Influencer marketing rules and ethics: how to assign duties

Influencer agencies rules and ethics are easiest to apply when each duty is assigned to the party making the relevant decision. An England-based campaign may involve the advertiser, agency, creator, talent manager and platform, but an agency label or contract does not make one party the universal owner. For a separate explanation of how UK rule sources differ, see UK influencer-agency regulations.

This guide focuses on responsibility: who decides, who acts under delegated authority and who must answer for a decision. It is not case-specific advice or a campaign certificate; qualified specialists must assess the actual parties, product, audience, asset and data use.

What to take away

Start with the party making the decision

The Digital Markets, Competition and Consumers Act 2024 is relevant to commercial practices. CMA207 is Competition and Markets Authority (CMA) guidance explaining the unfair-commercial-practices provisions; its current overview says they apply from 6 April 2025 and replaced the earlier Consumer Protection from Unfair Trading Regulations 2008 (CPUTR) regime for that conduct. For a campaign, establish who chose the commercial representation and who actually made or communicated it; a general agency label does not answer that question.

The CAP Code is the non-broadcast advertising code written by the Committee of Advertising Practice (CAP) and administered through the Advertising Standards Authority (ASA). CMA and Information Commissioner's Office (ICO) material can help explain responsibilities, but the party doing the work should not assume that a client, agency or platform has taken over its own role. Identify who gave the instruction, who had authority to approve it and who could require a change.

For campaigns reaching people in England, most sources discussed here have a UK-wide legal or regulatory scope, but contract and employment questions can differ within the UK. Employment-status guidance from Acas applies to Great Britain, while Northern Ireland has the Labour Relations Agency; Scots contract law is separate from the law of England and Wales. A platform record may be global. Record the jurisdiction next to each conclusion rather than describing everything as "England law".

Give someone in the advertiser-agency relationship responsibility for noticing proposed changes in the rules that affect their work. A proposal or consultation should not be treated as an enacted duty.

The ICO's update on the Data (Use and Access) Act 2025 (DUAA) says the Act amended rather than replaced the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and PECR. Its data-protection provisions were in force when checked. Assign responsibility for reviewing the effect on the parties' actual processing, rather than assuming a contract label resolves it.

Where an ICO page is marked under review, the party relying on that guidance should ensure its use is checked against current law and appropriate advice.

Voluntary standards and professional duties

The law is not the only source. Professional and trade bodies publish standards that can bind the parties as members: the Public Relations and Communications Association (PRCA) and the Chartered Institute of Public Relations (CIPR) each maintain a professional code of conduct, ISBA represents UK advertisers, IAB UK and the Influencer Marketing Trade Body (IMTB) publish standards for the influencer-marketing market, and the Data & Marketing Association (DMA) publishes a code for marketing practice. Check the current version, whether it binds a party as a member, and how it interacts with the CAP Code and the other sources described here.

Allocate duties to the real parties

The advertiser chooses business purpose, product claim and intended audience; a talent manager may represent a creator for specified decisions. An influencer agency may brief, coordinate, buy media or operate accounts within its mandate.

The creator produces or publishes content and may retain rights or approval powers. A platform supplies account functions and imposes terms; audience members hold consumer and data rights, not a resource owned by the campaign.

Use the map below to keep each duty with the party that normally carries it; no row removes a duty from the other parties.

Some duties sit with the agency only when it actually holds the mandate, and each should be allocated in writing.

Exclusivity: the agency should not accept a restriction on the advertiser's other activity without authority from the contracting entity. Whitelisting or paid-partnership permissions: confirm who may authorise the use of a creator's handle or account, on which platform and for how long. Usage rights: record the licence scope, territory, channels and duration, and name who approved it. Payment handling: state who pays the creator, when, on what evidence and what happens if the advertiser does not pay. Conflicts of interest: require the agency to disclose any interest in a creator, media owner or supplier before the advertiser approves the arrangement.

Do not let a contract label settle the legal analysis. A party's actual activity can matter. The CMA's updated guidance for brands tells businesses using an intermediary to ensure it understands its obligations, and advises brands to check and correct content referring to them. It does not make an agency the universal compliance owner.

Verify the contracting entity and the creator-side authority separately. The Companies House register kept under the Companies Act 2006 can support an identity check for an incorporated UK party, but it says nothing about a talent mandate, platform-account control or rights licence.

Keep approval authority with the accountable parties

CAP Code Section 1 requires marketing communications to comply with the Code as a whole. Section 2 addresses recognition of marketing communications, while Section 3 deals with misleading advertising, including evidence for objective claims. Identify who supplied the claim, who was authorised to approve its wording and who can require it to be changed; an agency's involvement alone does not answer those questions. For the label itself, CAP and ASA guidance for influencers gives examples such as "Ad", "#ad" and "Advert", alongside platform tools such as a paid-partnership label; the party publishing the final asset is responsible for the wording the audience actually sees.

Set approval authority out in a way that reflects the parties' actual roles. The advertiser should identify who can approve product statements and the creator should know what they are being asked to say; the agency should stay within its mandate when adapting or circulating material. Make clear when an approval is only for presentation and when it authorises the substance.

Where an agency negotiates or arranges consideration, establish who has authority to agree it and who is responsible for telling the other parties what was agreed. CMA content-creator guidance covers commercial relationships including free or discounted products, direct payment and commission. The agency should not treat arranging the relationship as proof that another party has understood or approved it.

Platform controls do not decide the division of responsibility between advertiser, agency and creator. YouTube's first-party paid-promotion help says creators and brands remain responsible for local disclosure obligations. A native label does not show that an agency had authority to approve the campaign or that the other parties discharged their own roles.

Protect the integrity of creator statements

A creator's account of personal experience is not simply another piece of advertiser copy. Establish whether the creator actually used the product and whether the words remain their own, especially if an agency or advertiser edits the material. The Digital Markets, Competition and Consumers Act 2024 is relevant to consumer-facing commercial practices, but this guide does not determine how its provisions apply to a particular post.

If a creator post claims genuine experience, keep evidence of what was actually used, for how long, and under what incentive. Record which statements are personal opinion or objective claim. Do not script an experience that did not occur.

The party that selects and republishes ratings, review counts or quotations takes an editorial decision about how those statements are presented. Check that the material is used in a way the relevant party is authorised to approve, and do not imply that a creator or reviewer made a statement they did not make.

No AI-assisted draft should be presented as a person's genuine experience. The applicable duty depends on the content, representation, product and use. There is no universal AI disclosure wording asserted here.

Assign responsibility for personal data

A party's contractual title does not settle its role under the UK GDPR. Use a processing map to show who determines why personal data is used, who decides how it is used and who acts only on another party's instructions. A named privacy lawyer or data-protection specialist must assess the configured roles and lawful basis.

For the separate questions raised by audience uploads, make clear which party is responsible for the decision to use them and which party is carrying it out.

The Privacy and Electronic Communications Regulations 2003 (PECR) can apply independently to storage or access on a person's device. Identify the party that decides to use or arrange the relevant mechanism, rather than assuming that an agency or platform automatically owns the analysis. The ICO's guidance can inform a specialist review of the configured arrangement.

Where an agency processes personal data only on an advertiser's instructions, the parties should make that instruction-based role clear in their agreement. The ICO controller-processor contract page was marked under review because of DUAA changes when checked. The agreement should reflect what the parties actually do, rather than relying on a label that conflicts with their conduct.

An agency that decides how personal data is used will usually need to register with the ICO, unless an exemption applies. The agency should check its own registration entry, named contact and scope against the role it actually performs.

Give safeguarding and accessibility decisions a clear owner

Do not assume an audience is adult because a campaign is not aimed at children. If children are creators, participants or likely audience members, identify who is responsible for commissioning the work and who can authorise its safeguarding and age-appropriate review.

The ICO's children and UK GDPR guidance says child-specific considerations apply and notes its DUAA update. ASA and CAP children guidance covers a separate advertising boundary. Assign someone with suitable authority to consider both, rather than treating a general campaign sign-off as a substitute.

Accessibility is another release responsibility. Agree who will assess the final label, captions, audio, contrast, text alternatives, reading order and destination with relevant users and assistive technology. A platform's disclosure control does not guarantee that the whole advert is perceivable or understandable.

For financial promotions, identify the party responsible for the communication and obtain an appropriate review against the applicable rules. The FCA's FG24/1 social-media guidance is finalised guidance from the Financial Conduct Authority (FCA), not new legislation, and explains that financial-promotion rules are technology neutral. Other regulated subjects may also require their own specialist approval; do not assume the agency's general sign-off covers them.

Make delegated authority clear in the agreement

The commercial agreement should name the legal entities and state who may give instructions, approve work, make changes and stop activity. Define the agency's mandate, the creator's authority over their contribution and the decisions that must return to the advertiser. The aim is to make the actual allocation of work and authority clear, not to imply that a contract label decides every legal responsibility.

Named UK contract law then applies to what the agreement says. The Unfair Contract Terms Act 1977 limits exclusion clauses in business-to-business dealings, and the Late Payment of Commercial Debts (Interest) Act 1998 gives a statutory right to interest on late payment of commercial debts. The Consumer Rights Act 2015 governs fairness and terms where a consumer contract or consumer notice is involved, and the off-payroll working rules (IR35) administered by HM Revenue & Customs (HMRC) can move the tax and National Insurance position where a creator or freelancer is engaged through an intermediary. Contract duties are not policed by a single regulator: they are enforced between the parties in the courts of the relevant UK jurisdiction.

HMRC's online-platform income guidance says online-content income can include gifts and services. That general UK page does not determine a creator's or agency's tax treatment. Make clear who records and reports each party's income and consideration, and have qualified advisers assess the treatment.

The National Cyber Security Centre (NCSC) has guidance on social-media publishing and organisational account security. The agreement should identify who is authorised to publish for the client and who is responsible for keeping that authority within the agreed mandate; holding account access does not make the agency the owner of the client's decisions.

The monitoring record should make clear who is responsible for identifying a material change to published work and who can authorise a correction or withdrawal. The CMA brand guidance recommends prompt correction where content is not labelled properly. Agree in advance how the agency will refer a decision back to the advertiser when it lacks authority to make it.

Review responsibility as rules and roles change

This page uses 2027 as a review horizon, not a forecast. On publication day, assign responsibility for checking changes to legislation, CMA guidance, CAP Code sections, ICO material, sector rules, platform policies and contract schedules. Keep clear which party owns each review and which conclusions need qualified advice.

Do not proceed while it is unclear who has authority over the campaign, who approved the relevant decisions or who must act if the agreed work changes. The correct legal conclusion can only come from named qualified reviewers examining the configured campaign.

Before you act

Common questions

What is the difference between the CAP Code and legislation?

The CAP Code is an industry code administered through the ASA and CAP system, not an Act of Parliament. The Digital Markets, Competition and Consumers Act 2024 is legislation. For an agency relationship, identify which party is responsible for the conduct at issue; the source alone does not establish that the agency owns every duty.

Can a prominent disclosure fix a misleading claim?

No. CAP Code Section 2 addresses recognition of marketing communications, while Section 3 deals with misleading advertising, including evidence for objective claims. Identify who approved the relationship description and who is responsible for the claim itself; an agency's involvement does not by itself settle either responsibility.

When does PECR apply to an influencer campaign?

PECR can apply independently to storage or access on a person's device. Determine which party decided to use or arrange the relevant mechanism and have a specialist assess that configured use. Do not assume that responsibility rests automatically with the agency or platform.