Rules and ethics
Part of B2B influencer marketing: UK disclosure laws
What the B2B influencer marketing UK regulations mean for brand teams
B2B influencer marketing rules for UK brands: CAP Code, CMA and ASA roles, consumer and B2B ad law, PECR, UK GDPR, AI claims and compliance actions.
What to take away
- UK AI policy has moved to a regulator-led model, so AI-written or AI-fronted content falls under existing advertising and data rules, not a new exemption.
- Disclosure is shared. A brand that briefs, edits and approves the content can carry as much responsibility as the creator who publishes it.
- UK GDPR applies to creator lists, event sign-ups and warm leads, not only to consumer data.
- The CAP Code and consumer law apply across the UK, while some contract and employment questions differ in Scotland and Northern Ireland.
- This is general guidance. Individual cases need a qualified adviser.
What the rules actually cover
The rules that catch B2B influencer marketing in the UK were not written for social media alone. They come from advertising codes, consumer protection law and data protection law. The Consumer Protection from Unfair Trading Regulations 2008 were replaced, for unfair commercial practices, by the Digital Markets, Competition and Consumers Act 2024. The Competition and Markets Authority (CMA) enforces that consumer regime, including rules against hidden advertising and fake reviews; the ASA administers and enforces the CAP Code. Pure B2B advertising is also covered by the Business Protection from Misleading Marketing Regulations 2008.
Three duties, four rule sources
Duty
- Labelling paid partnerships
- Brand and creator
- Claim substantiation
- Brand
- Lead data processing
- Brand as controller
- AI-generated copy
- Whoever publishes it
Who carries it
- Labelling paid partnerships
- CAP Code / ASA
- Claim substantiation
- CAP Code, consumer law
- Lead data processing
- UK GDPR, ICO
- AI-generated copy
- Existing sector rules
Source
- Labelling paid partnerships
- Claim substantiation
- Lead data processing
- AI-generated copy
Three duties do most of the work. Put the disclosure wording in the brief and check it is clear before publication. Prove the claims with evidence, and record the lawful basis before collecting personal data. None of those tests depends on follower count.
The AdviceOnline library for marketers is the fastest route to how the Committee of Advertising Practice reads those duties for influencer and expert content. It is written for marketers rather than lawyers.
| Duty | Who carries it | Where it comes from |
|---|---|---|
| Labelling paid partnerships | Brand and creator | CAP Code, enforced by the ASA |
| Claim substantiation | Brand | CAP Code and consumer law |
| Lead data processing | Brand as controller | UK GDPR and ICO guidance |
| AI-generated copy | Whoever publishes it | Existing sector rules |
Who carries the disclosure duty
Disclosure cannot be outsourced with a contract line. Where the brand pays for the content, sets the message and approves the final cut, the brand is part of the advertisement. The creator still has to label the post. So do you.
Do you share the disclosure duty?
Did you choose the claims?
treat the post as yours too
creator still must label it
The practical test is control. If you chose the claims, set the deadline and signed off the wording, assume a regulator would treat the post as yours as well as theirs. Put a B2B influencer marketing disclosure policy in place before the first brief: specify the label, approval owner and a pre-publication check that it is visible without a click.
AI content under existing codes
The government's policy paper, A pro-innovation approach to AI regulation, sets out a pro-innovation, regulator-led approach rather than a single new AI act for advertising. The ASA, the ICO and trading standards apply the rules they already have. An AI-drafted caption that overstates a result is still a misleading claim.
So the question is not whether AI was used. It is who checked the output, what evidence sits behind the claim, and whether a reader would grasp the commercial arrangement.
Data, lists and lead capture
B2B campaigns collect personal data quietly. Webinar lists, DM threads, sample requests and creator contact books all count. The ICO's UK GDPR guidance and resources explain the lawful bases, retention and individual rights that apply. A creator handing you a spreadsheet of contacts is a data transfer, not a favour.
The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) apply to direct-marketing emails, texts and social-media direct messages. Marketing to corporate subscribers generally does not require prior consent, but the sender must be identified and an opt-out provided. Sole traders and some partnerships are treated as individual subscribers, so consent is generally needed unless the soft opt-in applies.
Before launch, identify the controller and document the lawful basis. Provide privacy information when collecting data, agree how any transfer will be handled, and set a retention period based on the purpose; delete or anonymise data when it is no longer needed. Check that marketing lists have a lawful source and record opt-outs.
England, Scotland and the rest
The CAP Code and the ASA's remit apply across the UK. Consumer-protection rules matter where a campaign affects consumers; pure B2B advertising is also covered by the Business Protection from Misleading Marketing Regulations 2008. A campaign aimed at buyers in England is judged under the same UK-wide advertising and data-protection framework as one aimed at Scotland. Differences appear elsewhere, mostly in contract and employment questions.
Scots law is a distinct legal system, and general contract law is not contained in one single statute. Contract and employment questions can therefore differ from those in England. Northern Ireland has its own court system, but that does not change the UK-wide advertising and data-protection duties described here. For cross-border creator contracts or disputes, state the governing law and jurisdiction expressly and seek local legal advice.
Common questions
Does a B2B partnership post need a paid label?
Yes, where payment or anything of value changed hands. B2B does not exempt anyone, and the label should be visible before a reader has to click.
Who is liable if a creator gets disclosure wrong?
Usually both parties. The creator is responsible for what they publish, and the brand that commissioned and approved the content can be treated as an advertiser. A contract can move costs, but not regulatory responsibility.
Can AI draft our briefs?
You can, but the claims stay yours. Keep the evidence for anything factual, check AI output against source data, and do not bury the disclosure wording.
