Rules and ethics
Part of AI marketing tools: UK rules, ethics and safeguards
A checklist of UK regulations to verify before running a campaign using AI marketing tools
A named checklist of UK rules for AI marketing campaigns, covering UK GDPR, PECR, CAP Code, consumer law, CMA powers and ICO audit points to check.
What to take away
- Use this checklist before launchUK GDPR, PECR, CAP Code, Consumer Protection from Unfair Trading Regulations 2008 and the Digital Markets, Competition and Consumers Act 2024.
- Responsibility stays with the brand that publishes an ad, not the vendor whose model drafted it.
- Keep a named approver, a supplier agreement and a short audit trail.
- The rules are UK-wide. Court routes and some consumer remedies differ in Scotland and Northern Ireland.
- This is general guidance. Get a qualified adviser to review your campaign.
Match the activity to the regulator
Ask what your campaign does: writes copy, selects an audience, sets a price or recommends a product. The CAP Code covers ad claims; UK GDPR and PECR cover personal data and electronic marketing.
Match activity to regulator
What does the campaign do?
Ad claims -> CAP Code
Personal data -> UK GDPR
The CMA covers consumer protection and competition. The UK rules and compliance guide for 2027 walks through the full set of duties, helping if more than one regulator applies.
Checklist: UK rules to verify before launch
1. UK GDPR and the Data Protection Act 2018
Check each purpose's lawful basis: consent, contract, legitimate interests or another condition, and for profiling, scoring or large-scale monitoring run a data protection impact assessment. Check Article 22 rights if the tool makes automated decisions about people.
UK rules pre-launch checklist
- UK GDPRlawful basis and DPIA
- Article 22automated decisions
- PECRconsent for email and SMS
- PECRcookie consent before tracking
- CAP Codeaccurate and substantiated claims
- Record consent source, date, purpose
The ICO can fine up to £17.5 million or 4% of global turnover, whichever is higher. Its audits and overview reports list recurring marketing failures, including unclear lawful bases and retention that outlives its purpose.
2. PECR 2003
Check consent for email and SMS marketing. The soft opt-in only covers existing customers and similar products. Check cookie consent before any tracking script runs. The ICO enforces PECR and can fine up to £500,000. For AI tools that scrape contacts or enrich lists, PECR and UK GDPR both apply. Keep a record of consent source, date and purpose.
3. CAP Code and ASA rules
Check claims are accurate, substantiated and not misleading; the CAP Code covers non-broadcast ads, including social, search and influencer content.
The ASA publishes rulings, can require ads to be withdrawn, and may refer persistent offenders to Trading Standards or Ofcom. Use the ASA's AdviceOnline library for marketers to check specific claim types before publishing. Keep evidence for every performance figure, comparison or health claim.
4. Consumer Protection from Unfair Trading Regulations 2008
Check for misleading actions, misleading omissions and aggressive practices. These rules apply across Great Britain. Northern Ireland has equivalent regulations. The CMA and Trading Standards can enforce them. If an AI tool writes a price claim or comparison, keep the evidence and approval record. The regulations also cover bait advertising and fake limited-time offers.
5. Digital Markets, Competition and Consumers Act 2024
Check drip pricing, fake reviews and unfair commercial practices. The CMA has direct enforcement powers for many consumer law breaches under this Act, and can fine up to 10% of global turnover.
If your tool changes prices, ranks offers or personalises deals, document the logic and the override process. The Act also gives the CMA powers over firms with strategic market status. Its work on digital markets and consumer protection explains the remit.
6. Equality Act 2010
Check audience targeting and profiling do not discriminate by protected characteristics. The Act protects nine, including age, sex, race and disability. It applies in Great Britain; Northern Ireland has separate equality law.
A tool that excludes or skews audiences can create liability even if unintended. Record how you test for bias and who reviews the results.
Fix supplier terms before launch
Model providers change terms, discontinue features and shift liability in ways your campaign inherits. Our article on commercial contracts for AI marketing tools in England sets out what to negotiate on data processing, indemnities and termination. That matters before you build a workflow you cannot move.
Terms worth knowing
- CAP Codethe advertising rules the ASA enforces for non-broadcast ads.
- Substantiationthe evidence you hold for a claim before publishing it.
- Lawful basisthe UK GDPR condition that allows you to process personal data.
- PECRrules on electronic marketing, cookies and similar technologies.
Common questions
Does the vendor or our brand answer for a misleading ad?
The brand that publishes the ad. A platform or model provider may face separate action, but the CAP Code places responsibility on the advertiser.
Do the rules differ in Scotland and Northern Ireland?
The advertising and data regimes are UK-wide. Court routes and some consumer remedies differ, so take local advice where enforcement is likely.
What records should we keep?
The brief, the source data, the evidence for each claim, the approval decision and the date. An audit trail of that kind answers most regulator questions.
