reasoning takes minutes and is the cheapest protection an agency can buy.

Contracts and client briefs

A compliant agency puts the rules into the contract and the brief. That means a data processing agreement where personal data is involved, a clear scope for licences, and a written policy for any content that could be read as advertising.

The content agencies disclosure policy in England guide shows how to write a policy that clients, freelancers and in-house writers can follow without legal training.

Freelancer contracts need the same care. Contributors should warrant that their work is original, confirm they hold the rights they are licensing, and disclose any AI tool use. Without those terms, the agency carries risk it cannot manage. Indemnities should be mutual where possible and capped at a level the business can absorb.

Client sign-off is part of the control system. A named approver for claims, a log of evidence held, and a rule that unpublished claims do not go live until substantiated all reduce exposure.

A contract checklist should cover the lawful basis for processing, sub-processor approval and breach notification timescales. It should also set out IP ownership, licence scope, AI tool use and the route for handling a regulator complaint.

2027 before-and-after table

The table contrasts common agency practice before 2025 with what clients expect in 2027. It also shows when each check belongs in the briefing process.

Common questions

These are the questions clients ask most often when they brief an agency.

Does UK data protection law apply to content agencies based outside the UK?

It can, if the agency offers goods or services to people in the UK or monitors their behaviour. The Data Protection Act 2018 and UK GDPR have extraterritorial reach in those circumstances. A UK representative may be required.

Who is responsible for an ad that breaks the rules, the agency or the client?

Both can be. The brand is usually the advertiser. The ASA can name an agency that prepared or approved the content. Contracts should set out who signs off claims and who holds the evidence.

Do accessibility rules apply to private sector content agencies?

The legal duty for public sector websites sits with the public body. Agencies delivering that content must meet the same standard. For private clients there is no equivalent statutory duty in England, though accessibility remains good practice and supports SEO.

Can an agency use AI-generated images without copyright risk?

Purely machine-generated images may not attract copyright protection in the UK. That means the agency may not be able to stop others using them. Human authorship and substantial creative input change the analysis. Document the process and agree terms with the client.

This article is general guidance only. Individual cases need a qualified adviser, and rules can change. Check the current version of any statute or regulator guidance before relying on it.