Rules and ethics
Part of Privacy first measurement rules: five decisions before you launch
What fires before a person chooses? Advertising measurement checks before release
Advertising measurement checks should cover permission, ad identification, evidence, modelled results and consumer disclosures before release in England.
Use this privacy first measurement advertising rules checklist before an advert or campaign report is released. It keeps three approvals apart: permission for storage or access, lawful handling of personal information, and the truth and visibility of the marketing communication.
The operating example is England. ICO guidance and the consumer-protection framework cited here have UK reach. The CAP Code applies within its stated non-broadcast remit. Broadcast advertising and sector-specific products may need other rules. Evidence pages were reviewed on 5 September 2026; no campaign was tested.
What to take away
- Storage and access technologies for online advertising require consent under PECR, including associated tracking and profiling.
- Advertising measurement intrinsically linked to an advertising purpose does not need a second consent.
- A platform's consent-mode status is not legal clearance; the organisation remains responsible for real collection and use.
- Marketing communications must be obviously identifiable, and advertorials must be made clear under the CAP Code.
- Objective advertising claims need documentary evidence before publication, and consumer law adds a separate statutory layer.
1. Record what fires before a person chooses
- List every cookie, pixel, script, SDK, local-storage operation and fingerprinting technique.
- Capture network behaviour when permission is granted, refused, withdrawn and unavailable.
- Write the purpose beside each device operation instead of calling the whole set "analytics".
The ICO states in its online-advertising guidance that storage and access technologies used for online advertising require consent, including associated tracking and profiling. Advertising measurement does not need a second consent when it is intrinsically linked to that advertising purpose. That does not mean the original permission can be vague or that unrelated reuse is covered.
Record pre-choice device activity
- List cookies, pixels, scripts, SDKs, storage
- Capture network behaviour when permission granted
- Capture behaviour when permission refused
- Capture behaviour when permission withdrawn
- Write purpose beside each device operation
2. Trace personal information through the chain
- Identify each controller, joint controller, processor, recipient and onward recipient from actual conduct.
- Document the UK GDPR purpose and lawful basis separately from the PECR decision.
- Confirm how withdrawal and other relevant rights reach every party.
Do not treat a platform's consent-mode status as legal clearance. It may communicate a setting, but the organisation remains responsible for the real collection, sharing and use.
Trace personal data through the chain
- Identify controller from actual conduct
- Identify joint controller and processor
- Identify recipient and onward recipient
- Document UK GDPR purpose and lawful basis
- Confirm withdrawal reaches every party
3. Mark advertising so the audience knows what it is
- Decide whether the page, post, email or comparison is a marketing communication.
- Place an explicit label where a person sees it before engaging if the commercial nature is not obvious.
- Disclose payment, commission, gifts, ownership or editorial control that affects the communication.
The CAP Code recognition section requires marketing communications to be obviously identifiable and advertorials to be made clear. A privacy notice does not perform that job. It explains data use; it is not an advertising label.
4. Build a file for every claim
- Connect each number and comparison to dated underlying evidence.
- State the population, period, denominator, exclusions and uncertainty beside the result.
- Distinguish observed events, attributed credit, modelled values and causal evidence.
- Remove words such as "anonymous", "compliant" or "proven" unless the precise claim is substantiated.
The CAP Code rules on misleading advertising cover material misleading impressions and omitted information. They also require documentary evidence for objective claims before publication. A technical report should therefore preserve the source calculation, configuration and reviewer, not only a screenshot of the final figure.
5. Check the consumer decision
- Ask what a typical customer is likely to understand from the whole presentation.
- Put limitations where they affect the choice, not behind an unrelated footer link.
- Verify that testimonials, reviews and incentives are genuine and disclosed.
The CMA's unfair commercial practices guidance covers business-to-consumer practices from 6 April 2025 under the Digital Markets, Competition and Consumers Act 2024. It includes misleading actions, misleading omissions and prohibited practices. This is a statutory consumer-law layer, distinct from CAP's advertising code and from privacy law.
6. Name the release authorities
Record the technical tester, data-protection reviewer, claim owner and advertising approver. Add commercial or specialist counsel where the product, audience or contract creates additional risk. Sign-off must state the exact version and date. It should never promise that later configuration changes will remain compliant.
Before you act
- List every cookie, pixel, script, SDK and fingerprinting technique.
- Document the UK GDPR purpose and lawful basis separately from the PECR decision.
- Place an explicit advertising label where a person sees it before engaging.
- Connect each number and comparison to dated underlying evidence.
- Ask what a typical customer is likely to understand from the whole presentation.
- Record the technical tester, data-protection reviewer, claim owner and advertising approver.
Common questions
Does advertising measurement need a second consent?
No, the ICO states that advertising measurement does not need a second consent when it is intrinsically linked to the advertising purpose. However, the original permission cannot be vague, and unrelated reuse is not covered.
Can a platform's consent-mode status be treated as legal clearance?
No. The article warns that a platform's consent-mode status may communicate a setting, but the organisation remains responsible for the real collection, sharing and use of personal information.
What evidence is required for objective advertising claims?
The CAP Code rules on misleading advertising require documentary evidence for objective claims before publication. A technical report should preserve the source calculation, configuration and reviewer, not only a screenshot of the final figure.
