Rules and ethics
When to check affiliate marketing rules and ethics before you scale
Affiliate marketing rules and ethics in England: ASA sanctions, ICO tracking consent, UK GDPR, VAT on commissions and a practical pre-campaign compliance checklist.
What to take away
- The Advertising Standards Authority can name a non-compliant advertiser and require it to have its marketing checked before publication, so an affiliate's breach can cost you placement and brand trust.
- The Information Commissioner's Office expects consent for affiliate tracking cookies, and the Data Protection Act 2018 sets the legal framework for the personal data those cookies collect.
- Affiliate commission is business income, so VAT and record-keeping duties apply once you are trading, not once you feel established.
- Disclosure must be clear and up front, and it should sit in a policy you can point partners to rather than in a single footer line.
- This guide covers England; Scotland, Wales and Northern Ireland share the same advertising and data rules, while some tax administration details differ.
What changed recently and why it matters
The compliance question for affiliate programmes has moved from a niche legal worry to a routine operating cost. Regulators have published detailed guidance on tracking technologies, and the advertising regulator has clarified how sanctions work when a marketer ignores a ruling. Both matter to anyone earning commission on referrals.
If you run a programme, you are not just buying traffic. You are responsible for how that traffic is tracked, what consumers are told, and how the resulting income is accounted for. A partner's shortcut becomes your problem once the complaint arrives.
This guide sets out the rules and the ethics together. The rules are what regulators enforce. The ethics are what keep partners, publishers and customers willing to work with you after the campaign ends.
How the advertising rules apply to affiliate marketing
The Advertising Standards Authority administers the CAP Code, which covers marketing communications in the UK. Affiliate content that promotes a product can fall within its scope even when a third party publishes it.
The practical implication is that claims made by an affiliate are treated much like claims made by the brand. If a partner promises a result you cannot substantiate, the complaint may land with you as the advertiser.
Sanctions and what they mean for a programme
When a ruling is not followed, the ASA can apply sanctions. Its published sanctions guidance sets out measures including naming the advertiser and requiring pre-publication vetting of future ads. That is a commercial problem: buyers see the ruling, and media partners may pause campaigns while vetting is in place.
For programme owners, the lesson is to monitor affiliate creative as closely as you monitor your own. Spot checks, approval workflows and a clear takedown route all reduce the chance of a ruling escalating.
Sanctions are not the only risk. A non-compliant claim can also trigger consumer complaints and payment disputes, both of which cost more time than the original commission was worth.
Data protection and tracking consent
Affiliate attribution depends on tracking, and tracking usually means cookies or similar technologies. The ICO's online tracking guidance explains that consent is normally required before these technologies store or read information on a user's device.
The same guidance covers the consent standard itself: it must be freely given, specific, informed and unambiguous, and it must be as easy to refuse as to accept. A pre-ticked box does not meet that standard.
This is where programme design meets law. If your tracking fires before consent, you are processing personal data without a lawful basis. Fixing that later means re-pitching partners and rebuilding tags.
The Data Protection Act 2018 provides the statutory framework for this processing, so it is worth reading alongside the regulator's guidance rather than instead of it.
For a closer look at consent, retention and lawful bases in an affiliate context, see affiliate marketing data protection in England.
When consent is not the only question
Consent is not the only lawful basis available, but for affiliate tracking it is usually the realistic one. Legitimate interests can be argued, and the ICO expects a documented balancing test if you rely on it.
Record what you rely on, why, and how long you keep the data. If a partner asks for evidence during due diligence, a written record is far more persuasive than an assurance in an email.
Disclosure duties that sit with the affiliate
Disclosure is the ethical core of affiliate marketing. A reader who clicks a link that earns you money should know that before they click, not after they have bought.
The Competition and Markets Authority has taken action against online content that hides commercial relationships, and the ASA has treated undisclosed affiliate content as misleading. The affiliate marketing disclosure policy in England article walks through wording and placement in detail.
Good practice is simple. Put the disclosure where the link appears, use plain language, and avoid vague phrases that readers skip. "Ad" or "paid link" is clearer than a long sentence about commercial partnerships.
Ethically, disclosure also protects the partner. A creator who discloses consistently builds trust with an audience, and that trust converts better than a concealed recommendation.
Contract terms and partner accountability
Most affiliate disputes are contractual before they are regulatory. Who owns the creative, who pays for a breach, and who handles complaints are all matters for the agreement.
Your programme terms should require partners to comply with the CAP Code and data protection law. They should also give you the right to pause or remove a partner whose content creates a compliance risk.
The affiliate marketing commercial contracts guide covers clauses worth negotiating, including indemnities, audit rights and termination triggers.
One practical point: commission terms and compliance terms should be reviewed on the same cycle. A partner paid on a generous model has more incentive to push claims, so the monitoring around that partner should be stronger, not weaker.
Tax and VAT on affiliate income
Affiliate commission is taxable trading income if you are carrying on a business, and it may be miscellaneous income if the activity is occasional. Either way, it should be reported.
VAT is the area that catches people out. Commission paid by a UK affiliate network or merchant is normally consideration for a supply, so registration thresholds and invoicing rules apply. GOV.UK's guidance on VAT for businesses explains registration and what counts as taxable turnover.
If you are an individual affiliate, keep records of every commission payment and any platform fees. If you operate as a company, the accounting treatment differs, and the timing of VAT on accrued commission can affect cash flow.
Budgeting for tax and compliance work is part of programme planning. The affiliate marketing costs and budget guide for England sets out typical line items, from tracking tools to legal review.
This section is general guidance only. Your own position depends on your turnover, structure and contracts, so take advice from a qualified accountant or tax adviser before relying on it.
When to pause a campaign and get advice
There are clear triggers for stopping and checking before you spend more. A complaint from a regulator is the obvious one, but it should not be the first.
Pause when a partner publishes a claim you cannot evidence, when tracking fires before consent, or when a disclosure is missing from a high-traffic page. Pause also when a new market or a new commission model changes your risk profile.
Scale only after the basics are documented: consent flow, disclosure wording, partner terms and tax treatment. Growth on a shaky compliance base simply increases the size of the eventual correction.
A pre-campaign compliance checklist
- Confirm the lawful basis for tracking and record it in writing.
- Check that consent is collected before any affiliate cookie or pixel fires.
- Make refusal as easy as acceptance on the consent banner.
- Put a clear disclosure next to every affiliate link, not in a distant footer.
- Require partners to follow the CAP Code in your programme terms.
- Keep evidence for every performance claim used in affiliate creative.
- Monitor top partners monthly and spot-check long-tail publishers.
- Record commission income and platform costs as you go.
- Review VAT registration and invoicing with an accountant.
- Store consent records and retention schedules so you can answer a request.
How regulators enforce across the UK
The advertising and data rules described here apply across the United Kingdom, and the affiliate marketing UK regulations in England article sets out how the main regimes fit together.
Enforcement in the United States can reach further than many UK marketers expect. The Federal Trade Commission maintains notices of penalty offenses, which signal the conduct it treats as unlawful and can expose advertisers to civil penalties.
For anyone promoting to US audiences, that is a reason to keep disclosure and substantiation standards consistent across markets rather than treating the UK as the strict one.
When a breach is found, the sanction usually starts with a request to change the content. Escalation follows refusal or repetition. The ASA sanctions guidance describes that ladder, and it is worth reading before you assume a warning can be ignored.
Common questions
Do affiliate marketers need to disclose links in England?
Yes. If a link earns you commission, the commercial relationship should be clear to the reader before they act on it. The disclosure should be close to the link and written in plain language.
Is consent always needed for affiliate tracking cookies?
Usually, yes. The ICO's online tracking guidance states that consent is normally required before storing or reading information on a user's device. Relying on legitimate interests instead requires a documented assessment.
Do I need to register for VAT on affiliate commission?
It depends on your total taxable turnover and how you trade. VAT registration is based on turnover thresholds, so check the current position on GOV.UK and confirm your own treatment with an accountant.
What happens if an affiliate breaks the advertising rules?
The ASA can rule against the ad and, if the ruling is ignored, apply sanctions such as naming the advertiser or requiring pre-publication vetting. Programme terms should let you remove the partner and the content quickly.
In this guide
- 5 affiliate marketing UK rules to check before you brief a campaignAffiliate marketing UK regulations for England teams: ASA/CAP ad disclosure, IAB UK Gold Standard duties, CMA reporting routes, plus a worked £5,000 example.
- How to apply affiliate marketing advertising rules to your programmeA checklist for England teams applying affiliate marketing advertising rules: CAP Code disclosure, data protection and environmental claims, with regulator links.
- Check affiliate marketing data protection before your next campaignHow affiliate marketing data protection works for England teams, from controller roles and lawful bases to disclosures and eIDAS trust services.
- What affiliate marketing commercial contracts mean for UK programmesAffiliate marketing commercial contracts set out commission, disclosure duty and data roles. The clauses UK brands and publishers should settle in writing.
- How to write an affiliate marketing disclosure policy without vague wordingA step-by-step guide to drafting an affiliate marketing disclosure policy for England, covering wording, consent, green claims and a scoring rubric.
