Rules and ethics
Part of Before you launch, review the programmatic advertising rules and ethics
Framework contract or insertion order for programmatic advertising commercial contracts
A practical comparison of framework contracts and insertion orders in programmatic advertising commercial contracts, with England rules, ICO and ASA guidance.
What to take away
What to take away
- Picture a Bristol agency booking display inventory for a client. It signs a master framework contract plus a short insertion order for each campaign. The framework carries liability, data and payment terms. The order carries dates, budget and targeting.
- UK GDPR, the Data Protection Act 2018 and PECR sit behind programmatic data processing, and the ICO's guidance on the use of cookies and similar technologies treats cookie and pixel data as personal data. Consent and lawful basis clauses therefore belong in the framework, not the order.
- The ASA's AdviceOnline library holds the advertising rules that bind the creative, and the CAP Code applies across the UK, so terms should require creative sign-off before trafficking.
- Named technical standards keep the buy measurableIAB Tech Lab's OpenRTB carries the bid request, the W3C's Intersection Observer and User-Agent Client Hints carry browser signals, and IAB Europe's Transparency and Consent Framework carries the consent string. Append the required versions to the framework.
- General guidance only. Individual cases need a qualified adviser, particularly on data protection or regulated products.
What each document does
A framework contract is the standing agreement. It sets payment terms, liability caps, data processing roles, termination rights and governing law. It should also name the regulator guidance the parties follow. The England regulations overview explains where the ICO, ASA and Ofcom sit in the chain.
Framework vs Insertion Order
Framework contract
- Purpose
- Standing agreement
- Payment terms
- Set once
- Liability caps
- Set once
- Data roles
- Set once
- Dates & budgets
- Not repeated
- Audiences
- Not repeated
- Conflict rule
- Says which wins
Insertion order
- Purpose
- Campaign instruction
- Payment terms
- Not repeated
- Liability caps
- Not repeated
- Data roles
- Not repeated
- Dates & budgets
- Per campaign
- Audiences
- Per campaign
- Conflict rule
- Subject to framework
An insertion order is the campaign instruction. It names the advertiser, dates, budget, inventory sources and measurement rules. Where an order conflicts with the framework, the framework should say which wins. Most agency disputes start here rather than in the creative.
Payment terms, liability caps and data roles rarely change campaign by campaign, so they belong in the master document. Dates, budgets and audiences change constantly, so they belong in the order.
Data protection clauses to settle first
Programmatic buying moves personal data between advertiser, agency, demand-side platform and publishers. UK GDPR and the Data Protection Act 2018 require a lawful basis, and PECR require consent before a cookie or pixel is stored or read. The ICO also expects a clear controller or processor role before anything fires. Put that wording in the framework and reference it in every order.
Data protection clauses to settle
- Lawful basis and controller or processor role
- Consent string passed and bidding stopped if absent
- Advertiser instructions and approved sub-processors
- Transfer mechanism and safeguards for non-UK platforms
Consent signals sit inside that flow. A framework should require the buyer to pass a consent string built to IAB Europe's Transparency and Consent Framework and to stop bidding where consent is absent.
Where the agency acts as processor, the framework should record the advertiser's instructions and any approved sub-processors. If personal data crosses to a platform outside the UK, record the transfer mechanism — the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses — and any safeguards agreed.
Creative and disclosure terms
The CAP Code applies to ads served programmatically, including display and native formats. An order should require advertiser approval of creative before trafficking, and should flag sector rules such as financial promotions or alcohol.
Regulated sectors add their own approval steps, so the order should name who signs off a financial promotion before it runs.
Disclosure of paid placement matters as well. If an ad resembles editorial, the contract should name who labels it. That is an advertising rule, not a technical preference.
Technical specifications and appendices
Ad calls, viewability measurement and consent signalling rely on named standards: IAB Tech Lab's OpenRTB for bid requests, W3C specifications such as Intersection Observer and User-Agent Client Hints for the browser signals, and IAB Europe's Transparency and Consent Framework for consent. Append required formats and timeout rules to the framework instead of leaving them in email threads.
Ask the demand-side platform and the publisher which formats they accept, then record the answer in the appendix.
For example, a team paying £400 a month for a small programmatic test still needs a data processing schedule. The volume of personal data does not change the obligation.
Which model suits which buyer
Use a framework plus orders when campaigns repeat, liability cover matters and one set of data terms should govern everything. Use a single order for a one-off test with a known publisher where no personal data leaves the advertiser's systems. The UK rules and compliance guide covers the wider obligations behind either choice.
Terms to check before signing
- Payment terms and who bears platform fees.
- Liability cap and indemnities for data breaches.
- Termination rights if a publisher leaves a supply chain.
- Audit rights over measurement and logs.
- Which transfer safeguard applies, the IDTA or the UK Addendum, and which sub-processors are approved.
- Governing law, usually England and Wales.
Glossary
Glossary
- Framework contractthe master agreement covering all campaigns.
- Insertion orderthe per-campaign instruction.
- DSPdemand-side platform that buys inventory.
- Consent stringthe signal recording a user's choices.
- Controllerthe party deciding why data is processed.
- TCFthe IAB Europe Transparency and Consent Framework, the standard for recording and passing consent signals.
- OpenRTBthe IAB Tech Lab protocol that carries bid requests.
Common questions
Does an insertion order need its own data clause?
No, if the framework sets roles and lawful basis. The order should reference the framework and add campaign detail only. Without a framework, the order must carry the data terms itself.
Which law governs an England agency contract?
Most English agencies choose England and Wales, and that choice belongs in the framework rather than being assumed. Cross-border enforcement may need advice.
Can a framework override a signed order?
Only if it says so. State the order of precedence clearly, otherwise the later document tends to win.
Do small programmatic tests need full contracts?
They need the same data and disclosure terms, scaled down. A short order with a data schedule is usually enough for a single test.
