Rules and ethics
Part of PPC agencies rules and ethics: a compliance guide for England
Five data sources behind PPC agencies UK regulations
Five data sources behind PPC agencies UK regulations: ICO lawful basis guidance, CMA consumer guidance, EU online advertising policy, PECR 2003 and the CAP Code.
What to take away
- ICO lawful basis guidance decides consent or legitimate interest for paid search targeting.
- CMA consumer protection guidance governs ad claims, not just landing pages.
- PECR 2003 sets cookie and tracking consent rules for remarketing.
- The CAP Code covers paid search ad copy and is enforced by the ASA.
- EU online advertising policy applies to campaigns targeting member states.
Cite the regulator's page, not a webinar slide
Agencies often cite a webinar slide instead of the regulator's page. Point to the primary document when a client asks why a consent banner was set a certain way, not a secondary explainer.
Primary Source vs Secondary Explainer
Primary source
- Authority
- Regulator's own page
- Use case
- Client consent questions
- Risk
- Defensible position
Secondary explainer
- Authority
- Webinar slide
- Use case
- Background reading
- Risk
- Over- or under-compliance
Five sources do most of the work for paid search compliance in England and the wider UK. Each has a specific job. Get the mapping wrong and you will over-comply in one area while missing a rule elsewhere.
The PPC agencies: UK rules and compliance guide for 2027 sets out the full framework.
Source one: ICO lawful basis guidance
The ICO guidance on choosing a lawful basis for direct marketing is the starting point for any paid search campaign that collects or reuses personal data. It explains how consent and legitimate interest differ in practice.
Does This Element Need a Lawful Basis?
Does the element collect or reuse personal data?
Document lawful basis and balancing test
Platform handles data, no basis needed
Paid search sits in an awkward spot. Search ads themselves rarely process personal data beyond what the platform handles. But remarketing lists, customer match and lead forms do. That is where the lawful basis question bites.
Read it alongside platform terms. Where they conflict, the regulator's position wins.
What agencies get wrong here
Many teams assume legitimate interest covers everything short of email. The ICO expects a documented balancing test, not a formality.
How to apply it
Map each element. Record the basis and reasoning. Review when targeting changes.
Source two: CMA consumer protection guidance
Ad copy is a consumer protection issue, not just an advertising standards one. The CMA consumer protection guidance for businesses covers unfair commercial practices that apply to paid search claims.
This matters for agencies writing headlines, sitelinks and descriptions. A claim about speed, price or availability must be substantiated. The CMA's position is that misleading omissions count alongside misleading statements.
A compliant sitelink reads 'Delivery in 2 to 3 working days, UK mainland only.' A non-compliant headline reads 'Cheapest prices guaranteed' if the agency holds no evidence and omits exclusions.
If a client insists on a claim the agency cannot support, document the objection. That record matters if a complaint arrives.
The PPC agencies commercial contracts in England piece explains typical clauses.
Source three: EU online advertising policy
Campaigns targeting audiences in EU member states sit under EU policy as well as UK rules. The EU policies on online advertising page sets out the Commission's position on transparency and targeting.
A single campaign can face two regimes. A user in Dublin and a user in Manchester may need different consent handling and disclosure.
Agencies running cross-border accounts should keep a simple matrix: market, regime, consent standard, disclosure requirement. Update it when either regime changes.
Source four: PECR 2003
The Privacy and Electronic Communications Regulations 2003, usually called PECR, sit alongside UK GDPR. They cover cookies, similar tracking technologies and electronic marketing.
The full title is the Privacy and Electronic Communications (EC Directive) Regulations 2003. The ICO's Guide to PECR sets out the cookie and marketing rules.
Under PECR, the ICO can impose a monetary penalty of up to 500,000 pounds. Under UK GDPR, the maximum is 17.5 million pounds or 4 per cent of annual worldwide turnover, whichever is higher. PECR regulation 6 covers cookies and similar tracking. PECR regulation 22 covers electronic marketing by email or SMS.
For PPC agencies, PECR decides whether you can drop a remarketing tag or use a customer match list without fresh consent. It also covers email and SMS follow-ups from lead forms. Read the ICO's PECR guidance before you build the tracking plan.
Source five: CAP Code
The UK Code of Non-broadcast Advertising and Direct & Promotional Marketing, known as the CAP Code, is written by the Committee of Advertising Practice and sets UK rules for non-broadcast ads, including paid search. The Advertising Standards Authority enforces it.
The code requires ads to be legal, decent, honest and truthful. It also has specific rules on misleading claims, prices and availability. CAP Code rule 3.1 covers misleading claims, rule 3.7 requires documentary evidence for objective claims, and rule 3.17 covers price statements. ASA rulings are published and can lead to ad takedowns.
Five-step source file checklist
- List every campaign element that processes personal data.
- Assign ICO lawful basis guidance to each element and record the reasoning.
- Check cookies and tracking against PECR before launch.
- Review ad copy against CMA guidance and the CAP Code.
- Add EU online advertising policy for member states, then set a review date.
This sequence is deliberately short. The value is in the written record, not the checklist itself.
Common questions
Do these rules apply across the whole UK?
Data protection, consumer protection and privacy rules cited here apply UK-wide. Advertising codes are administered separately in some respects, and Scotland, Wales and Northern Ireland share the same CMA and ICO remit for the guidance above.
Is ICO guidance legally binding?
It is regulatory guidance rather than statute, but the ICO expects organisations to follow it and can act where they do not. Treat it as the practical standard.
Who should own the source file?
Usually the agency's compliance lead, with client sign-off on claims. Small agencies often assign it to a senior account manager.
Does this replace legal advice?
No. This is general guidance only, and individual cases need a qualified adviser.
