Rules and ethics
When to check affiliate marketing rules and ethics before you scale
Affiliate marketing rules and ethics in England: ASA sanctions, ICO tracking consent, UK GDPR, VAT on commissions and a practical pre-campaign compliance checklist.
What to take away
- Affiliate content promoting a product sits inside the CAP Code, so the ASA can rule against the programme and not just the publisher. Ignore a ruling and it can name you and require pre-publication vetting of future ads.
- Consent is normally needed before an affiliate cookie or pixel reads or stores anything on a device. Legitimate interests is possible, but only with a documented balancing test.
- VAT registration turns on total taxable turnover, which was £90,000 from 1 April 2024. Confirm the current figure before you scale spend.
- Disclosure belongs beside the link, in plain words such as ad or paid link. A footer line is not enough.
Which rules bite before you scale
Four sets of rules cover an affiliate programme: advertising, consumer protection, data protection and tax. The advertising and consumer protection rules run UK-wide, enforced by the ASA and the CMA respectively. Data protection is enforced by the ICO. Tax administration differs in places across the four nations, but an England-based programme operates the same way.
The ICO's guidance on cookies and similar technologies and the CMA's Influencers' guide to making clear that ads are ads map how these regimes overlap, which helps when one complaint touches several.
When to check: a staged checklist
- Before recruiting partnersconfirm programme terms require the CAP Code, the Consumer Protection from Unfair Trading Regulations 2008 and data protection law, and that you can remove a partner quickly.
- Before tags fireverify PECR-compliant consent is captured before any affiliate cookie or pixel reads or stores data, and that you have paid the ICO data protection fee unless exempt.
- Before content goes livecheck that every affiliate link is labelled as advertising beside the link, using CAP Code rule 2.1 and the CMA's Influencers' guide to making clear that ads are ads.
- Before commission paymentconfirm VAT treatment and that invoices and records meet HMRC requirements.
- Before increasing budgetreview ASA rulings and sanctions history, ethical risks such as dark patterns or incentivised reviews, and whether pre-publication vetting could stall activity.
| Regime | Enforcer | What it means for a programme |
|---|---|---|
| CAP Code | Advertising Standards Authority | Affiliate claims must be substantiated and identifiable as marketing |
| UK GDPR and Data Protection Act 2018 | Information Commissioner's Office | Consent for tracking, records of processing, retention limits |
| VAT and income tax | HMRC | Commission is payment for a supply once you are trading |
Consent has to come before the tag fires
Attribution depends on cookies and pixels. The Privacy and Electronic Communications Regulations 2003 (PECR) govern storage and reading on a device, and the ICO's guidance on cookies and similar technologies explains that consent is normally required. The ICO's Guide to the GDPR sets out that consent must be collected before storage or reading, not after.
Practically, refusal must be as easy as acceptance, pre-ticked boxes do not count, and consent records need to be retrievable months later. A default tag that fires on page load is a build problem, not a policy one.
Before launch, confirm:
- Consent is captured before any affiliate tag fires.
- Accept and reject are equally prominent and equally simple.
- Consent records are timestamped and stored where you can retrieve them.
- You have paid the ICO data protection fee unless exempt.
Disclosure that survives scrutiny
The ASA and the CMA both treat a hidden commercial relationship as misleading. Under the Consumer Protection from Unfair Trading Regulations 2008, it is a misleading commercial practice to omit material information such as a commercial relationship. CAP Code rule 2.1 requires that marketing communications are obviously identifiable as such. The CMA's Influencers' guide to making clear that ads are ads and the ASA's Advice Online entry on affiliate marketing state that a link's commercial nature should be obvious before a reader clicks, not buried in a site-wide page.
Placement matters more than wording. A short label beside the link works better than a paragraph about partnerships. Keep the same standard on social posts, newsletters, video descriptions and comparison tables, where labels often go missing.
Disclosure wording: clear vs vague
Clear
- Placement
- Next to link
- Language
- Plain words
- Label
- Ad or paid link
- Timing
- Before click
Vague
- Placement
- Distant footer
- Language
- Long sentences
- Label
- Commercial partnership
- Timing
- After purchase
The CMA's Influencers' guide to making clear that ads are ads gives examples of clear wording and placement.
Ethical safeguards beyond disclosure
Ethics in affiliate marketing goes beyond labelling links. Watch for dark patterns that make rejection harder than acceptance, incentivised reviews that are not disclosed, targeting vulnerable audiences, and conflicts of interest where a publisher also owns the merchant. The CMA's Influencers' guide to making clear that ads are ads and the ASA's Advice Online entry on affiliate marketing give the compliance baseline, but a programme that scales should treat these as risk areas to review.
Example: when one claim escalates
A publisher promises clinically proven results for a supplement you sell. You cannot evidence the claim, and the complaint lands on you as the advertiser, not the publisher.
The ASA's sanctions ladder applies when a ruling is ignored. It can name the advertiser, require pre-publication vetting of future ads, and refer the matter to other regulators. Vetting alone can stall paid activity for weeks.
ASA sanctions escalation
- Affiliate publishes unsubstantiated claim
- Complaint lands with advertiser
- ASA ruling issued
- Advertiser named publicly
- Pre-publication vetting required
- Media partners pause campaigns
Name who checks creative, how fast a partner can be removed, and what evidence sits behind every claim, before you raise budget.
Contracts, tax and records
Programme terms should require partners to follow the CAP Code, the Consumer Protection from Unfair Trading Regulations 2008 and data protection law, and give you the right to pause or remove content without waiting for a ruling. Clauses worth negotiating include indemnities, termination triggers and audit rights; see our affiliate marketing commercial contracts guide.
VAT catches people out. Commission from a UK network or merchant is normally payment for a supply. Registration is triggered by total taxable turnover, which was £90,000 from 1 April 2024. HMRC's GOV.UK registration guidance covers eligibility and the process; check the current threshold before you scale.
Common questions
Do affiliate links need to be disclosed in England?
Yes. A link that earns commission must be identifiable as marketing before the reader clicks, with the label beside the link rather than in a distant policy page.
Is consent always needed for affiliate tracking cookies?
Usually. The ICO treats consent as the realistic basis for tracking, and it must be captured before the tag fires. Fraud prevention can rest on legitimate interests, but not as a default for attribution.
Do I need to register for VAT on affiliate commission?
Only once total taxable turnover passes the threshold, which was £90,000 from 1 April 2024. Commission from a UK merchant is normally payment for a supply, so invoicing rules follow.
What sanctions can the ASA impose?
It can name an advertiser, require pre-publication vetting of future ads, and refer a case to other regulators such as Trading Standards.
In this guide
- Five affiliate marketing UK rules to check before you brief a campaignAffiliate marketing UK rules for England teams: five checks covering ASA/CAP disclosure, IAB UK Gold Standard, CMA, UK GDPR, and PECR cookie consent.
- Affiliate marketing advertising rules: CAP Code disclosure and eight checks before launchA practical guide to affiliate marketing ad rules for England programmes: CAP Code disclosure wording, eight checks before launch, liability and records.
- Affiliate marketing data protection: roles and consentHow affiliate marketing data protection works for UK teams, from controller roles and lawful bases to online disclosures and eIDAS trust services.
- What affiliate marketing commercial contracts mean for UK programmesAffiliate marketing commercial contracts set out commission, disclosure duty and data roles. The clauses UK brands and publishers should settle in writing.
- How to write an affiliate marketing disclosure policy without vague wordingA step-by-step guide to drafting an affiliate marketing disclosure policy for England, covering wording, consent, green claims and a scoring rubric.
