The UK has one national regime instead of fifty state ones — but it is stricter, more consolidated, and enforced by a regulator (the ICO) that can fine up to £17.5M or 4% of global turnover. On top of it sits an ad-standards regime (the ASA) most US-trained teams have never met. In our builds this is an engineering constraint, not a legal opinion — so we state what changes in the funnel, and route the interpretation to your counsel.
SurfaceLaw / codeIn forceTriggerWhat changes in your funnel
UK data protectionUK GDPR + DPA 20182018 · retained 2021Processing personal data of people in the UKSix lawful bases, the absolute right to object to direct marketing, subject-access requests and documented records of processing. Fine ceiling: the higher of £17.5M or 4% of global turnover.
Email & SMSPECR (ePrivacy)2003, as amendedAny marketing email, SMS or cookie in the UKThe soft opt-in for B2C marketing to existing customers — related products, opt-out on every send; B2B email on documented legitimate interests with an opt-out; consent for SMS. This is the law the lifecycle CRM is built around.
Cookies & trackingICO ePrivacy rules2022 guidance · 2025 draftAny tracking that is not strictly necessaryConsent before the tag fires, a refusal honoured as easily as a grant, no pre-ticking, no dark patterns. The most common ICO finding in an audit is a banner that consents too much — or to nothing.
New data lawData (Use and Access) Act 2025Assent Jun 2025 · key provisions 5 Feb 2026Most UK personal-data processingDirect marketing codified as a recognised legitimate interest, 'reasonable and proportionate' SAR searches with a pausable clock, automated decision-making relaxed outside special categories, a direct right to complain to the company. We build the stack to absorb these as configuration, not projects.
AdvertisingASA — CAP & BCAP codesongoingAny ad or commercial content — paid, organic, influencerEvery claim needs a documented basis; a rejected ad is a paused campaign; influencer disclosure is enforced. The UK's ad-standards regime is the one most US-trained media plans have never met.
Green claimsCMA Green Claims Code + UTPRA 2008Code in force · legislation pendingAny environmental claim in ads or product pages'Carbon neutral' and 'sustainable' need a documented basis, enforced as unfair trading. The claim that sounds best in the workshop is the one that gets the account flagged.
Financial servicesFCA financial-promotions rulesongoingPromoting any regulated productApproval, disclosure and suitability standards — social and influencer channels included. For financial-services and insurance clients this is a hard gate before creative ships.
HealthMHRA + ASA health rulesongoingMedicines, medical devices, supplements with medicinal claimsMedicinal claims are regulated before they are advertised: which claims are runnable, which need substantiation before they ship, and which we do not take at all — decided in the audit, not in the creative meeting.
AccessibilityAccessibility Act 2025 + Equality Act 2010in force from 25 Jun 2025Public-sector digital services; private digital services via the Equality Act dutyWCAG 2.1 AA is the public-sector floor and WCAG 2.2 AA is our baseline everywhere: the checkout you optimised for conversion should not be the one that generates a demand letter.
Consumer lawConsumer Rights Act 2015 + CMAongoingAny consumer transactionUnfair commercial practices, pricing and total-cost disclosure. The offer itself is a compliance surface: if the advertised price is not the price, the funnel is a liability.
On the wayOnline Safety Act duties · CMA AI-chatbot code · UK digital omnibus2026 / 2027signed, not yet in forceAge assurance and UGC duties, codes for AI-assisted customer interactions, and the omnibus simplification. The consent layer is built so the new duties arrive as configuration, not a rebuild.
