Marketing attribution rules and ethics: UK checks

Marketing attribution rules and ethics start with a configured data journey: a team can have a plausible dashboard and still lack permission to track, a sound basis for using personal data, or evidence for its public claim. Treat release as connected checks, with each approval tied to the configured journey and the exact version of the underlying evidence.

Research closed on 6 September 2026. This is general information, not legal advice. The Data (Use and Access) Act 2025 changed parts of the framework in stages, while some ICO material remains under review. Obtain qualified advice on the actual configuration before deployment or publication.

What must a published attribution claim prove?

Before publication, the wording must create no stronger impression than its supporting evidence can justify. Objective claims need documentary support, and a platform credit, accuracy statement, incremental-lift result or ROI statement does not prove the others. Assess the finished advertisement in context.

Keep each proposed statement beside its evidence label and supporting detail. Review advertising claim requirements against the actual wording, then check sample eligibility, period, geography, missing data, exclusions, model version and uncertainty. A qualification cannot repair a misleading headline or visual, so narrow or remove wording the evidence cannot support.

For UK non-broadcast advertising, CAP Code rule 3.7 requires documentary evidence to be held before publication for claims consumers are likely to regard as objective. Rule 3.1 prohibits materially misleading communications, and rule 3.9 requires qualifications not to contradict the claims they qualify. The Advertising Standards Authority (ASA) administers the CAP Code and handles complaints about ads. Keep the claim, supporting evidence and finished creative together for review.

Worked decision: If the evidence records conversions credited under a platform’s attribution window, a claim that the platform attributed those conversions may be supportable if the wording matches the record and its limitations are clear. That evidence alone does not support a claim that the campaign caused additional sales. Hold or narrow the causal claim unless suitable counterfactual evidence supports it; then assess the final advert under rules 3.1, 3.7 and 3.9.

What did the measurement actually observe?

Start by naming the measured outcome, eligible population, source data, model, recipients and output type. Then classify each result as observed, platform-attributed, modelled or causally estimated; those labels represent different evidence bases, not interchangeable descriptions of a channel's contribution. Record its accountable owner and retention route as well.

List every event and identifier, including whether it arrives through a tag, pixel, upload or broker. Compare an allocation under a platform's settings with a method's ability to establish causation, using the evidence grid and a mix modelling comparison without treating the methods as interchangeable.

Assign a named decision owner and release reviewer to understand what the credit can support and what remains unknown. Their sign-off should follow the claim and evidence together, rather than the software name or a dashboard export alone. This keeps the operational decision visible when the output moves to publication.

Does the technology access information on a device?

Ask whether the configured technology stores information on, or retrieves it from, terminal equipment. PECR regulation 6 covers that device-access question and has statutory exceptions, so the answer depends on the function and context of each technology, not the supplier's chosen label.

ICO material addresses cookies, pixels, scripts, tags and fingerprinting, and identifies exceptions. A first-party label, server-side collection or essential designation does not settle the issue. If personal data is then used, carry out a separate UK GDPR assessment, including the candidate lawful basis.

Because PECR and data protection address separate issues, do not compress them into one consent question. The UK regulations overview can frame the inventory, but reviewers must map configured processing, terminal access and communications to the relevant provisions in each case.

Map each configured activity to its own check. For a cookie, pixel, script or tag, assess whether it stores information on or accesses information from terminal equipment under PECR regulation 6; record the function, firing test and the consent or statutory exception relied on. A server-side event does not settle whether an earlier browser technology accessed the device, so assess that access separately. If personal data is then used, record the UK GDPR Article 6 basis and, where a provider processes on instructions, the Article 28 terms.

For an uploaded or brokered identity match, trace the data’s source and collection route: assess PECR at any relevant device-access point and assess the use of personal data under Article 6. For unsolicited direct marketing by electronic mail, including text messages where applicable, check PECR regulation 22 and retain evidence of consent or the conditions for the soft opt-in. Keep that communication check separate from the tracking assessment.

Where the journey also uses promotional email, text or another stored message, assess electronic direct marketing separately. Permission to contact a person does not itself establish that the accompanying measurement is allowed; record the communication decision and device-access assessment as separate questions.

Who decides why each activity happens?

Determine roles from actual decisions about purposes and essential means, rather than titles in the contract. A buyer may set campaign and measurement purposes while a provider processes on instructions; a provider may also use data for its own purposes, and particular activities can be jointly determined.

Make a separate entry for page measurement, identity matching, advertising activation, model training, customer export, support access and deletion. For each, name the decision maker, whose data is used, fields, recipients and instructions. Compare that activity-level map with the data protection flow review, rather than relying on a contract label.

Processor terms under Article 28 cover instructions, confidentiality, security, sub-processors, assistance with rights, end-of-contract handling and audits. The ICO's controller and processor contract guidance remains under review. It does not settle the wider service bargain or establish the parties' actual roles, so keep the role analysis separate.

How do the 2025 changes affect the review?

Check commencement and wording for the provision relevant to the operation: the Data (Use and Access) Act 2025 took effect in stages, so older guidance may not reflect the current position.

The official Act text remains the legal reference, while the ICO's 19 June 2026 summary says all data protection provisions are in force.

Some ICO guidance displays an under-review notice, including material on controller and processor roles. Record that status, check the legislation and revisit the relevant page on publication day. A regulator summary can help with orientation, but it does not replace the statutory wording or a review of the configured operation.

Review automated decision-making where an attribution score changes a person's access, price, treatment or opportunity. Section 80 of the Act replaced Article 22 with Articles 22A to 22D; official explanatory notes describe safeguards for solely automated decisions with legal or similarly significant effects.

A human glance at a score might not amount to meaningful involvement. Ask a qualified lawyer to assess whether the configured use falls within the amended provisions. If the answer is uncertain, record an unresolved issue and hold the release rather than relying on a nominal human check.

What should the data record follow?

Keep a purpose-by-purpose record that follows fields from collection through use, onward sharing and deletion. Separate campaign diagnosis, billing reconciliation, fraud work, audience building, personalisation and model development rather than placing them under one broad analytics heading. This supports accountability and governance across the operation.

For every field, capture its source, collection time, identifier, transformation, recipient, retention trigger and deletion evidence. Record the notice version shown to the person, including the right to be informed. If a purpose or recipient changes, pause and reassess rather than assuming the earlier record still describes the operation.

Record the candidate lawful basis, necessity analysis and any balancing or consent evidence, together with the reviewer's conclusion. Match transparency, access, correction, erasure and related rights to the actual flow, including the right of access and right to erasure. Do not reduce the data protection principles or Article 6 to a dropdown choice.

Where processing may be high risk, determine whether a data protection impact assessment is required. Profiling, novel tracking, extensive matching or vulnerable groups can raise risk, but no one label decides the issue. Retain the regulator material's review status and consult data protection by design guidance.

Record onward disclosures, sub-processors and remote support locations, including any data sharing. The ICO's approach to international transfers has three stages: identify a restricted transfer, select an applicable mechanism and assess required protection. A supplier's region setting describes configuration, but does not establish by itself whether a restricted transfer occurs.

Review security at architecture level, including access control, privileged support, authentication, encryption, logging, change control, backup, recovery, incident notification and deletion proof. NCSC SaaS guidance says customers retain responsibilities for secure configuration and use. Check that a certification's scope and date match the service being purchased.

Which supplier promises and public notices matter?

Supplier terms and public notices need separate records: one sets service and processing commitments, while the other explains relevant uses and claims to an audience. Specify product edition, service scope, acceptance evidence, support, changes, term, fees, currency, VAT treatment, renewal and termination rather than leaving assumptions unresolved.

Where appropriate, put processing instructions and security in a schedule, and make intellectual-property and data rights explicit. Address campaign data, model inputs, derived outputs, feedback and supplier training use. A commercial contract review should include a tested export plan covering format, schema, metadata, fees, timing, assistance and deletion evidence.

Plan for continuity if access is lost, a supplier fails, an invoice is disputed or a model changes, including a manual reporting route. Liability allocation and remedies need legal and commercial judgement. A general checklist cannot determine what a particular buyer should accept in its own negotiation.

A privacy notice may not be the only disclosure required. Attribution claims may need a public methods note, commercial relationships may need a clear advertising label, and corrections need an audit trail. The CAP Code requires marketing communications to be identifiable; placement and audience understanding affect whether a disclosure works.

Maintain a versioned disclosure register containing its owner, audience, claim, evidence type, data source, model and window, material exclusions, commercial relationship, placement, approval and expiry. Preview the finished advert or page in context, then retain withdrawn versions and the reason for correction.

For business-to-consumer journeys, check consumer protection separately from advertising review. The DMCC Act 2024 protections described in the previous record apply from 6 April 2025. Review omissions, interface choices, pricing and claims in the real journey; consumer risk scenarios can prompt questions.

When is the release ready to approve?

Approve only when each relevant reviewer has made a separate, recorded decision; one approval cannot substitute for another. Record approve, reject or unresolved, identify the reviewer and evidence version, note conditions and expiry, and hold unresolved material points instead of treating silence as permission.

On publication day, reopen the legislation and regulator material. Check commencement, amendments, territorial scope and review notices. Confirm technologies, suppliers, sub-processors, model versions, notices and claims remain as assessed, then repeat the final-render advertising review, link check and accessibility test. For automated uses, compare the actual operation with AI application tests.

What should I do first?

Start by writing down the actual data journey and the intended public claim, then assign reviewers to the separate approval areas. Keep the operation on hold wherever a material question remains unresolved, and set a publication-day check for the legislation and relevant regulator guidance.