Rules and ethics
Part of Landing page software rules and ethics: a UK review guide
Landing page software UK regulations: map by event
A practical map of landing page software UK regulations: match ads, forms, checkouts and regulated offers to UK rules, evidence and release checks.
Landing page software UK regulations cannot be reduced to one checklist. A brochure, lead form, consumer checkout and medicine promotion may use the same builder while raising different questions. No landing-page software implies a tool-specific duty; the duty sits with the advertiser, controller or seller as the facts decide.
This scope map gives general information, not legal advice. It cannot establish compliance, and the actual page must receive named UK legal and specialist review before publication.
What to take away
- The page event decides which UK regulation applies, not the software used to build it.
- CAP and ASA rules cover advertising, while UK GDPR and PECR apply across the whole UK.
- The Data (Use and Access) Act 2025 amends rather than replaces the UK GDPR, Data Protection Act and PECR.
- DMCC unfair commercial practices provisions apply from 6 April 2025, but subscription rules are expected in spring 2027.
- A failed or unresolved specialist gate stops release of the landing page.
Match each page event to its authority
| Page event | Authority and territory | Evidence to hand over |
|---|---|---|
| Non-broadcast advertising | CAP Code and ASA system within their UK remit | Acquisition message, rendered page, claims and qualifications |
| Personal-data collection | UK GDPR and Data Protection Act 2018, applying across the UK subject to their scope | Purpose, fields, source, roles, basis, recipients, retention and rights |
| Device storage or access | PECR across the UK | Technology inventory, purpose, setting, information and choice record |
| Consumer invitation to purchase | DMCC Act unfair-commercial-practices provisions for UK consumer transactions in scope | Seller, product, total price, terms and transaction path |
| Service to the public | Equality Act 2010 in Great Britain, with England in scope | Delivered journey, barriers, adjustments and direct test evidence |
| Regulated offer | Relevant product and sector regime | Product status, audience, permissions and specialist approval |
The CAP Code rule 2.1 requires marketing communications to be obviously identifiable within the Code's remit; rules 3.1 and 3.3 address misleading claims and material omissions. That is separate from whether direct marketing is permitted or whether data processing has a lawful basis.
Page event to authority map
Page event
- Non-broadcast advertising
- CAP Code, ASA
- Personal-data collection
- UK GDPR, DPA 2018
- Device storage or access
- PECR across UK
- Consumer invitation
- DMCC Act, UK consumers
- Service to the public
- Equality Act 2010, GB
- Regulated offer
- Product and sector regime
Authority and territory
- Non-broadcast advertising
- Message, page, claims
- Personal-data collection
- Purpose, fields, basis, rights
- Device storage or access
- Tech inventory, choice record
- Consumer invitation
- Seller, price, terms, path
- Service to the public
- Journey, barriers, adjustments
- Regulated offer
- Status, audience, approval
Evidence to hand over
- Non-broadcast advertising
- Personal-data collection
- Device storage or access
- Consumer invitation
- Service to the public
- Regulated offer
Apply the map in the page builder
For each event, record the relevant page version, campaign or form configuration, evidence, owner and release decision. Configure the page so that the evidence can be retrieved later; a general supplier statement is not a substitute for the live page and its settings.
- Ad and claim:CAP Code rule 2.1 requires marketing communications to be obviously identifiable; rules 3.1 and 3.3 address misleading claims and material omissions. Keep the ad, landing-page variant, claim substantiation and any qualifications together for review by the advertiser and, where needed, the ASA system.
- Form and email marketing:The UK GDPR and Data Protection Act 2018 govern personal-data processing. PECR regulation 22 governs unsolicited direct-marketing email; use consent or the existing-customer exception only where its conditions are met. Keep the form fields, privacy notice, purpose, lawful-basis record and marketing choice together. Do not treat submitting an enquiry as permission for unrelated marketing.
- Cookies and tracking:PECR regulation 6(2) requires consent for storing information on, or accessing information from, a user's device, subject to the regulation 6(4) exceptions. The ICO's Cookies and similar technologies guidance explains the consent requirements, and its published cookie enforcement position is relevant when reviewing a banner. Configure the banner to distinguish cookie categories and retain evidence of the choice and consent state.
- Controller fee check:Under the Data Protection (Charges and Information) Regulations 2018, a controller must pay the ICO data protection fee unless an exemption applies. Check the ICO's register of fee payers and record the payment or exemption decision.
- Consumer checkout:The Digital Markets, Competition and Consumers Act 2024, Part 4, Chapter 1 covers unfair commercial practices. Keep the offer, price, recurring-charge information and material conditions visible at the point of choice, and retain the checkout version and order evidence. Do not describe the Act's subscription-contract rules as already in force: the stated expectation is spring 2027.
- Regulated offer:For a financial promotion, check section 21 of the Financial Services and Markets Act 2000 (FSMA) and the Financial Conduct Authority (FCA) rules. For gambling, check the Gambling Act 2005 and Gambling Commission requirements. For medicine promotion, check the Human Medicines Regulations 2012 and Medicines and Healthcare products Regulatory Agency (MHRA) rules; advertising prescription-only medicines to the public is prohibited. Record the applicable regime and obtain the relevant specialist sign-off before release.
- Age assurance and accessibility:The Online Safety Act 2023 and Ofcom requirements may apply where the page is part of an in-scope regulated service; a standalone landing page is not automatically in scope. For covered public-sector bodies, the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 require accessibility to WCAG 2.1 AA. The Equality Act 2010 service-provider duties also need consideration in Great Britain.
Worked example: a lead form collects name, email and phone for a newsletter. The page event is personal-data collection, so UK GDPR applies, and PECR applies to any device storage on the page. Evidence: form fields, notice text, lawful-basis record, retention period and rights route. Owner: the data protection lead, who signs off before release.
Territory and audience must stay visible throughout the map, and CAP and ASA material concerns advertising within that system's remit.
Data protection and PECR are UK-wide frameworks. The cited Equality Act service duties cover Great Britain. In England, local authority trading standards enforce consumer protection and can act on misleading landing pages.
A page accessible outside England may also encounter other legal regimes; record intended and actual reach, but do not assume a location selector prevents access or settles jurisdiction.
Record the current legal status
The Data (Use and Access) Act 2025 changed the UK data-protection framework. The ICO's organisation overview was updated on 19 June 2026 to state that all its data-protection provisions were in force. It also says the Act amends rather than replaces the UK GDPR, Data Protection Act and PECR.
The ICO's controller and processor guidance is among the pages still marked under review. Keep that warning in the source record and recheck it on publication day. A supplier contract label does not decide the factual role.
The consumer position also needs dates. The Competition and Markets Authority (CMA) says the Digital Markets, Competition and Consumers Act 2024 unfair-commercial-practices provisions apply to practices from 6 April 2025 in its guidance updated on 18 November 2025. By contrast, an April 2026 CMA update described subscription-contract rules as expected in spring 2027. Do not present that expectation as a rule already in force.
Keep the gates separate
Assign one owner to each question: advertising impression; privacy and lawful basis; PECR tracking and messages; consumer choice and charges; accessibility; security; IP and asset licences; supplier terms; and sector restrictions. Each owner should record the source, jurisdiction, update date, fact pattern and result. Name the specialist reviewer for any regulated offer and record that reviewer's decision in the release record.
A failed or unresolved specialist gate stops release. Recheck legislation, regulator guidance, commencement status and the rendered page immediately before publication. The useful output is a scoped evidence pack, not a claim that the software or this map has made the page lawful.
Before you act
- Map the page event before choosing any rule.
- Record territory, audience and actual reach.
- Check the legal status and update dates.
- Assign one owner to each separate gate.
- Recheck guidance and the rendered page before publication.
- Do not treat supplier contract labels as deciding factual roles.
Common questions
Why does the page event matter more than the software?
The map above shows the rule, evidence and owner for each page event. A builder can host a lead form or a checkout, and those events do not share one checklist.
What changed under the Data (Use and Access) Act 2025?
The Act amended the UK data-protection framework. The ICO overview of 19 June 2026 states that its data-protection provisions were in force, and that the Act amends rather than replaces the UK GDPR, Data Protection Act and PECR. The ICO's controller and processor guidance still carries a review notice.
When do the DMCC unfair commercial practices provisions apply?
The CMA says they apply to practices from 6 April 2025, in guidance updated on 18 November 2025. Subscription-contract rules are expected in spring 2027, not in force.
Official sources:
