Rules and ethics
UK paid social agencies: rules and ethics, gate by gate
Paid social agencies rules and ethics in the UK, gate by gate: advertising, consumer, privacy, security, accessibility, contract and disclosure checks.
An England paid-social campaign can pass a platform review and still fail an advertising, consumer, privacy, security, accessibility or contract requirement. Those are separate gates. No consent setting, disclosure button, processor clause or certificate clears the whole activity.
This guide reflects sources checked on 5 September 2026. The laws discussed generally operate across the UK, not England alone, although contractual jurisdiction and regulated-sector details can vary. It is a publication-hold framework for named qualified reviewers, not legal advice or a compliance promise.
What to take away
- Paid social must clear separate advertising, consumer, privacy, security, accessibility and contract gates, not one approval.
- The Data (Use and Access) Act 2025 provisions were all in force by 19 June 2026.
- Platform approval does not determine the regulatory perimeter or supply the advertiser's lawful basis.
- Assign controller, joint controller or processor roles by each activity, not by the services agreement label.
- Tracking technologies and electronic marketing are separate decisions under PECR and UK GDPR.
Establish the legal map before the advert
Start with the advertiser, agency, platform, creator, measurement supplier and intended audience. Record where each entity is established, where people are located and which organisation decides each purpose and essential means. Then map the product category, placement, data flow and commercial relationship.
The Data (Use and Access) Act 2025 changed parts of UK data-protection and electronic-communications law. The ICO's DUAA summary states that all its data-protection provisions were in force by 19 June 2026. Older commentary describing them as future reforms is stale.
Some detailed ICO pages have not completed that transition. Its controller and processor material is marked under review, with the regulator's guidance programme listing further updates. Record the status and check again on publication day rather than silently treating draft, under-review and final material alike.
Gate one: identify the marketing communication
CAP's recognition rules require marketing communications to be obviously identifiable. Its misleading advertising section requires documentary evidence before objective claims are distributed. These UK self-regulatory rules answer different questions: recognition tells people that content is advertising; substantiation tests what the advert says.
Build a claim register containing the exact wording, evidence owner, source, date, geography, population, qualification and expiry trigger. Check the visible caption, image, audio, call to action and destination together. An approved landing page cannot rescue an unsupported statement in a short video.
The CMA's unfair commercial practices guidance says the Digital Markets, Competition and Consumers Act 2024 provisions apply to practices from 6 April 2025.
It covers misleading actions and omissions, and practices prohibited in all circumstances. The agency should identify who owns price, availability, review and endorsement evidence, and who can correct or withdraw a campaign.
Gate two: check restricted and regulated categories
The general CAP Code has category sections for areas including health, food, gambling, alcohol, financial products and advertising to children. The current non-broadcast code index is a route into those rules, not a substitute for product-specific review.
Financial promotions require separate perimeter and approval decisions. The FCA's final social-media financial-promotions guidance FG24/1 explains that its rules are technology-neutral and addresses authorised and unauthorised communicators. An agency should not decide alone whether a communication is a regulated promotion or whether approval is valid.
The FCA's CP26/15 review of consumer-credit promotion rules was a consultation, not an enacted replacement. Any final 2027 draft should check whether the FCA has made rules since the evidence date. Platform approval does not determine the regulatory perimeter.
Gate three: assign data-protection roles by activity
Do not call the agency a processor merely because the services agreement says so. A controller decides purposes and essential means; joint controllers decide them together; a processor acts on documented instructions. The ICO's roles guidance explains this distinction but is expressly marked under review following the DUAA.
Assess each activity separately: account administration, creative testing, audience selection, customer-list upload, platform delivery, conversion measurement, reporting and the agency's own analytics. The same parties may have different roles across those operations.
For processor activity, Article 28 terms must cover instructions, confidentiality, security, subprocessors, assistance, deletion or return, and audit information. The ICO's controller-processor contract page is also under review. Treat its status as a publication-day checkpoint and obtain current UK privacy counsel.
Joint control needs its own transparent allocation of responsibilities. A commercial label cannot change the factual decisions that the parties actually make.
Gate four: document purpose, lawful basis and rights
Create one processing record for each purpose. Identify the people and data, source, lawful basis, special-category condition if relevant, recipients, retention, rights handling and risk decision. Do not reuse a lawful-basis statement written for campaign delivery to justify agency prospecting.
The ICO's March 2026 legitimate-interests guidance reflects DUAA amendments and describes the need for a lawful basis and documented assessment where legitimate interests is relied upon. Consent is not a universal alternative, and a platform term cannot supply the advertiser's basis.
Audience uploads deserve their own check. Meta's first-party Customer List Custom Audiences Terms describe hashing, advertiser permissions and specified UK GDPR roles for that feature. These are supplier contract terms, not independent legal clearance. Verify data origin, transparency, objections, suppression, sharing authority, platform role, transfer route and deletion before upload.
Design a rights route that can locate, correct, object to, restrict or delete relevant records across the client, agency and suppliers. Record who receives a request and how deletion propagates. A hashed identifier can still sit within personal-data processing.
Gate five: separate PECR technologies and messages
Tracking and electronic outreach are related but different decisions.
The ICO's final April 2026 storage and access technologies guidance covers cookies, pixels, scripts, device fingerprinting and comparable access, including online advertising. Record every technology, device action, purpose, exception or consent route, recipient and withdrawal behaviour. Consent mode or a tag status reports configuration; it does not decide whether the configuration meets PECR and UK GDPR.
The ICO's separate electronic-mail marketing guidance was updated on 28 April 2026. Apply it if the campaign or follow-up uses email, text, in-app messages or similar covered communications. A person's agreement to research, receive a download or appear in a testimonial is not automatically permission for later sales contact.
Gate six: examine transfers, security and incidents
Identify where each separate entity can access personal information, not just the nominal storage region. The ICO's international-transfer guide was updated in January 2026 and sets out a three-step assessment of restricted transfers. Record the responsible exporter, destination, mechanism and any risk assessment.
For account access, the NCSC advises access logging where available, secure credential handling, prompt removal for leavers and advance recovery planning in its social-media security guidance. The contract should set individual roles, multifactor controls, incident contacts, log availability and removal deadlines without claiming these measures eliminate risk.
The ICO's personal-data breach page discusses risk assessment and the 72-hour reporting requirement where notification is required. It is marked under review after the DUAA. The incident plan needs faster internal notification so the responsible controller can assess the facts; the agency should not promise that every incident is reportable or non-reportable in advance.
Gate seven: test accessibility as delivered
Accessibility review includes the advert, disclosure, captions, audio, contrast, motion, call to action and destination. WCAG 2.2 supplies testable technical criteria for web content, but applying a standard does not decide every legal question or user need.
Test actual formats and devices, including magnification, keyboard and screen-reader paths where relevant. Ensure a disclosure remains perceivable when text is cropped, audio is muted or a post is viewed as a short preview. Name the defect owner, acceptable evidence and pause threshold.
Gate eight: make the contract operational
The agreement should identify account and asset ownership, media payer, spending authority, deliverables, claims and creative approval, data roles, platform permissions, conflicts and rebates, measurement definitions, support, security, accessibility, fees and taxes, renewal, liability, termination, exports, deletion and continuity.
Avoid copying a model clause without mapping the service. Specify what happens if a platform changes access, rejects or suspends activity, a creator misses a disclosure, tracking loses permission or a supplier relationship ends. Preserve client access and evidence even during a fee dispute, subject to qualified commercial advice.
Metrics belong in the contract schedule with population, numerator, denominator, unit, period, timezone, source and exclusions. Neither an agency report nor platform dashboard should silently redefine acceptance.
Run a disclosure workflow, not a label checklist
Maintain a relationship register for payments, gifts, loans, discounts, affiliate commission, ownership and other material connections. The CMA's August 2025 guidance for brands places responsibility on businesses to brief, monitor and correct endorsement content.
Specify approved disclosure wording, placement and timing for every format. ASA advice on recognising influencer advertising discusses prominent upfront identification and warns that platform labels may not always be enough on their own. Treat Meta or TikTok disclosure controls as separate global supplier features, then review the rendered result against UK requirements.
Version the brief, content, evidence and approval. Monitor published placements, capture the visible state, correct failures promptly and withdraw when correction cannot make the communication clear. Record who has authority to act outside office hours.
Publication-day decision
Before publication or launch, the named owner should present eight signed outcomes: advertising recognition and claims, consumer law, regulated category, data protection, PECR, security and transfers, accessibility, and commercial contract. One failure stops the affected activity; strength elsewhere cannot offset it.
Commission named UK legal and privacy counsel, advertising and consumer specialist, FCA-authorised review where the perimeter may apply, security and accessibility reviewers, and commercial and measurement specialists.
Recheck regulator notices, under-review ICO pages, platform terms, product restrictions and enacted commencement status that day. The only defensible conclusion may be to narrow claim, remove data use or postpone the campaign.
Before you act
- Map every entity, purpose and data flow before the advert runs.
- Build a claim register with evidence owner, source and expiry trigger.
- Assess data-protection roles activity by activity, not by contract label.
- Check ICO guidance status again on publication day.
- Verify audience upload origin, transparency and deletion route before upload.
- Record every tracking technology, purpose, consent route and withdrawal behaviour.
Common questions
Why is platform approval not enough for a paid social campaign?
A campaign can pass a platform review and still fail advertising, consumer, privacy, security, accessibility or contract requirements. Those are separate gates, and no consent setting, disclosure button, processor clause or certificate clears the whole activity, so each requirement needs its own review.
How should an agency decide whether it is a processor or controller?
Do not rely on the services agreement label. A controller decides purposes and essential means, joint controllers decide them together, and a processor acts on documented instructions. Assess each activity separately, because the same parties may hold different roles across account administration, audience selection, measurement and analytics.
What must be checked before uploading a customer list to a platform?
Meta's Customer List Custom Audiences Terms describe hashing, advertiser permissions and specified UK GDPR roles, but these are supplier contract terms, not legal clearance. Verify data origin, transparency, objections and suppression before upload, along with sharing authority, platform role, transfer route and deletion.
In this guide
- Checking a paid social advert in England before it goes liveReview paid social advertising in England with separate checks for recognition, evidence, consumer law, restricted products and accessibility.
- Rights requests and incidents in a paid social campaign: who actsHandle data protection rights requests and incidents in a paid social campaign: which party acts, what to preserve, and what to pass on to the others.
- Ten contract areas to check for paid social account ownership and evidenceReview ten contract areas for paid social agency work, from account ownership and billing to data roles, conflicts, platform access and exit continuity.
- How to build a paid social disclosure policy with a relationship registerBuild an England paid social disclosure policy with a relationship register, accessible labels, approval evidence, monitoring and correction routes.
