What the CAP Code means for social media agencies advertising rules

What to take away

The Online Safety Act 2023 added a statutory layer alongside the CAP Code, so social platform advertising is governed from two directions.
The ASA applies the CAP Code to paid social, influencer content and organic brand posts that are marketing communications.
The ICO enforces data protection law, and its £12.7m fine on TikTok in 2023 shows what weak compliance costs.
Buyers should ask for a written compliance process, a named responsible person and sample substantiation files.

Start with who regulates what

A social media agency in England answers to more than one rulebook.

The CAP Code, written by the Committee of Advertising Practice and enforced by the ASA, covers paid social ads, affiliate posts and brand content that counts as a marketing communication.

Key rules include CAP Code 2.1 (marketing communications must be obviously identifiable) and 3.7 (claims must be substantiated before publication).

The ASA has ruled against Boohoo over influencer posts that were not obviously identifiable.

The Online Safety Act 2023 places duties on regulated user-to-user and search services about illegal and harmful content. Agencies do not carry those duties, but their client work does. See social media agencies: UK rules and compliance guide for how the regimes fit.

The checklist before you brief or sign

Work through these in order, ending each with a document you can point to. Most complaints turn on an ad not obviously an ad and a claim nobody could evidence.

Pre-brief compliance checklist

Confirm who signs off final ad copy
Check paid posts identifiable as advertising
Verify age targeting and restricted categories
Record lawful basis for audience data
Agree takedown and escalation route
Set a process review date

Confirm who signs off final ad copy and who holds the substantiation file.
Check every paid post is identifiable as advertising, including gifted and affiliate content.
Verify age targeting and any restricted-category rules for alcohol, gambling or cosmetic interventions.
Record the lawful basis for any audience list, pixel or lookalike.
Agree a takedown and escalation route for complaints and platform notices.
Set a review date for the process, not just the campaign.

The ICO publishes enforcement action showing the regulatory risk that follows weak consent and unclear privacy information.

Decision table

Choose

Influencer posts: Written brief, clear ad label, signed approval
Custom audience from a CRM: Documented lawful basis and updated privacy notice
Alcohol, gambling or health campaign: Sector-specific CAP guidance checked first
Agency case study results: Figures approved in writing by the client
Complaint or platform notice: Named contact, dated log, written response

Avoid

Influencer posts: Relying on a hashtag the creator may drop
Custom audience from a CRM: Uploading a list without permissions
Alcohol, gambling or health campaign: Assuming the general rules are enough
Agency case study results: Rounding up results without a source
Complaint or platform notice: Handling it informally by email

Compliance file and standards

Good agencies keep a compliance file per client. A sample file holds the signed brief; dated approval emails or screenshots; the evidence pack for every claim; the lawful basis note for each audience list; the age-targeting rationale; and any advice from the ASA or a lawyer.

Some also work to BS 10012:2017, which covers personal information management. The BSI standards catalogue is where those documents are bought, and following one gives an auditable process rather than a promise.

The Online Safety Act 2023 sets the framework for how platforms handle content, and platform policy changes flow into what an agency can publish.

What differs across the UK

The CAP Code and ASA apply across the United Kingdom. Data protection law is UK-wide, with the ICO as regulator.

Online safety duties apply UK-wide. For the England-specific position, see social media agencies UK regulations in England.

Do agencies need to register for advertising work?

No. There is no advertising-specific registration for social media agencies in England. Company registration and sector licences are separate matters.

Who is liable if an ad breaks the rules?

The advertiser is primarily responsible, but agencies that prepare or approve an ad can be named in a ruling. Contracts should say who signs off final copy.

Common questions

Do the advertising rules differ in Scotland, Wales and Northern Ireland?

No. The CAP Code and the ASA's remit cover the whole UK, and the Online Safety Act 2023 extends UK-wide. ICO enforcement is UK-wide.

Is the CAP Code law?

It is self-regulation rather than statute, but the ASA enforces it, and persistent non-compliance can be referred to trading standards.

How often should an agency review its compliance process?

Review at least annually, and whenever a platform changes its ad policies or a client enters a regulated sector. A dated review note proves the process is live.

What should a buyer ask for before signing a retainer?

The named compliance lead, a sample approval workflow, and how audience data was sourced. If the agency cannot explain its process plainly, that is the answer.

This is general guidance only and is not legal advice; individual campaigns and contracts need a qualified adviser.