Before you launch, review the programmatic advertising rules and ethics

What to take away

The mistake that costs most

Teams treat compliance as a launch-day checklist. They sign an insertion order, switch on a demand-side platform and assume the platform's own certifications cover the campaign.

That assumption breaks in three places. The lawful basis for processing personal data may be wrong or undocumented. The creative may breach the CAP Code even if the targeting is clean. The site list may place the ad next to content the brand would never approve.

Each failure is cheap to prevent and expensive to fix. A regulator or a client audit will ask for the same four things: what data was used, why it was lawful, who approved the creative, and where the ads appeared.

If you cannot answer those questions from written records, the campaign is not compliant in any meaningful sense, whatever the platform dashboard says. Retrofitting documentation after a complaint costs far more than writing it before launch.

The six written checks

Six checks cover the ground before a campaign goes live. Each one needs evidence you can produce on request, not a spoken assurance.

Score each rule at campaign setup and at each quarterly review. A total of 10 to 12 is launch-ready. A total of 7 to 9 needs the amber gaps closed before launch. Any red score blocks the campaign until the gap is closed, whatever the total says.

Record each check with a date, a named owner and a review date. Keep the finished checklist with the campaign file, so a complaint six months later can be answered from evidence.

Data protection basics

Programmatic advertising usually involves personal data. Identifiers, device data and inferred interests all fall within the definition, even when no name is attached.

The UK General Data Protection Regulation sets out the lawful bases, the transparency duties and the rights that apply. The retained EU law version, in force since 1 January 2021, is the text that applies in the UK, and it is the version your privacy notice should reflect.

The Data Protection Act 2018 sets the UK derogations around it, so note the section you rely on.

Consent is the usual basis for behavioural targeting, but it is not the only one. Some contextual and measurement activity can rest on legitimate interests, provided a legitimate interests assessment is completed and recorded.

Cookies and similar identifiers carry their own consent rule. The Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426, require consent before information is stored on or read from a user's device, with narrow exceptions. That is the basis for cookie and identifier consent in England and across the UK.

Automated bidding and lookalike modelling process personal data too, so they fall inside data protection law. The ICO's guidance on AI and data protection explains how to assess fairness, transparency and human review; check the ICO site for the current version. Document what the model uses, what it infers, and how a person can challenge an outcome.

Children's data raises the bar again. The ICO's children's code expects age assurance where a campaign could reach under-18s, plus reduced tracking for that audience. If your targeting could plausibly reach minors, build for it from the start.

Special category data needs more care. Political, health or religious inferences are easy to build accidentally from browsing patterns, and using them for targeting without an explicit condition is a serious breach.

A data protection impact assessment is expected where processing is likely to result in a high risk to individuals. Large-scale behavioural profiling usually meets that threshold. Processors, including demand-side platforms and data management platforms, must have written contracts that meet Article 28 requirements.

Individuals can exercise rights of access, erasure, objection and portability. Your workflow needs a route for each, with a response deadline you can meet. Ignoring a request because it arrived through a platform rather than by email is not a defence.

Data minimisation matters more than teams expect. You should not collect a full profile when a segment will do. Retention periods should be set for each data type and enforced automatically where possible.

Controllers must be able to demonstrate compliance, not just claim it. That means records of processing activities and a written policy that staff can follow.

ICO direct marketing guidance

Direct marketing rules apply to programmatic advertising when an ad is directed at an identifiable individual or their device. The ICO's step-by-step guide to direct marketing for your small business explains consent, soft opt-in and the records you should keep.

The guide is written for smaller organisations, but the principles scale. Consent must be specific, informed and unambiguous. Silence, pre-ticked boxes and bundled terms do not count.

Keep evidence of when and how consent was collected. If a data broker supplies audiences, you need to know what basis the broker relied on and whether that basis transfers to your use.

Withdrawal must be as easy as giving consent. If a user opts out through your preference centre, the suppression needs to reach every platform buying on your behalf, not just the one that collected the request.

The Privacy and Electronic Communications Regulations sit alongside UK GDPR and add rules for cookies and similar technologies. Most programmatic targeting relies on storage or access to information on a user's device, so PECR consent standards are directly relevant.

Soft opt-in can apply where you obtained details in the course of a sale and the marketing relates to similar products. It is a narrow exception, and it does not cover the purchase of third-party audience data.

Consent records need to show what the user was told, when they agreed, and which version of the privacy notice applied. A screenshot of a consent banner is not enough on its own.

Advertising rules and the CAP Code

The CAP Code applies to ads in paid online space, including programmatic display, video and native formats. It is enforced by the Advertising Standards Authority, and it covers misleading claims, substantiation and social responsibility.

The system is co-regulatory. The Committee of Advertising Practice writes the UK Code of Non-broadcast Advertising, Sales Promotion and Direct Marketing, and the ASA polices it independently. Every banner, native ad, video pre-roll or dynamic creative served through an exchange must comply, wherever it appears.

The ASA resource library collects the guidance, rulings and advice notes that marketers need for day-to-day compliance. It is worth bookmarking before a creative review, not after a complaint.

Recent rulings repeat three patterns: misleading claims, targeting failures and disclosure gaps. Misplacement is a fourth. The ASA has found that buying through an exchange does not transfer the advertiser's duty of care over where ads appear.

The ASA has ruled against ads that reached users without proper age filtering, and against native ads that did not disclose their commercial nature.

Common failures are mundane. A price claim without a qualifying condition. A health or finance claim without evidence. A testimonial that does not reflect typical results. Each one can breach the CAP Code regardless of how the ad was targeted.

Programmatic adds a twist: creative variants are often generated at scale, so the advertiser may not see every combination before it runs. Approval workflows need to cover dynamic elements, not just the master asset.

Accessibility sits outside the CAP Code, but it still applies to creative. Ad formats and landing pages should meet the W3C's Web Content Accessibility Guidelines, version 2.2, and the Equality Act 2010 reasonable adjustment duty can apply to online services in England. Build formats that screen readers and keyboard users can operate.

The ASA can require an advertiser to withdraw or amend an ad, and it publishes rulings that name the advertiser. Persistent non-compliance can lead to referral to trading standards. The ASA also issues ad alerts, and the non-compliant online advertisers list names persistent offenders.

Check the list before you sign a partner, and again before each launch. For a wider walkthrough of where advertising rules and platform rules overlap, see the guide to programmatic advertising advertising rules.

Comparative advertising is permitted if it is not misleading and compares like with like. Programmatic campaigns that rotate claims by audience segment need to keep the evidence for each variant.

Influencer and affiliate content that is programmatically distributed still needs a clear ad label. The CAP Code treats it as advertising when the brand has control over the content.

Who enforces what

Different bodies police different parts of the chain. Data protection and electronic marketing sit with the ICO. The ASA applies the CAP Code to ad content across the UK. Sector regulators add conditions for their own markets.

The Digital Markets, Competition and Consumers Act 2024 received Royal Assent on 24 May 2024. It adds direct CMA enforcement over unfair commercial practices online, alongside the existing ASA system.

Brand safety and ad experience

Brand safety is the practice of keeping ads away from content that could damage the advertiser. It covers misinformation, adult material, hate speech and illegal content.

IAB brand safety resources set out the categories, the tools and the shared vocabulary that buyers and sellers use. They are a sensible starting point when writing a site list or exclusion policy.

Ad experience is the other half. The Coalition for Better Ads status maintained by IAB UK tracks which formats and placements fall below the accepted standard, including intrusive interstitials and autoplay video with sound.

Getting this wrong has two costs. Users install blockers or leave, and publishers lose inventory value. Advertisers lose reach they have already paid for. Neither shows up cleanly in a post-campaign report.

Supply chain transparency tools such as ads.txt and sellers.json help buyers see who is authorised to sell inventory. Verification vendors can scan pages for unsafe content, but their categories and thresholds vary. Write down which standard you are applying and why.

Contextual targeting avoids some data protection issues because it does not rely on personal data. It still needs brand safety controls, but the compliance burden is lighter.

Exclusion lists should cover both domains and content categories. A domain that looks safe at the top level may host user-generated content that is not.

Set exclusions in writing before launch. Review the list monthly, because news cycles and platform policies move faster than annual contracts.

Contracts and liability

Who is the controller when an agency buys media on a client's behalf? The answer should be in the contract, not inferred from practice.

A written agreement should cover data roles, the lawful basis relied on, sub-processor approval, audit rights and breach notification timelines. It should also say who owns the audience data once the campaign ends.

Indemnities matter. If a publisher serves an ad on unlawful content, or a data provider supplies an audience without valid consent, the contract should state who carries the loss.

International transfers of personal data need a lawful mechanism, such as an adequacy regulation or the International Data Transfer Agreement. Many programmatic platforms process data outside the UK, so this clause is not optional.

Audit rights should say how often you can audit, what notice you must give, and who pays. Without that detail, an audit clause can be unenforceable in practice.

Our guide to programmatic advertising commercial contracts covers the clauses that buyers most often find missing when a dispute arises.

Disclosure and transparency

Users should be able to tell when they are seeing an ad. That sounds obvious, but native and influencer-style programmatic formats blur the line.

Ad labelling must be clear, prominent and in the same language as the surrounding content. A small icon in a corner may not meet the standard if the rest of the placement looks editorial.

Political and issue-based advertising carries extra duties. Imprint requirements and spending transparency apply, and the rules differ across the UK nations in some respects, so check the regime that covers where the ad will be seen.

The AdChoices icon is a common transparency tool for interest-based advertising. It does not replace a clear label, but it gives users a route to opt out of behavioural targeting.

Internally, write down how you label ads, who approves exceptions and how you handle complaints. A short policy is more useful than a long one nobody reads. Our template for a programmatic advertising disclosure policy sets out the sections to include.

Complaints about ad labelling should be logged and reviewed. If the same format attracts repeat complaints, change the label rather than defending it.

England and UK differences

Most of the rules described here apply across the UK. UK GDPR applies UK-wide, and the CAP Code is administered by the ASA across England, Scotland, Wales and Northern Ireland.

Some adjacent regimes diverge. Electoral advertising rules differ between the four nations, and certain licensing or sector-specific rules apply only in part of the UK. Gambling advertising, for example, has additional restrictions that vary by jurisdiction.

If a campaign runs only in England, say so in the brief and in the contract. If it runs UK-wide, confirm that the compliance review covers each nation's requirements rather than assuming a single standard applies. A UK-wide campaign may need separate sign-off for each nation's electoral rules if political advertising is involved.

For a jurisdiction-by-jurisdiction view, see programmatic advertising UK regulations in England.

Operational controls

Rules only work if they are wired into the delivery process. That means named owners, documented approvals and a paper trail that survives staff changes.

Set up a pre-launch gate. No campaign goes live until data basis, creative approval, site list and measurement plan are signed off by the responsible person.

Embed the six-rule check in the creative brief and in ad ops, so claims are evidenced before the asset is built.

Log every change. Audience updates, exclusion edits and creative swaps should be versioned with a date and an owner.

A consent management platform can record and signal consent states across the supply chain. If you rely on IAB Europe's Transparency and Consent Framework, check that each vendor's purposes match what you actually do with the data.

Training should cover the specific platforms your team uses, not just general principles. Refresh it when a platform changes its consent framework or reporting API.

Documentation should be short enough to use. A one-page checklist that traffickers actually complete beats a 40-page policy that nobody opens.

Run a monthly compliance review across live campaigns. Check consent rates, exclusion list accuracy and any complaints received. Our programmatic advertising operations and delivery guide explains how to fold these checks into standard trafficking workflows.

Compliance scoring rubric

Use the table below to score a campaign before launch and again after 30 days. Score each row from 1 (no evidence) to 5 (documented and tested). A total below 30 signals material risk.

A score of 5 does not mean the campaign is risk-free. It means you could show a regulator or a client why you believed it was compliant at the time.

The person who signs off the campaign should not be the only person who scores it. A second reviewer from legal, data protection or compliance adds a check that catches optimistic self-assessment.

Keep the completed rubric with the campaign file. If a complaint arrives six months later, the rubric shows what you checked and when.

Common questions

Does UK GDPR apply to programmatic advertising that uses no names?

Yes. Personal data includes online identifiers and device data where they can single out a person, even without a name. The retained UK version of the regulation is the text that applies.

Who is responsible if an ad appears next to harmful content?

Responsibility is shared but allocated by contract. The advertiser and agency usually set the exclusion policy, while the platform and publisher apply it. If the contract is silent, the advertiser often carries the reputational cost. Contracts should name the party responsible for monitoring and the remedy if monitoring fails.

Do the same rules apply in Scotland, Wales and Northern Ireland?

UK GDPR and the CAP Code apply across the UK. Electoral, licensing and some sector rules differ, so a UK-wide campaign needs a review that covers each nation rather than England alone.

How often should a programmatic compliance review happen?

Before every launch, at 30 days, and then at least quarterly. Review sooner if you change data providers, add formats or enter a new market. Individual cases need a qualified adviser. Keep a record of each review as evidence.