Home > Guides > Online Advertising Law - A Guide for Online Business

Online Advertising Law - A Guide for Online Business

Online advertising is regulated by an intertwining roster of consumer, data protection, and intellectual property laws. Fines on global turnovers, publicised investigations, reputational harm, and possible criminal action are all at stake if businesses do not follow the rules.

As consumers favour the purchase of goods and services online, consume various kinds of digital content, and use social media as their shopping bags, the opportunities to leverage a brand or business on the internet have become abundant.

Social media, affiliate marketing, influencers, pay-per-click ads, behavioural advertising (etc) are all tools that businesses use. However, these are not without risk and businesses that do not follow the rules may find themselves facing regulatory fines, publicised investigations, intellectual property infringement claims, and even criminal liability.

While no single Act of Parliament exists, online advertising is regulated by a complex mixture of consumer protection, intellectual property, data protection, and e-privacy laws that intertwine with each another depending on the business activity envisioned.

This guide, written by our lawyers, will guide you through what laws apply, when they apply, and practical insights into achieving robust compliance.

Contents

This guide will cover the following: -

  • Who does this guide apply to?

  • What is an advertisement?

  • The Cap Code

  • Anti-consumer practices

  • Direct marketing

  • Online behavioural advertising

  • Comparative advertising

  • Intellectual property and advertising

  • Sector-specific advertising

  • Enforcement of online advertising law

  • What else to consider?

  • What we can help with

Who does this guide apply to?

Any business which trades online, or a mixture of in-store and online, to consumers, as well as those in the marketing industry.

What is an advertisement?

Generally, advertisements are communications that indicate the core features of a product (including price) enabling consumers to decide whether to make a purchase or some other transactional decision.

Obvious examples include social media posts or online ads in paid-for space, but it is important to understand that the legal definition of an advertisement is much broader than thought. In fact, aspects of a business that are not traditionally seen as advertisements may be caught by various legislative regimes. Examples include: -

  • online order and checkout processes;

  • blogs, press releases, and other visual commercial content;

  • landing screens, ‘about us’ sections, and other pages of websites;

  • in-game functionalities for video and mobile games (e.g. microtransactions);

  • call-to-action pop-ups and prompts within digital platforms and apps;

  • the overall design, GUI, and interactive functionality of a smartphone app, mobile game, or video game; and

  • formal terms and conditions and other consumer-facing notices.

Generally, therefore, advertisements can encompass whatever a business has published or communicated about itself or its products on any of its channels, whether written, verbal, or visual. A business’s online presence in general may thus be open to scrutiny by regulators, competitors, and consumers alike.

The Cap Code

The first type of regulation online adverts are subject is the Non-Broadcast Cap Code ran by the Advertising Standards Authority (ASA).

The Cap Code is a rules-based non-statutory code which stipulates various principles either in relation to holistic topics (e.g. children) or industry-specific topics (e.g. food and nutrition). The Code is lengthy and complex, so this guide will focus on the most common reason why adverts are found unlawful. That is, namely, misleading advertising which accounts up to over two thirds of all enforcement activity by the ASA.  

Generally, consumers are likely to focus on the general impression an advert exhorts as opposed to looking at the finer details. It is this contention which underpins the rationale for most ASA enforcement activity in relation to misleading advertising. Examples of ASA principles include: -

  • vulnerable target audiences (e.g. children) are more likely to be susceptible to misleading adverts;

  • hiding or obscuring any commercial incentive would not be permitted;

  • asserting a claim about a product or the advertiser itself requires substantiation, such as holding verifiable documentary evidence; and

  • obvious exaggerations are unlawful and this will be context-specific (e.g. even the use of face filters or fonts may be misleading).

The ASA posts weekly rulings on its website where its interpretation of the Code can be understood. The advertiser is named and shamed and the ASA discloses the status of the complainant(s) which tend to either be consumers, regulators, non-profit bodies, or competitors of the advertiser.

The Code is not legally enforceable but it often replicates laws which appear in the DMCCA (see below) and other industry-specific laws (see below) that may have more serious enforcement action behind them.

Anti-consumer practices

There has been an increased regulatory focus on anti-consumer and unfair commercial practices affecting the consumption of digital content and the purchase or promotion of goods and services online. The Digital Markets, Competition, and Consumers Act 2024 (DMCCA) was introduced to modernise consumer protection where regulation had lagged behind the exponential growth seen in digital and online trade.

Though the DMCCA applies to all activities pertaining to the trader-to-consumer relationship, there is a distinct angle toward online advertising.

The DMCCA requires certain information to always be included in an advertisement, such as the main characteristics of the product, the identity of the trader, and the existence of any optional charges. The omission of such material information will result in an automatically unfair practice, meaning it need not be proven that consumers would be negatively impacted by it through, for instance, making a purchase based on the deficient advertisement.

There is also a list of 32 automatically banned practices which similarly act on this basis, in that nothing has to be proven if it is apparent such practices are occurring. Examples include fake online reviews, falsely displaying trust or certification marks, bait and switch advertising, pressure tactics, and inertia selling.

Practices that fall outside of the above will be subject to the requirement to show that a consumer would have taken a transactional decision based on the practice in question. Such practices include misleading practices, aggressive sales tactics, and a general catch-all of anything which is contrary to professional diligence when dealing with consumers. It is important to note that a ‘transactional decision’ need not necessarily be a purchase, and simply browsing a website in response to advert may be sufficient.

A sub-category of enforcement has also been emerging which relates to the design and functionality of websites and digital products that attempt to cajole consumers into making uninformed transactional decisions often by exploiting consumer heuristics and behavioural biases. These so called ‘dark patterns’ or abusive ‘online choice architecture’ may result in breaches of the DMCCA. Examples include: bundling or sneaking products automatically into online checkouts, deliberately misplacing buttons within GUIs to force mistakes in online choices, and addictive mechanisms in mobile and video games.

The DMCCA is enforced by the Competition and Markets Authority (CMA) whom have direct powers of enforcement, meaning it need not involve the courts to take action – something unprecedented before the DMCCA was introduced.

Direct marketing

Direct marketing is a form of advertising addressed to an individual and opened and viewed by that individual in isolation to everyone else. It encompasses marketing via email, text messaging, and individually addressed alerts on websites or platforms with user accounts. Direct marketing rules also extend to postal and telephone marketing, but this guide will focus on digital marketing.

Direct marketing is governed by e-privacy laws which protect individuals’ right to privacy in the digital world. This includes the Privacy and Electronic Communications Regulations (PECR) and E-Commerce Regulations. The UK GDPR will also apply because targeted advertising involves the use of personal data.

Generally, PECR and the E-Commerce Regulations regulate rules in relation to consent, as well as the content and form of advertisements. For example, ensuring consumers can opt-out of marketing at any time and that advertisements are obviously identifiable as such.

The GDPR will also apply, and the compliance requirements are often quite intense, particularly where online behavioural advertising is relevant (see below). Some of the GDPR duties that may activate in relation to direct marketing will be as follows: -

  • identification of a legal basis for processing personal data for the marketing (including conducting and documenting a legitimate interests assessment);

  • having a suitable privacy policy in place explaining the extent of the processing of personal data;

  • conducting and documenting a data protection impact assessment for any large-scale or high-risk personal data processing;

  • putting in place a data processing agreement for the contracting out of the marketing activities to third parties (e.g. advertisers, agencies, adtech providers);

  • compliance with GDPR principles, such as data minimisation;  

  • complying with consent rules for processing personal data;

  • ensuring suitable technical and organisational measures are in place to ensure the marketing activities are secure;

  • complying with rules on international transfers, especially where third party providers outside of the UK are used; and

  • complying with data subject rights, especially the right to object to the processing of their data (if exercised).

Enforcement activity in relation to direct digital marketing is often the most active area for the Information Commissioners Office (ICO) who are responsible for the GDPR and PECR. The ICO has the power to fine non-compliant organisations up to 4% of global turnover or £17.5 million (whichever greater).

Online behavioural advertising

The digitisation of trade has led to the commoditisation of consumer engagement. Businesses now build profiles of individuals based on consumption patterns, usage data, purchasing choices, and browsing history all to optimise the bridge between lead generation and sales in the digital world.

This so called ‘online behavioural advertising’ (OBA) is achieved through various types of tracking technologies, such as cookies and pixels, which operate on websites, smartphone apps, video games, smart devices, and even digitally embedded into advertisements within emails.

Behind all of this is what is known as the ‘adtech stack’ where online advertising space on key platforms is advertised for sale that are sold on by adtech intermediaries or purchased by advertisers themselves. Cookies and tracking tech are used to measure which online ad space is worth purchasing. Adtech providers might add extra value by placing their own cookies on websites they sell ad space on. The purchase of online advertising in this way is often programmatic (i.e. occurring via automation and optimised by data generated from tracking tech).

In terms of legislation, PECR regulates OBA and most of the rules relate to the provision of transparent information to ensure informed consent for the use of digital advertising is obtained. Additionally, the ICO has confirmed that cookies and other tracking tech is personal data, since the behavioural profile generated is sufficient to single out individuals from others. Consequently, the rules on personal data (see above) will be relevant.

Comparative advertising

Comparative advertising is a common tactic used by businesses to increase the perceived value of its products to consumers. Since competitors are involved, this area of advertising law is closely regulated.

The Business Protection from Misleading Marketing Regulations 2008 (BPRs) contain multiple requirements advertisers must follow to ensure that a comparative advertisement is lawful. This includes the duty to ensure comparisons are not misleading, that similar products are compared, and that comparisons are objective and verifiable. Adverts need not explicitly identify competitors and it is sufficient that an implied reference to them is made for the rules to bite.

A breach of the BPRs will almost always be a breach of the DMCCA which will also likely be a breach of the Cap Code. Furthermore, a breach of the BPRs will most likely be a breach of a competitor’s intellectual property rights (see below).

Intellectual property and advertising

The unlawful use of online advertising may also constitute an infringement of intellectual property rights. As opposed to regulatory action, these claims will come direct from competitors and the amount of (economic) liability at stake could be unlimited.

Generally, this will arise in two circumstances (i) comparative advertising in breach of the BPRs which unlawfully replicate a competitor’s trademark (ii) the use or purchase of advertising keywords and search terms of an identical or similar nature to trademarks owned by competitors. This is generally provided that the use of the competitors’ trademarks leads to some sort of consumer confusion, deception, or unfair advantage gained by the advertiser.

In addition, advertisers may also open themselves up to passing off claims whereby the advertiser misrepresents or deceives consumers as to the source, quality, or repute of a competitor’s brand or products. 

As breach of the BPRs often mean a competitor’s intellectual property has been infringed, the choice of enforcement route is often up to the competitor whether it pursues a claim under the BPRs or an intellectual property infringement action. The wrongful use of competitors’ intellectual property in these ways may also give rise to breaches of the Cap Code and DMCCA insofar as misleading advertisements.

Sector-specific advertising

Advertisers who operate in specialist industries should be aware that special laws apply according to the nature of the product in question. For example, nutritional or health claims made in relation to food products must only be those claims listed under the official Nutritional and Health Claims Register under the Health and Nutrition Claims Regulations 2006. Moreover, the advertisement of medical devices must only occur when those products have been registered with the Medicines and Healthcare products Regulatory Agency under the Medical Devices Regulations 2002.

Enforcement of online advertising law

Regulatory enforcement of online advertising and digital trade has picked up considerably due to the introduction of the DMCCA. Regulators such as the CMA and ICO can issues fines of up to 10% of global turnover for breaches of the DMCCA, e-privacy laws, and GDPR. Fines can be in the multi-millions for multinational businesses whilst in the tens of thousands for small and mid-sized outfits. Enforcement action is often run in campaigns where the focus is on one or two key topics (e.g. dark patterning), depending on the market’s need for intervention at that time.

There is also the considerable reputational harm associated with matters such as anti-consumer practices and breaches of data protection laws. Regulators often have dedicated pages on their websites publishing matters such as enforcement notices, undertaking orders, and monetary penalties on named offenders. 

Though the Cap Code is non-binding, the ASA may issue alerts to Code members, including those in media and postal, to instruct them to withhold services from offenders, as well as require mandatory vetting for future advertisements for repeat offenders.

Criminal liability may also arise for breaches of certain types of advertising laws, especially in relation to anti-consumer practices.

Usually, however, the intertwining nature of advertising laws means most enforcement action is often done initially via the Cap Code before things are escalated to serious enforcement. In fact, the Cap Code replicates some industry-specific advertising laws, that often come with criminal liability, verbatim so that initial enforcement action is done via the ASA. Breaches which are egregious, repetitive, or large-scale may nevertheless receive enforcement action from the CMA or Trading Standards outright which bring the larger fines and possible criminal action.

What else to consider?

Advertising is just the first part of the customer journey. Regulation also kicks in when it comes to contractual terms, cancellation rights, refunds, and returns.

Consumer contracting is a separate but closely connected area and businesses should seek to ensure they have a comprehensive legal compliance strategy in place for such matters and seek specialist advice on the same. In particular, the failure to provide certain mandatory pre-contractual information to consumers under separate legislation (e.g. the Consumer Contract Regulations 2013) may be seen as a misleading action.

For more information, view our guide on e-commerce and consumer law here.

What we can help with

The intertwining and complementary nature of online advertising laws means that what is a breach of one particular type of law often results in breaches of other types of laws. The creative aspect to the interpretation of adverts, the potentially unlimited types of advertising content, reputational risk, and possible escalation into more serious enforcement action are all strong reasons why businesses should pay special attention to their online advertising activities and seek specialist advice on the same.

At Click Digital Law we can advise upon the plethora of different consumer laws pertaining to your business and audit your business activities in relation to laws such as the DMCCA, PECR, and the UK GDPR.

About the author

This guide has been written in-house by our qualified lawyers whom you can contact here for further information and support on your business activities.