Who approves remarketing lists and ad copy at your PPC agency?

What to take away

What an England disclosure policy has to cover

A disclosure policy answers one question: who may say what, to whom, and on what evidence? It matters most when an agency runs remarketing, uses customer match lists or writes claims about price and performance.

Under the UK GDPR and the Privacy and Electronic Communications Regulations, the advertiser is usually the controller and the agency the processor. The UK rules and compliance guide puts that split in the wider UK regulatory picture.

Naming the controller and the lawful basis

List every live campaign in one table. For each, record the lawful basis for any personal data used, whether consent or legitimate interests, and who collected it. Note where the list is stored and when it should be deleted. The ICO's direct marketing guidance sets out how consent and legitimate interests apply to paid search and remarketing.

Sign-off before an ad goes live

Give every ad a named approver on the advertiser side, not just the agency account manager. That person checks claims against evidence: price, availability, comparison language. Keep the approval in the account change history so it can be produced later.

Where the rules come from

Three sources do most of the work. Data protection law covers the lists and tracking behind a campaign, while the CAP Code covers the words in the ad. Google then decides whether it runs at all.

The CAP Code and ASA rulings

The Committee of Advertising Practice writes the Code and the Advertising Standards Authority enforces it. The ASA's published rulings show how the rules are applied in practice, including in search ads, and give case studies a policy can use as examples.

Google's own advertising policies

Google applies its own rules on top, covering misrepresentation, restricted content and destination requirements. Quality Score depends partly on relevance and landing page experience, so policy breaches can raise costs as well as invite complaints. Google's Quality Score guidance explains how those components are assessed.

Running the policy as a process

A policy that sits in a shared drive and is never opened creates false confidence. Build three habits.

Monthly checks and a decision log

Review new campaigns, audiences and ad copy each month. Record decisions in a short log: date, campaign, decision, approver. When a regulator or platform asks questions, the log is the evidence.

Contract terms that match the policy

Disclosure duties, audit rights and data-processing terms belong in the agency contract. If contract and policy disagree, the contract usually wins in a dispute. The commercial contracts guide explains what to check before signing, including termination and data return clauses.

Glossary

This is general guidance, not legal advice; individual cases need a qualified adviser.

Common questions

Who is responsible if an agency breaks the rules?

The advertiser is normally the data controller and the platform account holder, so enforcement lands there first. The agency may be liable under the contract.

Does a small England advertiser need a written policy?

Yes, if it runs remarketing, uses customer lists or makes performance claims. The document can run to a few pages; what matters is that approvals and lawful bases are recorded.

How often should the policy be reviewed?

At least once a year, and sooner if the agency changes sub-processors or platforms. A dated review note is enough.

Do ASA rulings apply to search ads?

Yes. The CAP Code covers paid search copy. Published rulings are a practical way to test whether your claims would survive scrutiny.