Every claim your organisation makes is covered by rules, whether it's on a poster, a product page, a social post or an email. In the UK, most non-broadcast marketing follows the CAP Code, written by the Committee of Advertising Practice and enforced by the ASA, the Advertising Standards Authority. TV and radio adverts have a sister code. The ASA can't fine anyone, but it can stop an advert running, and its rulings are published with the organisation's name on them.

Three rules do most of the work:

• Don't mislead. Marketing must not materially mislead, or be likely to (rule 3.1).
• Don't mislead by leaving things out. Omitting material information can mislead just as much (rule 3.3).
• Hold the evidence first. Before you make a claim that can be objectively checked, you must hold documentary evidence for it (rule 3.7). That evidence is called substantiation.

"The UK's freshest coffee" can be checked, so it needs evidence. Obvious exaggeration that nobody would take literally, called puffery, usually doesn't. The ASA judges how a typical customer would read the claim, not what you meant.

Environmental claims get extra scrutiny. Section 11 of the CAP Code says the basis of an environmental claim must be clear, and unqualified claims can mislead if they leave out significant information. The CMA's Green Claims Code (September 2021) says the same for consumer law: claims must be truthful, clear, complete, fair in any comparison, consider the product's whole life, and be backed by evidence. Green claims that are misleading, vague or unproven are called greenwashing.

UK example: HSBC. On 19 October 2022 the ASA ruled on two HSBC bus-stop posters seen in Bristol and London in October 2021, before the COP26 climate summit. One said HSBC was "aiming to provide up to $1 trillion in financing and investment globally" to help clients move to net zero; the other said it was helping to plant 2 million trees in the UK. The problem was what the posters left out: the bank's financing of businesses with notable greenhouse gas emissions. The ASA "concluded that the ads omitted material information and were therefore misleading", and they must not appear again in that form. A claim can be true and still mislead.

Where your work goes. The Marketing Compliance and Ethics Checklist finds the issues. Keep your fix list (issue, fix, owner, by when) in your portfolio document: you'll copy it into the Compliance fixes section of the Strategic Audit Builder in Module 6. The worked example later in this topic shows a full audit; read it before the task in Lesson 5.4.

You met consent in Module 2, when you asked people to take part in research. Now it returns for marketing, where two sets of rules apply.

UK GDPR, with the Data Protection Act 2018, covers personal data: anything that identifies a living person, such as a name, an email address or an order history. Its principles, in plain English: be lawful, fair and open; use data only for the purpose you collected it for; collect no more than you need; keep it accurate; don't keep it longer than you need; keep it secure; and be able to show you've done all this.

You also need a lawful basis for each use. There are six. The two that matter most in marketing are consent (the person has clearly agreed) and legitimate interests (a use people would reasonably expect, which you've weighed against their rights). A privacy notice tells people in plain words what you collect, why, and how to object.

PECR, the Privacy and Electronic Communications Regulations, adds rules for marketing by email, text and phone, and for cookies. To send marketing emails or texts to individuals you generally need consent. Valid consent is freely given, specific, informed and unambiguous: the person takes a clear action, such as ticking an empty box. A pre-ticked box isn't consent, and nor is silence.

In January 2026 the ICO, the UK's data regulator, fined ZMLUK Limited £105,000 for more than 67 million marketing emails. People had been shown 361 "partner" companies with no way to choose which could contact them, so their consent wasn't specific or informed.

The soft opt-in is the main exception. You can email or text your own customers about your own similar products if you got their details during a sale or while discussing one with them, and gave them a clear, simple chance to refuse then and in every message. Emailing business addresses follows different rules.

Cookies that aren't strictly necessary need consent, so a banner that sets them before anyone chooses is a problem.

What has changed. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and the ICO says all its data protection provisions are now in force. For marketers: PECR fines can now reach UK GDPR levels (the higher of £17.5 million or 4% of worldwide turnover); some low-risk cookies, such as some used for statistics or to improve how a site works, can be set without consent; and charities can use a version of the soft opt-in for supporters. Check the ICO's current guidance for the conditions.

You noted in Module 1 that fake reviews were banned from 6 April 2025. That ban is part of the Digital Markets, Competition and Consumers Act 2024 (the DMCC Act), now one of the main consumer laws a UK marketer needs to know. Its rules on unfair commercial practices took effect that day.

A commercial practice is unfair if it is likely to change what a typical customer decides, and it:

• misleads by what it says or shows (a misleading action);
• leaves out information the customer needs (a misleading omission);
• is aggressive, such as pressure or harassment; or
• falls below the standard of honest, careful behaviour expected of a trader.

On top of these sits a list of 32 practices that are banned in every case. Fake reviews are among them: writing or commissioning a fake review, or one that hides that the reviewer was paid or given something in return. Publishing genuine reviews in a misleading way, such as showing only the good ones, is also caught. Asking every customer for an honest review is fine; rewarding only five-star ones is not.

Drip pricing means showing a low headline price, then adding compulsory charges later in the buying process. The first price a customer sees must include every fixed charge they can't avoid. If a compulsory charge can't be worked out in advance, say how it will be worked out. Optional extras can come later, as long as they are clearly optional.

Who enforces. The Competition and Markets Authority (CMA) can now decide for itself that consumer law has been broken, without going to court first, and fine a business up to £300,000 or 10% of its global turnover, whichever is higher. Trading Standards also enforce consumer law.

Subscriptions: what's expected. The DMCC Act also creates new rules for subscription contracts. They are not yet in force. The government's draft guidance on GOV.UK (October 2026) says they are expected to apply to subscriptions taken out from 1 January 2027, if Parliament approves the regulations. They cover clear information before someone signs up, reminders, and an easy way to cancel. Check GOV.UK for the current date before you rely on it.

The test for every review, price and subscription is the same: would a typical customer, seeing what you show them, make the choice they'd make if they knew everything?

The law sets the floor, not the ceiling. Something can be legal and still cost your organisation the trust it depends on. A useful test: would you be comfortable if customers saw exactly how you did it?

Four areas to check:

• Customers in vulnerable circumstances. Anyone can be vulnerable at times, through illness, money worries, grief or stress. Pressure tactics such as a false "only 2 left!" hurt them most, and fake urgency can also break consumer law. Adverts aimed at children have their own rules in the CAP Code.
• Inclusive images and words. Who appears in your marketing, and who never does? Since 14 June 2019 the CAP Code (rule 4.9) has banned gender stereotypes likely to cause harm or serious or widespread offence. Beyond the rule, ask whether all your customers would recognise themselves.
• Dark patterns. Design that steers people into choices they wouldn't otherwise make: a "No thanks, I don't like saving money" button, a hidden unsubscribe link, a cancellation that needs five screens or a phone call. Some are already unlawful; all of them cost trust.
• AI. Never paste personal data (names, emails, order histories) or confidential information into a public AI tool. Check every fact and claim an AI writes: you need the evidence, not the AI. Watch for bias, such as who an AI image shows by default. Be open about AI use where customers would expect to know, and follow your organisation's policy if it has one.

AI activity. Take one piece of your organisation's ad copy, such as a product description or a social post. Ask an AI assistant whether it meets the CAP Code, and which rules apply. Then check its answer against the Code itself on the ASA's website. Note where it was wrong, out of date or vague: a rule number that doesn't say what the AI claimed, or "it depends" with no reason. Keep the AI's answer and your notes in your portfolio; they show your judgement. Use public copy only.

The audit. Read the worked example first: it shows Larkfield's audit in full. Then work through every group of the Marketing Compliance and Ethics Checklist using your organisation's real public marketing: its website, emails you've received from it, its adverts and its reviews. Mark each item Done, Partly or Not yet. For every gap, add a line to your fix list: the issue, the fix, who should own it, and by when. If you can't check an item from outside, write it down as a question to ask someone inside.