Rules and ethics
Part of UK rules and ethics for a social media agency
Seven steps to a social media agencies disclosure policy
A practical, England-focused guide for social media agencies writing a disclosure policy, covering the main mistake, the legal framework and seven steps.
What to take away
- Most teams copy a rival's disclosure wording instead of writing rules that match the campaigns they actually run, which is the mistake to avoid first.
- The main duties come from advertising rules, data protection law and platform terms, not from one single statute.
- A usable policy names who checks each post, what wording is acceptable, and where signed-off examples are stored.
- You should review the policy whenever a platform changes its branded content tools or an advertising rule is updated.
- This guide is general information only. Individual cases need a qualified adviser.
Start with the mistake most teams make
Many agencies treat a disclosure policy as a legal formality and copy a competitor's wording. That produces rules that do not match the work being done.
Disclosure scenarios to list
- Creators are paid for posts
- Staff post about clients
- Client product in a competition
- Money or free products unclear
- Commercial relationship not obvious
A policy should describe the campaigns your agency runs. If creators are paid, if staff post about clients, or if a client's product appears in a competition, each needs clear wording.
Start by listing every situation where money, free products or a commercial relationship could be unclear to an audience. Then write a rule for each one.
Know the rules that sit behind the policy
Advertising in the UK is regulated by the Advertising Standards Authority under the CAP Code, and the AdviceOnline library of advertising rules explains how those rules apply to social media and influencer marketing.
Direct marketing messages sent by electronic means are also governed by the Privacy and Electronic Communications Regulations, and the ICO hub for direct marketing and PECR compliance sets out the consent and opt-out requirements.
Personal data used in campaigns falls under the UK GDPR and the Data Protection Act 2018. The older Data Protection Act 1998 is useful only as historical context, because it has been superseded.
Agencies working for public bodies or in Scotland, Wales and Northern Ireland should check whether additional guidance applies. The UK rules and compliance guide collects the wider framework in one place.
Write the policy in seven steps
- List every disclosure scenario your agency handles, including paid partnerships, gifted products, affiliate links and staff advocacy.
- Check each platform's branded content and paid partnership tools, and record which tool must be used for each format.
- Agree the minimum wording for each scenario, such as "paid partnership with" or "ad", and ban vague tags like "collab".
- Assign a named person to approve disclosures before a post goes live, with a deputy for holiday cover.
- Set a retention rule for evidence, including screenshots, briefs and signed creator agreements.
- Train account managers and creators once a year, and keep a record of who attended.
- Diarise a review each quarter so platform changes are picked up quickly.
Steps three and four do most of the work. Vague wording and unclear ownership are the two failures that regulators and clients notice first.
Keep the policy usable
A policy nobody reads is worse than no policy, because it creates a false sense of cover. Keep the live version short and put detailed examples in an appendix.
Give every new starter the policy on day one and ask them to confirm they have read it. Client-side staff who post about campaigns should sign it too.
Where a campaign involves personal data, cross-check the disclosure wording against the privacy notice. The England regulations overview explains how the data rules apply to agency work in England.
Common questions
Does a disclosure policy need to be a separate document?
No, but it must be findable and version-controlled. Many agencies keep it as a section of a wider compliance manual, provided staff can reach it quickly.
Who is responsible if a creator fails to disclose?
The agency and the brand can both be held responsible under the advertising rules, even where a creator writes the post. Clear contracts and pre-approval reduce that risk.
How long should we keep disclosure records?
There is no single retention period for all campaign evidence. Set a period that matches your client contracts and data protection duties, and review it each year.
Does the policy apply to staff posting on personal accounts?
Yes, where the post promotes a client or the agency. Set out clearly when a personal post becomes advertising and what wording is required.
