B2B influencer marketing: UK disclosure laws

What to take away

The most common mistake is treating a paid creator post as a PR favour rather than an advertisement. Under the CAP Code, paid-for promotion must be obviously identifiable before a reader engages with it.
The legal duties split into four areasadvertising disclosure, data protection, direct marketing consent, and professional conduct. Each has a different regulator and a different remedy.
The Data Protection Act 2018 and UK GDPR govern any personal data you process when sourcing, briefing or measuring creators. You need a lawful basis, not just a signed contract.
The Competition and Markets Authority can act on unfair commercial practices online, including hidden advertising, and has published guidance on influencer marketing.
A written disclosure policy, a data protection impact assessment and a named ethics owner are the three controls that most reduce risk.

Why B2B influencer marketing rules and ethics matter now

B2B influencer marketing has moved from novelty to standard practice. Buyers in software, professional services and industrial sectors now follow named experts, analysts and practitioner creators. That shift brings commercial value and legal exposure. A recommendation from a trusted expert can influence a six-figure contract, so the same rules that apply to consumer advertising apply here.

The regulatory framework is not new. It is under-used in B2B. The Advertising Standards Authority enforces the CAP Code across paid promotion, including LinkedIn posts and newsletter placements.

The Competition and Markets Authority has taken an interest in online commercial practices since its 2021 guidance on hidden advertising. The Information Commissioner's Office polices how you collect and use creator and audience data.

Ethics sit alongside law. A campaign can be legal and still damage trust. The Chartered Institute of Marketing's code of professional conduct sets expectations around honesty, transparency and conflicts of interest. For B2B brands, reputational damage is slower and more expensive than a fine.

Employee advocacy is often where B2B teams first meet these rules. When staff post about their employer's product, the audience may not realise the relationship exists. Saying plainly that the person works for the brand removes the doubt. Asking staff to post without that context is the mistake to avoid.

The disclosure rule in plain terms

CAP Code rules 2.1 and 2.3 require marketing communications to be obviously identifiable as such and their commercial intent to be clear where it is not obvious from context. The ASA and CAP's Influencers' guide to making clear that ads are ads explains how this applies to influencer content. A label such as "Ad", "Paid partnership" or "Sponsored" works. A hashtag buried after twenty other tags does not.

For B2B, disclosure applies to LinkedIn posts, videos, podcasts, webinars and newsletter features. If money, free access, event tickets or any other benefit changes hands, the audience should know. The same principle applies when a creator is an employee or a long-term ambassador.

Gifting is a grey area. An unsolicited product with no conditions may not require a label, but if the creator is expected to post, it does. The test is control and incentive, not the size of the payment. A clear internal rule is simpler than a case-by-case debate.

Our guide to B2B influencer marketing disclosure policy sets out how to write labels, train creators and keep records that satisfy both the CAP Code and procurement teams.

Where the CMA and ASA overlap

The Consumer Protection from Unfair Trading Regulations 2008 were the consumer-law framework for unfair commercial practices; consumer unfair-commercial-practices rules now sit under the Digital Markets, Competition and Consumers Act 2024. The Business Protection from Misleading Marketing Regulations 2008 (BPRs) are the key UK rules for misleading advertising directed at businesses. The CMA's guidance, Social media endorsements: being transparent with your followers, addresses endorsements and disclosure. Whether someone is acting as a consumer or a business can depend on the context.

The Advertising Standards Authority handles the CAP Code, which covers paid marketing communications. The two bodies coordinate. A complaint can start with the ASA and end with the CMA if the practice is widespread.

The practical implication for B2B is simple. Do not rely on a platform's own branded content tools alone. The platform label may satisfy the platform, but it does not automatically satisfy the CAP Code or consumer law. You need your own disclosure standard.

Our overview of B2B influencer marketing UK regulations in England explains how the England, Scotland, Wales and Northern Ireland positions differ for advertising and data.

Data protection, consent and ethics in creator programmes

Lawful bases for creator and audience data

Any B2B influencer programme processes personal data. That includes creator contact details, audience analytics, engagement records and payment information. The Data Protection Act 2018 sits alongside the UK GDPR and requires a lawful basis for each processing activity.

For creator outreach, legitimate interests is often the most practical basis, but it must be balanced and documented. For non-essential cookies or similar technologies, regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR) generally requires consent before storing or accessing information on a device; UK GDPR governs any related personal data processing. For payments, contract is the basis. Do not use one basis for everything.

Data minimisation matters. Collect only what you need. If you are measuring campaign performance, aggregate where possible. If you are building a creator CRM, set retention periods and delete inactive records.

Accountability is the part an auditor checks first. Write down the lawful basis, the retention period and who approved the processing. A one-page record for each campaign is usually enough, and it makes a subject access request far quicker to answer.

Our detailed guide to B2B influencer marketing data protection covers lawful bases, retention and international transfers in more depth.

Direct marketing to creators and their audiences

The Privacy and Electronic Communications Regulations 2003 (PECR), particularly regulation 22, govern unsolicited direct marketing by electronic mail. The ICO's Guidance on direct marketing using electronic mail explains that marketing emails to individual subscribers generally require consent, unless a limited soft opt-in applies. The soft opt-in is narrow. It applies where you obtained the contact details in the course of a sale or negotiations, and you are marketing similar products.

PECR distinguishes individual from corporate subscribers. Prior consent is generally required for unsolicited marketing emails to individual subscribers, including sole traders and some partnerships, unless the soft opt-in applies. Unsolicited B2B emails to corporate subscribers do not generally require consent under PECR, but the sender must identify itself and provide a valid opt-out. Check the recipient type and channel before outreach; a platform's own messaging system is not automatically outside the rules.

The same rules apply to your newsletter and to any list you build from campaign activity. Buying a list is never a lawful basis. Renting a list from a publisher requires careful contracting and a clear lawful basis.

Consent has to be recorded rather than assumed. Keep the source, the date and the wording the person agreed to, because the ICO expects you to evidence it. If a creator withdraws consent, stop the marketing and log the change.

Ethics beyond the minimum

Ethics in B2B influencer marketing goes beyond disclosure and data. It covers how you select creators, how you brief them and how you handle disagreements. The CIM code of professional conduct expects marketers to act with integrity, maintain professional competence and avoid conflicts of interest.

In practice, that means paying creators fairly and on time. It means not pressuring a creator to remove a negative comment or to hide a sponsorship. It also means being straight about what a campaign can achieve, and correcting errors quickly when they happen.

Ethical programmes also consider audience vulnerability. B2B audiences are usually professionals, but they can still be misled by exaggerated claims. A claim that a software tool "guarantees" a result is a problem under both advertising rules and professional conduct.

Building a compliance process that survives scrutiny

A scoring rubric for campaign risk

Use this rubric before you brief a creator. Score each row from 1 to 5, where 1 is low risk and 5 is high risk. Total the scores. A total above 15 means you need legal review before launch.

Campaign risk score decision

Total score above 15?

Yes

Legal review before launch

Proceed and document score

Risk scoring rubric

Risk area

Disclosure clarity: Label above fold
Payment type: Fixed fee
Data processing: Aggregated analytics
Creator status: Employee or contractor
Claim type: Opinion or experience
Audience: Business professionals

Low risk (1)

Disclosure clarity: Label in caption
Payment type: Fee plus bonus
Data processing: Named contact data
Creator status: Long-term ambassador
Claim type: Comparative claim
Audience: Mixed business and consumer

Medium risk (3)

Disclosure clarity: No label
Payment type: Pure commission
Data processing: Sensitive data
Creator status: Undisclosed shareholder
Claim type: Health or financial claim
Audience: Vulnerable consumers

High risk (5)

Disclosure clarity
Payment type
Data processing
Creator status
Claim type
Audience

Score each row. Add the total. Document the score and the decision. This creates an audit trail that satisfies both internal governance and regulator enquiries.

Contracts, records and review

Your contract with a creator should cover disclosure wording, approval rights, data protection obligations, payment terms and termination. It should also state who owns the content and what happens after the campaign. A clear contract reduces the risk of a dispute and makes compliance easier to evidence.

Records matter. Keep a copy of the brief, the approved disclosure label, the published post and the performance data. Retention periods should be set and followed. If the ASA or CMA asks questions, you want to answer with documents, not memory.

Training is the cheapest control available. A short briefing on labels, claims and escalation costs far less than one corrective campaign. Give creators a named contact for questions, and ask them to confirm the disclosure wording in writing before the first post goes live.

Our guide to B2B influencer marketing advertising rules covers the specific CAP Code sections and the evidence you need for comparative claims.

Review your programme every quarter, not once a year. Rules, platforms and creator behaviour change.

A quarterly check of published labels, consent records and complaint logs catches most problems while they are small enough to fix with a quiet word to the creator. Bring the rubric score to the meeting, so discussion starts from evidence, not opinion.

Decide now what happens when a label is missed. The usual response is to ask the creator to correct the post within a set time, and to pause further payments until it is fixed. Log the incident, the correction and the date. A pattern of misses is what turns a single complaint into an enforcement case.

Start with a disclosure policy, a data protection assessment and a named ethics owner. Then test the process on a low-risk campaign before scaling. Our guide to B2B influencer marketing trends and outlook explains how compliance expectations are shifting as the creator economy matures.

Common questions

Does the CAP Code apply to B2B influencer marketing?

Yes. The CAP Code applies to paid marketing communications directed at UK audiences, including business audiences. If a creator receives payment or any other incentive to promote a product or service, the communication must be obviously identifiable as an advertisement. The ASA enforces this across social media, podcasts and newsletters.

What is the lawful basis for emailing a creator about a campaign?

The ICO's direct marketing guidance says electronic mail marketing to individuals generally requires consent. The soft opt-in is narrow and usually does not cover cold outreach to creators who have never bought from you. Legitimate interests may apply in limited cases, but you must document a balancing test. Consent is the safer route for most programmes.

Do I need a written contract with every creator?

There is no single legal requirement for a written contract in every case, but a written agreement is strong evidence of compliance. It should cover disclosure, data protection, payment and termination. Without it, you may struggle to show that you controlled the campaign or that the creator understood their obligations.

How do I handle a creator who refuses to disclose?

Do not publish the content. A refusal to disclose is a red flag. If the creator has already posted without a label, ask them to add one at once. If they refuse, pause the campaign and take advice.

The Federal Trade Commission's reports concern US law and do not establish UK requirements. For UK campaigns, use the CAP Code, PECR, BPRs and applicable consumer-protection rules.

This article is general guidance only. It is not legal advice. Individual campaigns, contracts and data processing arrangements need a qualified adviser.

External sources: Data Protection Act 2018, Competition and Markets Authority - GOV.UK, Guidance on direct marketing using electronic mail | ICO, Code of Professional Conduct | CIM, Reports | Federal Trade Commission.