Landing page software rules and ethics: a UK review guide

Landing page software rules and ethics are not a single setting. A team operating in England must examine the configured page, acquisition route, offer, audience, data flow and supplier relationship under several separate regimes. A consent banner cannot clear an advertising claim. A sound processor clause cannot fix an inaccessible form.

This guide gives general legal and operational information, not advice on any case. It was researched on 6 September 2026. Legal and regulatory positions change, so check the current sources and the actual facts for your own page.

What to take away

A consent banner cannot fix a misleading advertising claim or an inaccessible form.
Record the acquisition advert and landing page together, because the overall impression decides compliance.
PECR tracking rules apply separately from any UK GDPR lawful basis you document.
Do not treat the new subscription rules as live; the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 still apply until the new regime is expected in spring 2027.
An accessible editor does not guarantee an accessible published page, so test the live journey.

Start with the page event

Write down what the visitor sees before arrival, what the landing page asks them to do and what happens next. The same builder can host a simple information page, a lead form, an invitation to purchase or a regulated-product promotion. Those are different legal and evidential events.

The file should identify:

the legal entity publishing the page and any other seller;
the destination URL, version, audience and territory;
the acquisition message and whether it is advertising or direct marketing;
every claim, qualification, review and commercial relationship;
each data field, tracking technology, recipient and retention route;
the product, charge, renewal, cancellation and complaint path;
the supplier edition, sub-processors, contract and exit route.

Do not use this inventory as a certificate. Its purpose is to give each qualified reviewer the same evidence.

Advertising claims and overall impression

The UK CAP Code applies to non-broadcast marketing communications within its remit. The ASA's misleading advertising guidance says objective claims need substantiation and the overall impression matters. A true statement can still mislead if context, imagery or omitted conditions change the likely interpretation.

Review the acquisition advert and destination together. The headline, hero image, form label, call to action and nearby small print all affect the impression. CAP's guidance on claims that require qualification explains that a qualification should clarify rather than contradict and may need greater prominence when it materially affects understanding.

Keep a claim record containing the exact wording, evidence, product or service scope, geography, date, owner and expiry. If the evidence no longer supports the live wording, the withdrawal owner should be able to pause every connected advert and page version.

Recognition, reviews and commercial relationships

Marketing should be recognisable in its context. Section 2 of the CAP Code requires marketing communications to be obviously identifiable and addresses commercial intent and advertorials. A disclosure hidden in terms or placed after the call to action may not repair the first impression.

Testimonials create a separate evidence job. CAP Executive advice dated 31 July 2026 on testimonials and endorsements covers documentary evidence, relevance, permission and material commercial interests. It expressly says the advice is not legal advice and does not bind the ASA or CAP. Preserve the source, permission, original context and relationship instead of copying a favourable line into a builder.

Consumer-facing pages: the Digital Markets, Competition and Consumers Act 2024 unfair-commercial-practices provisions have applied to practices from 6 April 2025. The CMA's guidance, last updated 18 November 2025, covers misleading actions, omissions and banned practices, including fake reviews, in its current unfair commercial practices record.

A business-to-business page requires its own legal analysis rather than an automatic transfer of the consumer test.

Privacy and data protection

A page that handles identifiable contact details, online identifiers or behavioural records needs a processing map. The 2025 DUAA changed parts of the existing UK GDPR, Data Protection Act 2018 and PECR framework instead of displacing those instruments. The ICO updated its DUAA overview for organisations on 19 June 2026 to say that all data-protection provisions were then in force.

UK GDPR Article 6 sets out the lawful bases, Article 7 sets conditions for consent, and Article 13 requires privacy information to be given to individuals. For each purpose, record the fields, source, individual, recipient, retention, rights route and proposed lawful basis. The ICO's lawful-basis guide was updated on 2 April 2026 for DUAA amendments. It does not select a basis for a landing page. A team must decide and document the basis before processing, then revisit it if the purpose changes.

Identify the real roles from decisions and conduct. Calling a platform a processor in a contract does not settle the matter. The ICO's detailed controller and processor material is marked under review following the DUAA. That status and the publication-day position should be recorded beside any reliance on it.

PECR for tracking and electronic messages

PECR questions remain even if the same activity has a UK GDPR basis. PECR regulation 6 covers storing information or gaining access to information stored on a user's device. The ICO finalised its storage and access technologies guidance on 29 April 2026 after consultation and DUAA changes.

It covers pixels, link decoration and device fingerprinting beyond familiar cookies. Inventory the technology and purpose actually deployed, including supplier defaults and tags loaded through other scripts.

If the page feeds an email, text or similar promotional sequence, classify the message and subscriber population separately. The ICO updated its electronic-mail marketing guidance on 28 April 2026, including the new charitable soft opt-in. That specific change does not create a general soft opt-in for every organisation or list.

The current ICO direct-marketing collection still flags some material as under review after the DUAA. Cite the exact sub-page used and repeat the legal check on publication day.

Consumer choice, prices and subscriptions

Consumer-facing purchase pages need a separate choice and transaction review. The CMA's price-transparency guidance, published in November 2025 and updated on 7 January 2026, addresses mandatory fees, taxes, charges, drip pricing and partitioned pricing. The reviewer should see the full route from acquisition message to payment confirmation, not a screenshot of the first price.

Do not state that all provisions for the newer subscription-contract regime already operate. Until the new regime commences, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 govern paid subscriptions sold to consumers. They require pre-contract information, including the total price and cancellation terms, and give a 14-day cancellation right unless an exception applies. In its April 2026 update, the CMA said new subscription rules were expected in spring 2027, with guidance from the Department for Business and Trade. The Digital Markets, Competition and Consumers Act 2024 contains those subscription-contract provisions, including auto-renewal reminder and exit requirements.

That is an announced expectation, not an effective date. Check commencement legislation and final guidance immediately before publication or launch.

Separate consumer sales from a business buying landing-page software. The contracting party, use and transaction determine which consumer rules may apply.

Accessibility and equality

An accessible output is not guaranteed by an accessible editor. The Equality Act 2010 applies in England within its Great Britain framework, while Northern Ireland has different legislation. Its current text contains the reasonable-adjustment duty in section 20 and service-provider provisions in section 29. Public sector bodies also face the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018, with the Equality and Human Rights Commission as an enforcement route. The precise duty, disadvantage and reasonable step depend on the service and facts.

Use direct testing of the published page, form errors, keyboard route, zoom, content and recovery path. WCAG 2.2 is a global technical standard and useful test reference. It is not, by itself, a legal conclusion or proof that a live journey is accessible.

Security and operational control

Security depends on both supplier controls and customer configuration. NCSC guidance for using SaaS securely asks organisations to understand the application, users, data and security needs before configuration. Map privileged access, publishing authority, domains, integrations, secrets, logs, backups, incident contacts and recovery evidence.

The ICO's security outcomes guidance is currently marked under review because of the DUAA. It still describes risk-based technical and organisational measures, but a reviewer must confirm the current position and apply it to the actual processing.

Intellectual property

Templates, images, typefaces, code, testimonials and customer logos may carry separate rights and licence conditions. The Intellectual Property Office's copyright collection, last updated in December 2023, provides routes for ownership, licensing, exceptions and notices. It does not clear a particular asset.

The release record should link every third-party asset to its source, owner, licence, territory, term, permitted edits and evidence holder. Generating or importing an asset through software does not establish that the publisher has the needed rights.

Supplier and commercial contracts

Record the supplier's legal party, exact service and edition before reading the terms. Price needs currency, VAT status, unit, billing period, minimum term, usage limits and renewal. Service description and acceptance should match the working configuration. Then examine change rights, support, liability, termination, export, deletion and continuity.

Data terms need factual role analysis. The ICO says a controller using a processor must have a written contract or other binding arrangement under Article 28, but its controller-processor contracts guidance is marked under review after the DUAA. Qualified counsel should check the live text, sub-processor route and instructions.

Where personal information crosses the UK boundary, the ICO's international-transfers guide was updated on 15 January 2026. Hosting location alone may not answer every access or transfer question. Map the real recipients and routes.

Regulated-sector overlays

A general landing-page review cannot clear a regulated offer. The FCA explains that financial promotions can include websites and that product-specific rules may apply in its financial promotions and adverts record, last updated in May 2024. The MHRA's medicines advertising guidance, updated in April 2025, distinguishes audiences, product status and territories.

Other sectors may add licensing, age, safeguarding or professional rules. Name the product, audience and regulator, then route the final page to a specialist with current authority. Do not infer permission from a generic disclaimer.

Publication-day decision record

Before release, save the rendered page and acquisition message with their evidence. Record each review as pass, fail or unresolved. A pass in one area cannot offset a failure elsewhere.

Recheck the source status, guidance update date, commencement provisions, supplier edition and configured technologies on publication day. Assign one person authority to stop publication and another to preserve the withdrawn version. Keep the decision record with the rendered page and evidence.

Before you act

Write down the page event before arrival, on arrival and after.
Keep a claim record with exact wording, evidence, owner and expiry.
Map each data field, purpose, recipient and retention route.
Inventory every tracking technology actually deployed, including supplier defaults.
Review the full route from acquisition message to payment confirmation.
Test the published page directly, including keyboard route and form errors.

Common questions

Can a consent banner make a landing page compliant?

No. The text says a consent banner cannot clear an advertising claim, and a sound processor clause cannot fix an inaccessible form. A team must examine the configured page, acquisition route, offer, audience, data flow and supplier relationship under several separate regimes.

When are the new UK subscription rules expected to apply?

In an official April 2026 update, the CMA said the new subscription rules were expected in spring 2027, with guidance from the Department for Business and Trade. That is an announced expectation, not an effective date. Check commencement legislation and final guidance before launch.

Does WCAG 2.2 prove that a landing page is legally accessible?

No. WCAG 2.2 is a global technical standard and a useful test reference, but it is not by itself a legal conclusion or proof that a live journey is accessible. The Equality Act 2010 duties depend on the service and the facts, so test the published page directly.