
Rules and ethics
Part of PPC agencies rules and ethics: a compliance guide for England
PPC agencies advertising rules in England explained
A checklist for PPC agencies advertising rules in England, covering the CAP Code, consumer law, data protection and platform ad policies in paid search.
What to take away
PPC agencies advertising rules in England combine the UK Advertising Codes, consumer protection law, data protection legislation and each platform's ad policies.
- The Advertising Standards Authority (ASA) enforces the CAP Code for most paid search and display ads seen by UK consumers.
- Data protection rules cover audience targeting, remarketing lists and conversion tracking, under the Data Protection Act 2018 and UK GDPR, with the ICO as the regulator.
- Cookie and tracking-tag consent is governed by the Privacy and Electronic Communications Regulations 2003 (PECR).
- YouTube and Google Ads add their own ad policies, and an agency can lose account access for breaching them.
- Consumer protection law bans misleading pricing and hidden fees, and the Digital Markets, Competition and Consumers Act 2024 has largely replaced the Consumer Protection from Unfair Trading Regulations 2008.
- Contract terms and liability sit alongside the ad rules, and the commercial contracts guide sets out what to check before signing.
Which rules apply to paid search ads in England?
The CAP Code is the UK rulebook for non-broadcast ads, and the ASA applies it to paid search copy, sitelinks and landing pages. It requires ads to be legal, decent, honest and truthful, and bans misleading claims on price, availability and performance.
The rules an agency will cite most often sit in Section 3, on misleading advertising: rule 3.1 (an ad must not materially mislead), rule 3.3 (material information must not be omitted or hidden) and rule 3.7 (objective claims must be backed by documentary evidence held before publication). Section 3 also carries the rules on price statements and on comparisons with identifiable competitors.
The CAP Code applies across the UK, so an agency working in England follows the same ad copy rules as one in Scotland or Wales. The England-specific part is enforcement: consumer protection law is enforced by local authority Trading Standards services, with the Competition and Markets Authority (CMA) as the national enforcer. Business-to-business ad claims are covered by the Business Protection from Misleading Marketing Regulations 2008, which sit alongside the CAP Code.
CAP Code ad copy checks
- Ad copy legal, decent, honest, truthful
- No misleading price claims
- No misleading availability claims
- No misleading performance claims
- Every RSA variation defensible
- Dated pricing evidence kept
Every responsive search ad variation and callout must be defensible; the ASA can act on a single complaint. Check ad copy against the misleading claims section before launch.
Ad copy that quotes a price needs evidence behind it. A reference price must be genuine and recent, and any stated saving must be real. Keep dated records of your own pricing and of any competitor price you compare against.
What does data protection law require for PPC targeting?
Any agency running remarketing, customer match or conversion tracking is processing personal data, and the Data Protection Act 2018 sets the framework alongside UK GDPR. The lawful basis for most paid search tracking is consent or legitimate interests, and it must be documented.
PPC data protection setup
- Identify personal data processing
- Document lawful basis
- Update privacy notice for advertising
- Collect cookie consent on site
- Configure consent signals in Google Ads
- Agree in writing who owns setup
Audience lists built from CRM data need a valid basis and a privacy notice that mentions advertising. The ICO's guidance on AI and data protection matters for automated bidding and audience expansion, which profile individuals.
Cookie consent has to be collected on the site or landing page, not inside the ad platform. In the UK that consent is governed by the Privacy and Electronic Communications Regulations 2003 (PECR), which the ICO enforces and which requires a clear, informed opt-in before non-essential cookies or tracking tags run; UK GDPR then governs what happens to the data. The agency usually configures consent signals in Google Ads so tags fire only after a visitor agrees. Agree in writing which side owns that setup.
How do platform ad policies differ from the law?
YouTube and other platforms enforce their own ad policies, which can be stricter than UK law. Google Ads sets them out in named policy chapters, including Misrepresentation (unclear relevance, misleading claims, unacceptable business practices), Restricted content (adult content, alcohol, gambling, healthcare and medicines, financial services) and Editorial and professional requirements. YouTube adds its own prohibited categories, such as illegal products or hateful content, and restricted categories, such as adult or shocking content, that limit where an ad can run.
An agency buying video through Google Ads must check both the platform policy and the CAP Code. An ad compliant under one can fail the other. Enforcement is automated, so accounts can be suspended before a regulator is involved.
Suspension is the commercial risk. A single account ban can stop delivery across every campaign attached to it, so keep a second admin contact and a backup of your creative.
How do the main rule sources compare?
Who enforces it
- CAP Code
- ASA
- Consumer Protection from Unfair Trading Regulations 2008
- CMA and Trading Standards
- Data Protection Act 2018 and UK GDPR
- ICO
- Platform ad policies
- Google, Microsoft, Meta and others
- Contract law
- Courts
Main impact on PPC
- CAP Code
- Ad copy, claims, pricing, landing pages
- Consumer Protection from Unfair Trading Regulations 2008
- Misleading omissions and aggressive practices
- Data Protection Act 2018 and UK GDPR
- Audience data, tracking, profiling, consent
- Platform ad policies
- Ad approval, account access, restricted categories
- Contract law
- Liability, indemnities, termination
The UK rules and compliance guide covers the wider framework for agencies, including the extra sector rules that apply to finance and health advertising.
A practical compliance checklist for agencies
- Check every ad variation against CAP Code rules 3.1 and 3.3 on misleading claims and omitted material information before launch.
- Keep a written record of the lawful basis for each tracking and remarketing activity, and confirm PECR consent is collected before any tag fires.
- Review platform ad policies monthly, including the Google Ads Misrepresentation and Restricted content chapters, because restricted categories change.
- Make sure landing pages match the ad claim on price, availability and terms.
- Name one person responsible for data protection queries from clients.
- Check the client's regulatory statusfinancial promotions must follow the FCA's COBS 4 rules, and a promotion from an unauthorised firm needs approval by an authorised person under section 21 of the Financial Services and Markets Act 2000.
- Remember that consumer law in England is enforced by local authority Trading Standards services, with the CMA as the national enforcer.
Common questions
Do PPC agencies in England need ASA approval before running ads?
No. The ASA runs a complaint-led system for most paid search ads, so no pre-clearance is needed. Financial promotions are the main exception: investment ads must follow the FCA's COBS 4 rules, and promotions issued by an unauthorised firm need approval by an authorised person under section 21 of the Financial Services and Markets Act 2000.
Does the CAP Code apply to ads shown only in Scotland or Wales?
The CAP Code applies across the UK, but some consumer law and sector rules differ in Scotland, Wales and Northern Ireland. Where a rule differs, state the jurisdiction and check devolved guidance.
Can a PPC agency be liable for a client's misleading ad?
Liability depends on the contract and the agency's role. The ASA usually names the advertiser. Consumer protection enforcement sits with the Competition and Markets Authority and local authority Trading Standards services, and the unfair commercial practices rules they apply now come largely from the Digital Markets, Competition and Consumers Act 2024, which replaced most of the Consumer Protection from Unfair Trading Regulations 2008.
What happens if a campaign breaches platform ad policy?
The platform can reject the ad, limit delivery or suspend the account. Repeated breaches can lead to a permanent ban, which is a commercial risk for both agency and client.
This article is general guidance only and is not legal advice. Individual cases need a qualified adviser.



