PPC agencies rules and ethics: a compliance guide for England

What to take away

What is the regulatory split for PPC agencies in England?

Paid search in England is not governed by one rulebook. Three layers apply at once, and each has a different enforcement body.

First, general consumer law: mainly the Consumer Protection from Unfair Trading Regulations 2008 and the Digital Markets, Competition and Consumers Act 2024, which strengthened the CMA's direct enforcement powers.

Second, the advertising codes, written by the Committee of Advertising Practice and enforced by the Advertising Standards Authority.

Third, data protection law, where the Information Commissioner's Office is the regulator.

For an agency, the practical effect is that a single campaign can be checked by three different bodies for three different reasons. A misleading claim is an ASA matter. How you collected the email list behind a customer match audience is an ICO matter. Whether a price comparison was fair may be a CMA matter.

Enforcement normally follows a complaint, so which body acts first depends on what the complaint is about.

England has no distinct advertising statute of its own. The codes and the data rules apply across the UK, although Scotland and Northern Ireland have their own consumer enforcement arrangements in some areas. That matters if a client sells across borders.

Agencies that want a plain-language walk-through of what must appear in client-facing documents should read PPC agencies disclosure policy in England, which sets out the minimum content for a disclosure statement.

Which data protection rules apply to paid search work?

Almost every modern PPC account processes personal data. Conversion tracking, remarketing lists, customer match, call tracking and lead forms all involve identifiers that relate to a person.

The core statute is the Data Protection Act 2018, which sits alongside the UK GDPR and sets out how personal data may be processed for advertising. Agencies are usually processors and clients are controllers, but that split is a contract question, not a default. If an agency decides why data is used, it becomes a controller for that activity.

Consent is the usual lawful basis for advertising cookies and similar technologies under the Privacy and Electronic Communications Regulations. Legitimate interests can work for some analytics, but not for dropping a marketing cookie on a device without consent.

The ICO expects records of processing, a data protection impact assessment for high-risk profiling, and a written processor agreement. Retention is where many accounts go wrong: audiences built in 2023 are often still live in 2026 with no review date attached.

Where the agency sets the purpose for a pixel or a list, it needs its own lawful basis and its own privacy notice.

Agency teams that need the underlying source list for these obligations can use PPC agencies data protection: data and sources, which maps each duty to the statute or regulator page it comes from.

How do platform advertising policies interact with the law?

The platforms are private rule-makers. They can refuse an ad that is perfectly legal, and they can reinstate one that a regulator would query.

Google Ads and Microsoft Advertising set their own editorial and trademark rules. YouTube adds further restrictions on categories such as health, finance and political advertising, all explained in the YouTube ad policy overview. TikTok applies a separate set of restrictions through its Business Resource Centre, including limits on body imagery and weight-loss claims.

Cross-border campaigns add a fourth layer. If an agency runs ads into the EU, the EU online advertising policy pages set out the direction of travel on transparency and targeting that will shape member-state rules.

The practical rule for an agency is simple: satisfy the strictest applicable standard. If TikTok forbids a claim that the CAP code merely discourages, the TikTok rule wins for that placement. Document the reasoning, because a client will ask why a creative was rejected.

Keeping up with changes is a job in itself. The ASA news updates page carries rulings and guidance changes that often become client questions within days.

Agencies that also buy display, video and social should read PPC agencies advertising rules in England, which covers the code sections most often cited in ASA rulings.

What must be disclosed to clients and to the public?

Disclosure runs in two directions: to the client about how the agency works, and to the public about what is an ad.

Client-side disclosure covers fees, media spend handling, rebates and any commercial relationship that could bias a recommendation. If an agency earns a platform rebate, the client should know. If a partner agency is paid to refer work, that should be in writing. The CAP code's rules on recognition of marketing communications apply to the public-facing side.

Public-side disclosure covers paid results, affiliate links, influencer posts and native placements. An ad must be identifiable as an ad. "Ad", "Advert" or "Sponsored" in a visible position is normally enough. Burying it in a hashtag list is not.

There is a grey area around search ads that mimic organic listings. The ASA has treated some of these as misleading when the commercial nature was unclear. The safe approach is to make the paid status obvious in the ad itself rather than relying on the platform label.

A written disclosure is easier to defend than a verbal assurance given in a pitch.

How should agencies handle client money and contracts?

Client media budgets are the largest sums most agencies touch, and the handling rules are stricter than many small agencies assume.

A written agreement should state who owns the ad accounts, who holds the payment method, what happens to data on termination, and how spend is reconciled. If an agency holds client money, it should be able to show the client how that money is protected.

VAT treatment depends on how the service is structured. Management fees and media spend can be treated differently, and the place of supply rules matter for overseas clients. This is general guidance only; individual cases need a qualified adviser.

The CMA has been active on online choice architecture, including drip pricing and urgency claims. An agency running countdown timers or "only 2 left" messages should be able to show the claim was true when it was displayed.

Agency teams planning budgets and staffing around these duties should read PPC agencies: trends and outlook for England in 2027, which links compliance load to expected client demand.

Comparison table: which rule applies to which activity

What are the ethical duties beyond the letter of the rules?

Compliance is a floor, not a ceiling. Several ethical questions in paid search are not settled by any code.

The first is transparency about performance. An agency that reports platform-attributed conversions as if they were incremental sales is not breaking a rule, but it is misleading the client. A media mix or incrementality view is harder to produce and more honest. Incrementality testing is not a legal requirement, but it changes how an agency describes its own results.

Second is bid steering. If an agency owns the tools and the client cannot see the account, the client cannot verify the work. Account ownership should sit with the client unless there is a clear commercial reason otherwise.

The third is avoiding dark patterns in ad copy and landing pages. False scarcity, pre-ticked consent boxes and confusing opt-outs all attract regulatory attention and damage trust.

Fourth is how an agency handles a client's competitors. Comparative advertising is lawful if it is accurate and not disparaging. Bidding on a competitor's brand is usually allowed by platforms, but the resulting ad must not imply a connection that does not exist.

Fifth is staff conduct. An agency that buys media on behalf of a client has access to commercially sensitive data. Using that data for another client is both a contractual breach and, in some cases, a data protection issue.

Agencies wanting the source-by-source basis for these duties can read PPC agencies UK regulations: data and sources, which lists the primary documents behind each obligation.

How should an agency document compliance?

Documentation is what turns a policy into a defence. Regulators and clients both ask for evidence, not intentions.

A workable file for a mid-sized agency contains six documents. These are a processing agreement template, a record of processing activities, a consent log per tracking technology, a creative approval record, a platform rejection log and a client disclosure statement.

The creative approval record is the one most often missing. It should show who approved the claim, what evidence supported it, and when it was last checked. Claims about price, availability and results go stale quickly.

The rejection log matters because it shows the agency acted on platform feedback rather than ignoring it. If the same creative is rejected three times, that is a signal to change the claim, not the wording.

Review dates should be set at the point of creation. An audience built for a campaign in September 2026 should have a review date attached, not an open-ended life.

None of this requires expensive software. A shared folder with consistent naming, plus a calendar reminder, covers most of it. What it requires is that someone owns the process. A one-page index showing where each document sits saves time during a client audit.

Common questions

Do PPC agencies need to be registered with a regulator in England?

No single advertising regulator licenses PPC agencies. Agencies must comply with the CAP code, data protection law and platform policies, and may need to register with the ICO if they process personal data as a controller. There is no general PPC agency licence.

Who is responsible if an ad breaks the rules, the agency or the client?

The advertiser is normally responsible for the ad, and the agency can also be held to account for the claims it creates or approves. Contracts should allocate responsibility clearly, but they cannot override the regulator's view of who published the ad.

Does the Data Protection Act 2018 apply to paid search outside England?

Yes. The Data Protection Act 2018 and the UK GDPR apply across the United Kingdom, including Scotland, Wales and Northern Ireland. The advertising codes are also UK-wide.

How often should an agency review its compliance documents?

At least annually, and whenever a platform changes its policies or a new tracking technology is introduced. Claims about price and availability should be checked more often, ideally before each campaign flight.

This article is general guidance only. Individual cases need a qualified adviser.