Rules and ethics
Part of Marketing attribution rules and ethics: UK checks
Marketing attribution UK regulations, flow by flow
Trace marketing attribution UK regulations through a tag, a server-side event, a follow-up email and a published claim, and see which rule each meets first.
What to take away
- Follow one data flow at a time and name the rule it meets first.
- A browser tag meets PECR regulation 6 before any question about reports.
- A server-side event that holds personal data falls under UK GDPR, with transfer checks where data leaves the UK.
- A follow-up email is a separate regulation 22 question.
- A published result is an advertising claim and needs evidence before publication.
- One cleared flow does not clear the others.
Trace each flow, not the software name
Marketing attribution UK regulations depend on the configured data flow and the proposed claim, not the software name. Trace each flow separately, because a browser tag, a server-side event, a follow-up email and a published result each meet a different rule first.
| Flow | First rule it meets | Regulator | Question to settle |
|---|---|---|---|
| Browser tag, pixel or script | PECR regulation 6 | ICO | Is the storage or access strictly necessary for a service the user requested? |
| Server-side event or upload holding personal data | UK GDPR and Data Protection Act 2018 | ICO | Which Article 6 basis covers the purpose, and does data leave the UK? |
| Modelled result that drives a decision about a person | UK GDPR Article 22 | ICO | Is the decision solely automated, with legal or similarly significant effects? |
| Follow-up email | PECR regulation 22 | ICO | Is the recipient an individual subscriber, and did consent or the soft opt-in apply? |
| Result used in an advert | CAP Code and ASA substantiation guidance | ASA | Is there evidence for the objective claim before publication? |
| Consumer-facing page or interface | Digital Markets, Competition and Consumers Act 2024 | CMA | Does any practice count as unfair? |
Record the people, territories and devices each flow touches before choosing a row. UK GDPR, the Data Protection Act 2018 and PECR are UK-wide, not England-only regimes, but the location of people, organisations and recipients can still affect territorial scope. The wider framework sits in the rules and compliance guide.
The browser tag or pixel
A tag meets PECR regulation 6 first. The rule can apply when a tag, pixel, script or similar technology stores information on, or accesses information from, terminal equipment. Non-exempt storage or access requires valid consent.
A checkout function may qualify only if strictly necessary to provide the requested service. Cross-site advertising profiles and ordinary attribution analytics are not exempt merely because they are first-party or aggregated. How tracking works without cookies is covered in cookieless attribution.
The ICO's guidance on storage and access technologies sets out what PECR says about them. Assess each technology's function and purpose, not its label, because two scripts on one page can fall on opposite sides of the line.
The server-side or modelled event
Moving collection to the server does not remove UK GDPR when the event holds personal data. Name an Article 6 basis for each purpose: consent, contract, legal obligation, vital interests, public task or legitimate interests.
Legitimate interests requires a purpose, necessity and balancing assessment. DUAA-recognised legitimate interests are limited public-interest purposes such as national security, public security, defence, emergency response, crime prevention and safeguarding vulnerable people. They are not a general marketing basis. The data fields themselves are mapped in personal data and device tracking.
Screen for an Article 35 DPIA before likely high-risk processing, including extensive automated evaluation with significant effects or large-scale special-category data. Controllers generally must register with the ICO and pay the data protection fee unless exempt.
For restricted transfers outside the UK, use UK adequacy regulations or safeguards such as the International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses. Complete a transfer risk assessment (TRA), and keep the terms with the supplier contract.
A modelled result becomes an Article 22 question only when it drives a decision. UK GDPR Article 22 concerns solely automated decisions with legal or similarly significant effects, not profiling alone. Human-reviewed attribution reports are not automatically covered, but automated eligibility or pricing decisions may be.
DUAA safeguards for such decisions include information, representations, human intervention and the right to contest. Additional limits apply to special-category data.
The follow-up email
Regulation 22 governs the message, not the measurement behind it. For individual subscribers it requires prior consent for direct-marketing electronic mail unless the soft opt-in applies.
The soft opt-in is limited to the sender's own similar products or services where contact details were obtained during a sale or sale negotiations. An opt-out must have been offered when the details were collected and in every message, and the recipient must not have opted out.
Corporate subscribers do not need consent under regulation 22, but messages must identify the sender and offer an opt-out. Data protection rules still apply to personal data. Permission to communicate is not permission to measure.
The published result
A result that supports an advert becomes an advertising claim. ASA and CAP's substantiation guidance requires evidence for objective claims before publication.
Preserve the method, population, period, model, exclusions and uncertainty. Platform credit, modelled estimates and causal lift must be described differently. A fuller check sits in advertising claim rules.
Consumer-facing interfaces and representations may also need review under the CMA's unfair commercial practices guidance and the Digital Markets, Competition and Consumers Act 2024, which cover practices from 6 April 2025. Neither a CAP check nor a privacy approval clears the other.
What the Data (Use and Access) Act changed
The Data (Use and Access) Act 2025 amended data protection and PECR, so each provision needs its own status. The ICO's DUAA guidance, updated on 19 June 2026, says all data protection provisions in the Act are now in force.
The PECR amendments are not in force, and commencement regulations must set their start date. Until they do, apply the existing PECR rules and exceptions, including the regulation 6 and regulation 22 tests above.
One retail campaign, five questions
Take a retailer that runs one campaign across several flows. Each step below gets its own reviewer and its own decision.
- The checkout script keeps the basketa regulation 6 question, which may be answered by strict necessity.
- The analytics tag builds a cross-site profilevalid consent is needed, whatever the first-party label.
- The purchase event goes server-side to a supplier outside the UK: an Article 6 basis, transfer safeguards and a TRA.
- A discount email followsregulation 22, with the soft opt-in only if every condition is met.
- The campaign report becomes an advert claimevidence must exist before publication.
Also assess security, accessibility, intellectual property, employment monitoring, tax and any regulated sector. Their application depends on the facts of the operation. Unknown is a valid result and keeps the activity on hold until resolved, as in a launch review.
Verify the law on the day of publication with qualified legal, privacy, PECR, advertising, contracts, security and accessibility reviewers. This is not legal advice.
Before you act
- List every flow in the operationtag, server event, email, claim.
- Name the first rule each flow meets.
- Record the Article 6 basis for each purpose that uses personal data.
- Check restricted transfers, safeguards and the TRA.
- Confirm the DUAA status of each provision you rely on.
- Hold any flow whose applicability is unknown.
Common questions
Which UK rule does a browser tag meet first?
PECR regulation 6. It can apply when a tag, pixel or script stores or accesses information on terminal equipment, and non-exempt use requires valid consent.
How do PECR rules differ from UK GDPR rules for an attribution operation?
PECR adds separate requirements. Regulation 6 governs terminal-equipment storage and access, while regulation 22 governs direct-marketing electronic mail and its limited soft opt-in. Permission to communicate is not permission to measure.
Does one cleared flow clear the others?
No. Neither a CAP check nor a privacy approval clears the other. Each flow gets its own reviewer and decision, and unknown means hold.
