Rules and ethics
Part of Before you launch, review the programmatic advertising rules and ethics
What should a programmatic advertising disclosure policy contain?
A practical guide to writing a programmatic advertising disclosure policy, covering UK rules, buyer questions and a decision table for what to disclose and when.
What to take away
What to take away
- A programmatic advertising disclosure policy should be a written, dated document that sets out what you tell buyers, platforms and regulators about your programmatic activity, and how you evidence it.
- It must reference two regimes by namethe UK GDPR and the Data Protection Act 2018, which govern the personal data you process, and the Privacy and Electronic Communications Regulations (PECR), which govern cookies, device access and electronic marketing.
- The ICO's guidance on organisations using marketing services of data brokers is a good starting point for audience data sourcing, because it explains what you must check before buying third-party audience data. The ICO's guidance on transparency and on legitimate interests decides how you word the disclosure itself.
- The IAB Europe Transparency and Consent Framework and the IAB Tech Lab standards — ads.txt, sellers.json and the SupplyChain Object — are the disclosure tools buyers ask about, so say which of them you use.
- The CMA's Online Platforms and Digital Advertising market study (2020), and the Digital Markets, Competition and Consumers Act 2024 that put the CMA's Digital Markets Unit on a statutory footing, are the competition context for how your supply chain shares data and how you avoid misleading buyers.
- The Digital Economy Act 2017 is often cited alongside advertising and age verification, but it does not set programmatic advertising obligations. Reference it only where a specific provision actually applies to your content.
- This is general guidance only. Individual cases need a qualified adviser.
What a disclosure policy must cover
A programmatic advertising disclosure policy is the document that explains what you reveal, to whom, and on what trigger. It is not a privacy notice and it is not a contract. It sits alongside both.
Core policy sections
- Audience data sourcingcategories, suppliers, lawful basis
- Measurement and reportingdata collected, retention, client sharing
- Commercial relationshipsmargins, rebates, SSP fees
- Leave outlegal definitions, privacy notice repeats, unevidenced claims
The core sections
Two regimes sit behind every section below. The UK GDPR and the Data Protection Act 2018 govern the personal data you process, and the ICO's guidance on transparency and on legitimate interests shapes how you word the disclosure. The Privacy and Electronic Communications Regulations (PECR) govern cookies, device access and electronic marketing, which is where most programmatic consent questions start. State which entity is the controller and where it sits on the ICO's data protection fee register.
Start with audience data sourcing. State which categories of data you buy — demographic, behavioural, location, modelled or lookalike segments — which brokers or platforms supply them, and the lawful basis you rely on under Article 6 of the UK GDPR. Where that basis is legitimate interests, say how the balancing test was carried out, because the ICO's guidance on legitimate interests expects a documented assessment rather than an assertion. The ICO's page on organisations using marketing services of data brokers sets out what you need to know before you use those services, and your policy should mirror that checklist.
Next, cover measurement and reporting. Explain what data you collect from campaigns, how long you keep it — give the retention period for each data set rather than a general promise — what you delete and when, and what you share with clients. If you use platform-reported metrics, say so and say what you do not verify independently, and name any third-party verification you do use.
Then cover commercial relationships. Say which buying model you operate — disclosed or undisclosed principal-based buying, a trading desk, or agency acting as agent — and the categories of supply-side platform, DSP, ad server and data broker you work with. If you earn a margin, rebate, technology fee or take rate, say it in the policy and say whether the client sees it in advance. Buyers ask this question often, and a written answer saves time later.
Supply chain and disclosure standards
Disclose the supply chain itself. Say whether your sites and apps carry an ads.txt file, whether your supply partners publish sellers.json, and whether SupplyChain Object data travels with your bid requests. These IAB Tech Lab standards are how buyers check who is really selling an impression, so a policy that names them answers the first question a trading desk will ask.
Say whether consent signals travel with the bid request through the IAB Europe Transparency and Consent Framework. List your sub-processors, and where data is transferred outside the UK, name the safeguard you rely on — the ICO's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.
What to leave out
Do not put legal definitions in the policy if they are already in your contracts. Do not repeat your privacy notice word for word. Do not include claims about compliance that you cannot evidence. A short policy that matches your actual practice is stronger than a long one that does not.
How to write and maintain it
Drafting steps
- List every disclosure triggernew client, new data source, new platform, new market.
- For each trigger, write one sentence saying what you disclose and to whom.
- Add an evidence linewhere the record lives and who owns it.
- Check each section against UK GDPR and the Data Protection Act 2018 — lawful basis, transparency wording, retention and transfers — and against PECR for cookies, device access and electronic marketing.
- Check the competition angle. The CMA's Online Platforms and Digital Advertising market study (2020) and the Digital Markets, Competition and Consumers Act 2024 set the market context, and your policy should not contradict the transparency they expect.
- Set a review date, at least annually.
For the wider set of rules that feed into the policy — PECR, UK GDPR and the IAB standards — the site's programmatic advertising UK rules and compliance guide gathers them in one place.
Maintenance and version control
Keep a version number and a date on every page. When a supplier changes its data terms, update the policy within 30 days. When a client asks a question that is not covered, add the answer and note the date.
If you operate mainly in England, the site's programmatic advertising UK regulations in England explains which rules apply in England specifically, which matters if your team treats England and the rest of the UK as one market.
Decision table: what to disclose
Choose
- You buy third-party audience segments
- Disclose the broker category and the lawful basis in writing
- You earn a margin on media
- State the margin basis in the policy and the contract
- You use platform-reported metrics
- Say which metrics are platform-reported and unverified
- A client asks about data retention
- Give the retention period and the deletion process
- You enter a new market
- Review the policy before the first campaign runs
Avoid
- You buy third-party audience segments
- Naming a broker without confirming its current terms
- You earn a margin on media
- Describing all fees as "technology costs"
- You use platform-reported metrics
- Presenting platform numbers as audited results
- A client asks about data retention
- Saying "as long as necessary" without a period
- You enter a new market
- Copying a policy from another market
Common questions
Does a disclosure policy need to be a separate document?
No, but it must be findable and dated. A section inside your compliance manual is fine if it has its own heading, owner and review date. What matters is that a buyer or regulator can see what you disclose without reading the whole manual.
How often should the policy be reviewed?
At least once a year, and whenever a supplier, platform or data source changes. Set a calendar reminder for the review and record who signed it off. If nothing changes, note that too.
Does the policy need to name every platform you use?
Not necessarily. Naming categories of platform and the criteria you apply is usually enough, provided you can produce the specific list on request. Some contracts require named platforms, so check before you publish a category-only version.
What happens if a client asks a question the policy does not answer?
Answer in writing within your normal response time, then add the answer to the policy at the next review. Repeated questions are a signal that the policy is missing a section, not that the client is being difficult.
