Five affiliate marketing UK rules to check before you brief a campaign

What to take away

Rule 1: ASA and CAP Code disclosure

Affiliate links, paid placements and incentivised reviews are ads under the CAP Code. The ASA's advice says promotions must be obviously identifiable. A reader should not have to work out that a link earns commission.

Use a clear ad label close to the link. Do not bury it in a footer. A vague partner tag usually is not enough. The CAP Code guidance for businesses sets out the standards.

A review page with one affiliate link needs a different label from a newsletter with ten links. The commercial nature must be clear before the click.

Rule 2: IAB UK Gold Standard

For programme teams, the IAB UK Gold Standard letter is a benchmark on ad quality and supply-chain responsibility. It asks signatories to cut ad fraud, improve transparency and account for where ads appear. Affiliate supply chains need that discipline because every party can affect what a shopper sees.

Ask networks to apply the same quality checks to affiliate inventory as to display. Our pillar guide on affiliate marketing UK rules and compliance for 2027 maps these duties to contract clauses and onboarding checks.

Rule 3: CMA competition reporting

If an affiliate platform or network appears to distort competition, the CMA is the route. The GOV.UK page on reporting a competition or market problem to the CMA explains how to submit a complaint. It is not a consumer complaints service.

Keep dated records of the conduct, such as screenshots, emails and contract terms. A vague account is hard to act on.

Worked example: a retailer pays a network £5,000 a month for affiliate management and £20,000 a month in commissions. If the network also owns the leading price-comparison sites in that category, shoppers may not know who owns them. That ownership gap can be a market conduct concern.

Fix your own disclosure first, around £500 for rewritten landing pages and clear labels. This is cheaper than an ASA ruling.

Rule 4: UK GDPR and the Data Protection Act 2018

Affiliate tracking usually involves personal data. The UK GDPR and the Data Protection Act 2018 set rules for lawful processing, retention and individual rights. A programme that shares click IDs, email addresses or purchase data with networks needs a lawful basis and clear notices. Check your network contract for data roles and breach terms.

Rule 5: PECR cookie and tracking consent

PECR sits alongside UK GDPR. Regulation 6 requires consent for storing or accessing information on a user's device, unless the storage is strictly necessary. Affiliate tracking pixels, analytics cookies and some device fingerprinting often need consent before they fire.

The ICO enforces PECR. Its cookie guidance says implied consent is not enough for non-essential cookies. A banner must give clear information and a genuine choice. For campaign briefs, add a tracking consent check to your QA list. Confirm which tags fire before consent and which wait.

Common questions

Does the CAP Code apply to affiliate links?

Yes. The ASA treats affiliate promotions as ads when they are paid or incentivised, so disclosure is required. The label must be clear to an ordinary reader.

Do I need a contract clause about the Gold Standard?

It is good practice. The IAB UK letter sets expectations on quality and accountability, and a clause helps you enforce them with networks and publishers.

Can I report an affiliate platform to the CMA?

Yes, if you have evidence of a competition or market problem. Use the GOV.UK reporting route and keep records of the conduct you are describing.

Is this legal advice?

No. It is general guidance based on current UK regulator material. Take advice from a qualified adviser for your own facts.