Rules and ethics
What ASA rulings on programmatic ads teach UK advertisers: Play'n GO and Enigmaa under the CAP Code
Two ASA rulings read for programmatic advertisers: age targeting under CAP Code section 16, advertorial labels under rules 2.1 and 2.4, and PECR consent.
What to take away
- A programmatic platform does not move responsibility for an ad: the ASA ruled on the advertiser's ads, not the platform's settings.
- Self-declared age and browsing-based targeting were not reliable enough to keep under-18s out of a gambling audience.
- An advertorial must be obviously identifiable as marketing, and "promoted by" was not enough in the Enigmaa case.
- Targeting that relies on cookies needs consent under PECR, so the data route is a separate check.
- Build the lessons into briefs, ad ops checks and partner due diligence before a campaign goes live.
Why rulings matter more than rules alone
The CAP Code is the rule book for non-broadcast advertising, and it must be followed by all advertisers, agencies and media. A ruling shows how those rules were applied to real creative, real targeting and a real placement.
Programmatic buying adds a layer between advertiser and audience. The usual route is real-time bidding, which the UK government's online targeting review describes as a commonly used programmatic approach. Two rulings show where responsibility stays with the advertiser.
Ruling one: banner ads beside children's email inboxes
In the ASA ruling on Play'n GO, upheld on 16 July 2025, three casino-content banner ads were seen beside email inboxes of children. Cartoon imagery included an Easter bunny dressed as a superhero, a robot DJ and anime-style princesses.
The ads ran through a programmatic platform, AdRoll. It was argued that bidding settings kept the ads to sites that accepted gambling ads, and that a website age check was a safeguard. The ads still breached CAP Code rules 16.1 and 16.3.12 (Gambling).
The reasoning is the useful part. The ASA considered that targeting built on self-declared age, retargeting from that data and prospecting from browsing behaviour was not reliable enough to keep under-18s out of the audience. The ads must not appear again in their current form.
For a programmatic team, three points follow. Creative appeal to young people matters even for an age-restricted product. Platform opt-ins do not replace reliable age exclusion. A shared device can show a retargeted ad to a child, so the risk sits in the design, not just the settings.
Ruling two: advertorials on news sites
The Enigmaa advertorials ruling covered four CBD oil advertorials seen on online news outlets. All five issues investigated were upheld, including the finding that it was not clear the advertorials were marketing communications.
Two rules explain the outcome. Marketing communications must be obviously identifiable as such (rule 2.1). Marketers and publishers must make clear that advertorials are marketing communications, for example by heading them "advertisement feature" (rule 2.4).
The ASA also found that the advertorials falsely implied an independent review of the products. A label such as "promoted by" did not cure that. For native programmatic units the lesson is direct: the label must be seen before the click, and the copy must not pose as editorial.
The data route is a separate check
Targeting rests on personal data, so the creative review is not enough. Where targeting relies on the use of cookies and similar technologies, PECR requires that people consent. Regulation 6 bars storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user.
The Play'n GO case shows both layers at work. There, tracking and retargeting were said to happen only with consent, yet the ruling still turned on age and appeal. Consent and content rules each need their own record. The data protection page and the guide to GDPR consent cover the consent side.
Put the rulings into a pre-launch check
| Lesson | Source | Check before launch |
|---|---|---|
| Age-restricted product needs reliable exclusion | Play'n GO ruling | Is under-18 exclusion based on more than self-declaration or browsing signals? |
| Appeal to young people | Play'n GO ruling | Does the creative use cartoon, superhero or princess imagery? |
| Advertorial identity | Enigmaa ruling | Is it labelled as an advertisement feature, and does it avoid posing as a review? |
| Cookie-based targeting | PECR regulation 6 | Is there a consent record for each tracking route? |
| Placement context | Brief and verification | Are exclusion lists and brand safety tools active? |
Add the table to the quality checklist used by ad ops, with a named owner for each row. Repeat the check for every new creative combination, because dynamic creative can produce versions nobody reviewed.
Brief agencies and partners with the lessons
Compliance starts in the brief. State which regimes apply to the product, require the evidence for each objective claim, and name the person who signs off creative. That person should not be the one who built the ad.
The commercial contracts with partners should say who holds the targeting and age-exclusion settings, how a complaint is handled and who can pause a live campaign. The rules and compliance guide sets out the wider regimes.
Keep records. Briefs, approvals, targeting settings and monitoring logs show what reasonable steps were taken if the ASA asks. Read new rulings as they appear, because each one adds a worked example to the code.
Before you act
- Check whether the product carries age restrictions and how under-18s are excluded.
- Review creative for imagery likely to appeal strongly to young people.
- Label every advertorial or native unit as marketing, and avoid posing as an independent review.
- Keep a consent record for every cookie-based targeting route.
- Name the owner who signs off each creative variation.
- Store briefs, approvals and targeting settings for each campaign.
Common questions
Does using a programmatic platform shift responsibility for an ad?
No. In the Play'n GO ruling the ads were run through a programmatic platform and the ASA still found them irresponsible and in breach of the code. Platform settings are one control, not a defence.
What makes an advertorial acceptable under the CAP Code?
It must be obviously identifiable as a marketing communication. Headings such as "advertisement feature" are the example the code gives. Copy must also avoid implying an independent review when none took place.
Does programmatic targeting need consent?
Where targeting relies on cookies or similar technologies, PECR requires consent. Personal data used for targeting also needs a lawful basis. Both checks sit alongside the CAP Code review.
