UK rules and ethics for a social media agency

What to take away

Social media agencies operate in one of the most heavily regulated corners of marketing. A single paid post can touch data protection law, advertising codes, consumer protection rules and platform terms at the same time. The rules are enforced by different regulators, and the penalties range from a compliance notice to a fine or a court claim.

This guide sets out the main obligations for agencies working with clients in England and the rest of the UK. It is general guidance only. Individual cases need a qualified adviser, particularly where a campaign crosses borders or involves sensitive data.

Who regulates social media agency work

Four regulators matter most for day-to-day agency work. The ICO enforces data protection law. The ASA applies the CAP Code to marketing communications, including social posts.

The CMA polices misleading commercial practices and influencer disclosure. The Consumer Protection from Unfair Trading Regulations 2008 governed the earlier consumer protection regime; the current rules on unfair commercial practices are set out in the Digital Markets, Competition and Consumers Act 2024. The CMA's guidance, Social media endorsements: being clear with your audience, explains disclosure expectations. Ofcom covers video-sharing platforms rather than agency output, so it rarely affects routine social work.

Platforms add their own rules on top. Meta, TikTok, LinkedIn and X each publish advertising policies, and breaches can lead to ad account suspension rather than a fine. An agency that ignores platform policy can lose a client's account access overnight, which is often a bigger commercial risk than regulatory action.

The practical upshot is that compliance is layered. A campaign must satisfy the law, the regulator's code and the platform's terms. Where those conflict, the strictest requirement usually wins. For a wider map of the statutory background, see social media agencies UK regulations in England.

Data protection and lawful basis

Any agency that builds audiences, runs retargeting or reports on engagement is processing personal data. The UK GDPR requires a lawful basis for that processing, and the ICO's page on sending direct marketing: choosing your lawful basis sets out the six options and how to choose between them. The six bases are consent; performance of a contract; compliance with a legal obligation; protection of vital interests; performance of a task carried out in the public interest or in the exercise of official authority; and legitimate interests.

Many agencies are controllers for at least some of their own processing. A controller must pay the ICO data protection fee and appear on the ICO register of fee payers unless an exemption applies. This is a data protection notification duty, not a licence to trade; agencies should check the ICO's fee guidance to establish whether they are exempt.

Consent is the best-known basis, but not always the right one. Legitimate interests can cover some analytics and fraud prevention, provided you document a balancing test. Contract covers processing needed to deliver a service the client has bought.

The mistake agencies make most often is assuming consent covers everything, then discovering the consent record is inadequate when a complaint arrives.

Electronic marketing adds a second layer. The Privacy and Electronic Communications Regulations 2003 restrict unsolicited marketing by electronic means, and the rules differ for business-to-business and consumer audiences. A campaign that is lawful for one audience may be unlawful for the other.

Agencies should also expect to act as a processor for client data and a controller for their own. That dual role needs to be reflected in the contract, not just in a privacy notice. The article on social media agencies commercial contracts explains how to allocate those roles in writing.

Advertising rules and the CAP Code

The CAP Code is the rulebook the ASA applies to non-broadcast advertising, including social media. It requires marketing communications to be legal, decent, honest and truthful. That sounds broad, but the ASA publishes detailed guidance on specific sectors, and its social and political advertising topic guidance covers the area where agencies most often get into difficulty.

Political and social advertising attracts particular scrutiny. Ads that appeal to voters, promote a cause or address contested issues can fall within the code even when they are not paid for by a political party. The ASA has ruled against campaigns that failed to make their commercial or political intent clear.

Influencer marketing is another recurring problem. The ASA expects ads to be obviously identifiable, which usually means a clear label such as #ad placed upfront rather than buried in a wall of hashtags. An agency that briefs creators should build that requirement into the brief and check the final post before it goes live.

Claims need evidence. If a client wants to say its product is the best or the fastest, the agency should hold substantiation before the post is scheduled. The companion guide on social media agencies advertising rules in England walks through the evidence standards in more detail.

Disclosure and transparency

Disclosure runs through most social media compliance. Audiences must know when content is paid for, when a creator was gifted a product, and when an agency runs an account rather than the brand.

The CMA has taken action against influencers who failed to disclose paid relationships. The ASA treats repeated failures as an aggravating factor.

Agency staff should also be transparent about their own role. Astroturfing, where an agency posts as an ordinary member of the public, breaches the CAP Code and platform rules. Fake reviews and undisclosed brand accounts carry similar risks.

A clear policy is also useful evidence if a regulator asks questions later. The guide on social media agencies disclosure policy in England sets out what it should contain.

Equality law and content

Marketing content must not discriminate. The Equality Act 2010 prohibits discrimination on nine protected characteristics, including age, disability, race, religion and sex. It applies to the content an agency produces and to the way the agency treats its own staff and candidates.

Content risk usually arises through targeting and creative. Ad settings that exclude entire groups can amount to indirect discrimination, particularly in housing, employment and financial services advertising, where the law is stricter. Creative that stereotypes or mocks a protected group can breach the Act and the CAP Code at the same time.

Employment risk is often overlooked. Recruitment ads, interview processes and pay decisions all fall within the Act, and an agency that hires freelancers on different terms from staff should be able to justify the difference. Training on inclusive content and fair hiring is cheaper than a tribunal claim.

Accessibility sits alongside equality. Alt text, captions and colour contrast make content usable by people with disabilities. The Web Content Accessibility Guidelines (WCAG) provide recognised criteria for accessible digital content and can be used as a practical benchmark; the legal duty depends on the service and context.

Professional and ethical standards

Beyond the law, agencies are expected to meet professional standards. The Chartered Institute of Marketing's code of professional conduct requires members to act with integrity, maintain competence and avoid conflicts of interest. Membership is voluntary, but the code is a useful benchmark for any agency setting out its own ethical position.

Ethical issues that clients raise most often include buying fake followers, using engagement pods, and scraping data without permission. None of these is worth the reputational damage. Platforms detect and penalise inauthentic behaviour, and a client that discovers an agency has bought followers will usually terminate the contract.

Sustainability claims are a growing area. Greenwashing, where a brand overstates its environmental credentials, is now a priority for both the CMA and the ASA. Agencies should ask for evidence before publishing any environmental claim, and should be willing to advise a client to drop a claim that cannot be substantiated.

Where agency work reaches EU audiences, the EU Digital Services Act (DSA) may be relevant to the online platforms used, depending on its territorial scope. It is not a general UK law for agency-created content, but it is worth checking for pan-European campaigns.

Decision table: situation, choose, avoid

What a compliant agency looks like

A compliant agency has a small number of habits rather than a large compliance department. It documents the lawful basis for each campaign before launch. It keeps evidence for every claim it publishes. It labels paid content clearly and checks creator posts before they go live.

It also trains staff. Data protection, equality and advertising rules change, and a team that has not had refresher training in two years is likely to be working from outdated assumptions. Short quarterly sessions on the areas that affect live accounts are usually enough.

Contracts matter as much as culture. Ownership of accounts, access to ad accounts on exit, approval workflows and liability for regulatory breaches should be settled in writing.

The social media agencies costs and budget guide for England covers how compliance work shows up in agency pricing. That helps when a client questions the cost of a policy review.

Finally, agencies should keep a simple compliance log. A dated record of decisions, approvals and advice taken shows good faith if a complaint arrives. It also makes onboarding new staff faster, because the reasoning behind past decisions is written down rather than remembered.

Common questions

Do social media agencies need to be registered with a regulator?

No single regulator licenses social media agencies in the UK. However, agencies that act as controllers must pay the ICO data protection fee and appear on the ICO register of fee payers unless an exemption applies. Agencies must also comply with the ICO, the ASA and the CMA where their work falls within those remits. Membership of a professional body such as the CIM is voluntary.

Who is liable if a client's ad breaches the CAP Code?

The advertiser is normally responsible for the ad, but an agency that prepared or approved it can also be held to account. Contracts should state who signs off final creative and who bears the cost of a ruling or takedown. In practice, liability is usually shared by negotiation rather than fixed by statute.

Does the Equality Act 2010 apply to social media content?

Yes, where the content or the targeting discriminates against a protected group. The Act also applies to the agency's own hiring and employment practices. Housing, employment and financial services ads face the strictest scrutiny because of specific provisions in the Act.

How long should an agency keep campaign records?

There is no single retention period, as data protection law requires personal data to be kept only as long as necessary. In England, limitation periods for contract claims are typically six years.

Practically, keep approval records and evidence for at least two years. Keep personal data for the shortest period the client needs, and individual cases need a qualified adviser.