When to check marketing agencies' UK compliance

What to take away

Choosing an agency comes down to more than the best pitch. The supplier you want can show you, in writing, how it will keep your brand on the right side of advertising, data and tax rules. That evidence separates a safe engagement from an expensive lesson.

This guide sets out the rules and ethical expectations relevant to marketing agencies operating across the UK, with notes where the position differs.

Advertising and data protection rules for agency work

Advertising and the CAP Code

The Committee of Advertising Practice writes the CAP Code, and the Advertising Standards Authority enforces it. The code covers paid media, including social posts, influencer content and native advertising. Ads must be legal, decent, honest and truthful, and marketing communications must be obviously identifiable as such. Broadcast advertising is covered by the BCAP Code, written by the Broadcast Committee of Advertising Practice and administered by the ASA.

That last point matters most for agency work. If an agency places a paid post that reads like editorial, the ASA can rule against it, and the ruling is published.

The ASA also keeps a list of non-compliant online advertisers, which names operators that fail to respond or correct breaches. Checking that list before you brief an agency is a quick reputational check. The ASA's non-compliant online advertisers list shows how enforcement escalates when advertisers ignore the regulator.

The code is drafted in broad terms, so an agency cannot hide behind a technical reading. The ASA decides each case on its merits and publishes its reasoning. That reasoning is useful evidence when you push back on a creative idea that feels risky.

Native advertising has its own layer of good practice. IAB UK publishes principles for creative best practice in native distribution, covering labelling, disclosure and the separation of commercial content from editorial.

An agency that follows those principles is easier to defend if a complaint arrives. The IAB UK native distribution principles are a sensible baseline to write into a brief. Ask to see the labelling convention the agency uses, and check it against your own brand guidelines before the first post goes live.

For wider advertising rules, including sector restrictions and the difference between codes and law, see our guide to marketing agencies advertising rules in England. It explains how the CAP Code interacts with statutory bans and where the ASA's remit stops.

Data protection and direct marketing

Direct marketing involving personal data is governed by the UK GDPR and the Data Protection Act 2018; the Privacy and Electronic Communications Regulations 2003 (PECR) set additional rules for electronic marketing and cookies. The ICO is the UK's data protection regulator, and these rules cover consent, legitimate interests, suppression lists and the right to object across email, SMS, phone and postal marketing, as well as cookies and similar technologies. See our data protection law guide for more.

Cookies and similar tracking technologies also fall under PECR, with requirements distinct from those for email and SMS. Ask the agency to explain its consent model for tracking and messages, and where consent is recorded. Agencies handling personal data should check whether they need to register with the ICO and pay the data protection fee; some organisations are exempt.

The statutory basis for many consent rules sits in older legislation. The Tobacco Advertising and Promotion Act 2002 is one example of a sector-specific prohibition, showing how Parliament can restrict marketing outright in some categories. Agencies working in regulated sectors need to check the specific ban before they plan anything.

For everyday direct marketing, consult the ICO's Direct marketing guidance, which includes a step-by-step guide for small organisations. It covers lawful bases, consent records, privacy notices and handling objections.

An agency that cannot describe its consent model in those terms is a risk to your brand; ask it to follow the ICO's Direct marketing guidance.

Where an agency acts as a processor, your contract needs to reflect that. Our guide to marketing agencies commercial contracts in England covers the clauses that allocate data protection responsibility, including breach notification and sub-processor approval.

Disclosure, tax and employment duties

Disclosure and transparency

Disclosure is the area where clients most often assume the agency has it covered. A policy should set out who checks labels and when.

Agencies should have a written disclosure policy that covers paid partnerships, affiliate links, gifted products and employee advocacy. The policy should name who signs off content and how labels are checked before publication. Our guide to marketing agencies disclosure policy in England sets out what a workable policy looks like and the questions to ask before you approve one.

Transparency also extends to pricing and conflicts of interest. An agency that earns commission from media owners while also advising you on media strategy has a conflict that should be disclosed. Ethical practice means putting that in writing, not leaving it to a conversation.

Tax and employment status

Tax rules affect both the agency and the client. VAT treatment, IR35 status and the employment status of contractors can change the cost of an engagement and create liabilities if handled badly.

Take an illustrative £10,000 fee from a VAT-registered agency. At the standard VAT rate of 20%, the invoice would be £12,000. If the agency is not VAT registered, it cannot charge VAT, but its turnover must stay below the £90,000 registration threshold.

On IR35, the off-payroll working rules apply to medium and large clients. A small company is exempt: broadly, it meets two of turnover up to £10.2m, balance sheet up to £5.1m, or 50 employees.

HMRC is the authority for all of these, and its guidance is the starting point for any question about VAT, payroll or off-payroll working. The HMRC guidance hub collects the relevant manuals and notices, including the off-payroll working rules that apply when a client engages a contractor through an intermediary.

Off-payroll working rules put the responsibility for determining status on the end client in many cases, which is why the question lands on your desk rather than the agency's. Get the answer in writing before the contractor starts.

For a small agency, the practical risk is a retrospective tax bill. For a client, the risk is a supply chain that stops mid-campaign if the agency is reclassified. Neither is a reason to avoid agencies; both are reasons to ask for written confirmation of tax status and to take advice where the answer is unclear.

Our overview of marketing agencies UK regulations in England puts tax alongside advertising and data rules in one place, which is useful when you are building a compliance checklist for a new supplier.

A step-by-step compliance check

Use this sequence before you sign a contract or renew an existing one. It is designed for a client-side marketer or procurement lead, not a lawyer, and it produces a file you can hand to a qualified adviser if something looks wrong. Work through it in order, because later steps assume you already have the answers to earlier ones.

Timing matters as much as sequence. Build or refresh the plan before you brief an agency, before you sign a contract, and at each renewal. Review it at least annually and whenever relevant rules or regulator guidance changes. The checks below apply at each of those points.

Steps three to six are the ones that most often expose gaps. An agency can be excellent at creative work and still fail on consent records or tax status. The point of the sequence is to find that out before the campaign goes live, not after.

If a supplier refuses any of these requests, treat the refusal as information about how the relationship will run. A short written answer costs nothing, and a refusal usually signals a gap the agency would rather not document.

Where the rules differ across the UK

Most advertising and data protection rules apply across the United Kingdom. The CAP Code is UK-wide, and the ICO regulates data protection across the UK. The Tobacco Advertising and Promotion Act 2002 extends to England, Wales and Scotland, with separate provision for Northern Ireland.

Some regulated products carry separate legislation in Scotland, Wales and Northern Ireland, so where an ad is seen can matter as much as where it was made. Check the jurisdiction your audience sits in, not just the one your agency works from.

Tax rules are UK-wide in structure but can differ in detail. VAT and off-payroll working rules apply across the UK, though the devolved administrations have their own powers in some related areas.

If your campaign runs only in England, the practical position is usually the same as the rest of the UK, but confirm anything sector-specific with a qualified adviser.

For a client, the safe assumption is that the rules travel with the audience. If you market to people in Scotland, Wales or Northern Ireland, the same advertising and data standards apply, and any sector ban needs checking against the relevant legislation.

Common questions

Do marketing agencies need to be registered with a regulator?

No single regulator licenses marketing agencies. Instead, agencies are subject to the CAP Code through the ASA, data protection law through the ICO, and tax rules through HMRC.

Some activities need separate authorisation. FCA financial promotions rules apply when a firm communicates an invitation or inducement to engage in investment activity; unauthorised firms usually need approval from an authorised person. Credit broking requires FCA permission, with limited permission available for some brokers. There is no de minimis threshold for either activity, though exemptions exist.

Who is liable if an agency breaks advertising rules?

The advertiser is usually liable for the content it approves, even when an agency created or placed it. The ASA can rule against the brand and publish the ruling. Contracts can allocate costs between the parties, but they cannot transfer regulatory responsibility away from the advertiser.

Can an agency use client data for its own marketing?

Only if the contract and the privacy notice allow it, and only on a lawful basis. Using client data for the agency's own promotion without a proper basis is a breach of data protection law. Ask for the clause that covers it before you sign.

What should a compliance file contain?

At minimum: the agency's disclosure policy, evidence of its consent and objection handling, confirmation of tax status, examples of labelled advertising, and the agreed measurement terms. Keep it with the contract. If a complaint or query arrives, this file shows what you checked and when.

This guide is general information, not legal or tax advice. Rules change, so take advice from a qualified adviser before you rely on anything here.