broadcasting, tv, camera, coverage, video, video camera, a television camera, broadcasting, broadcasting, coverage, coverage, coverage, coverage, coverage, video, video, video camera, video camera, video camera, video camera
Photo by frkotou on Pixabay

Rules and ethics

How to apply connected TV advertising rules and ethics

A practical guide to UK connected TV advertising rules and ethics, covering ASA/CAP, ICO, data protection and platform standards for streaming and CTV campaigns.

What to take away

What to take away

  • Connected TV advertising is non-broadcast video on demand, so the CAP Code applies alongside data protection law and platform ad policies.
  • The main regulators are the Advertising Standards Authority (ASA) for ad content, the Information Commissioner's Office (ICO) for personal data, and the Competition and Markets Authority (CMA) for consumer law.
  • Ofcom regulates broadcast TV under the Broadcasting Code and on-demand programme services under the Communications Act 2003; linear TV ads follow the BCAP Code, while CTV ads follow the CAP Code.
  • Cookies and device identifiers on smart TVs are governed by the Privacy and Electronic Communications Regulations 2003 (PECR), and the ICO's Age Appropriate Design Code applies where children are likely to use a service.
  • Compliance is not just about the adyou need a lawful basis for audience data, clear consent for personalised ads, and a plan for complaints and takedowns.
  • Contract terms, disclosure rules and operational delivery all affect whether a campaign stays compliant, so involve legal and ad ops early.
  • This guide covers England and the UK where rules are reserved; Scotland, Wales and Northern Ireland may have differences in consumer or data enforcement, so check local guidance.

Who regulates connected TV advertising in the UK

Connected TV advertising means video ads delivered through internet-connected televisions, streaming sticks and apps. It is distinct from linear broadcast TV, which Ofcom regulates under the Broadcasting Code and which is written to the BCAP Code, the UK code of broadcast advertising that the ASA also enforces. For most CTV inventory, the rules come from the Committee of Advertising Practice (CAP) and the Advertising Standards Authority (ASA).

Who is accountable for a CTV ad

  1. Advertiser: accountable for the claim
  2. Agency: accountable for placement and wording
  3. Platform: controls where the ad runs
  4. ICO: enforces UK GDPR and Data Protection Act

The CAP Code covers non-broadcast advertising, including online and on-demand video. You can read the full advertising codes published by CAP and the ASA to see how they apply to streaming ads. The code requires ads to comply with rule 3.1 on misleading advertising, rule 3.7 on substantiation and rule 2.1 on recognition.

Broadcasters that also run on-demand services may be subject to additional Ofcom rules, but the advertiser's first duty is to the CAP Code. Ofcom regulates on-demand programme services under the Communications Act 2003 and applies advertising and scheduling rules to them, so an ad served inside a regulated on-demand service can sit under Ofcom as well as the ASA. In England, the ASA is the main complaints body for CTV campaigns.

Responsibility is shared along the chain. The advertiser is accountable for the claim. The agency is accountable for how it was placed and worded. The platform controls where the ad runs and applies its own policies. A complaint can land on any of them.

Data protection is separate. The ICO enforces the UK GDPR and the Data Protection Act 2018. The Data Protection Act 2018 sets out how personal data must be handled, including data used for ad targeting.

The CMA also has a role. It enforces consumer protection law and has taken action on misleading online ads. For CTV, the CMA is most relevant when ads make claims about prices, health or environmental benefits.

Advertising and data protection rules generally apply across the UK, because they are reserved matters. Consumer enforcement priorities can differ in Scotland, Wales and Northern Ireland. If a campaign runs in one nation only, check that regulator's local guidance.

How the CAP Code applies to streaming ads

The CAP Code is principles-based. It does not list every possible CTV scenario, but it does set expectations for accuracy, substantiation and social responsibility. For example, ads must not mislead about a product's price, performance or availability.

CAP Code checks for streaming ads

  • Claims accurate and substantiated
  • Comparative claims backed by evidence
  • Testimonials genuine and permitted
  • Health, beauty and food claims compliant
  • Age-restricted ads targeted away from under-18s
  • No harm, offence or irresponsible behaviour

Comparative claims need evidence. If your CTV ad says your service is cheaper than a named competitor, you must hold proof before the ad runs. The ASA can ask for that evidence if it receives a complaint.

Testimonials and endorsements must be genuine. A streaming ad that uses a customer quote needs permission and must not imply a broader endorsement than the person gave.

Health, beauty and food ads face extra scrutiny. Claims about weight loss, supplements or medical devices must comply with the relevant rules, and some products need pre-approval before they can be advertised.

Children's ads are a priority. CTV platforms are often watched by families, so ads for age-restricted products must be targeted away from under-18 audiences. The CAP Code's children's section is strict: creative must not exploit children's inexperience or credulity, and ads for products that cannot lawfully be sold to children must not appear where children are likely to see them. The ASA has ruled against ads that appeared in child-friendly content.

The CAP Code also covers harm and offence. Ads must not condone violence, discrimination or irresponsible behaviour. This applies to creative content, not just the product claim.

Category rules vary, and some apply to scheduling as well as wording. The CAP Code carries dedicated sections for gambling, alcohol and electronic cigarettes, plus separate rules on food, food supplements and health or nutrition claims. Gambling and alcohol ads, for instance, must not be aimed at under-18s, and several categories also restrict when and where an ad may run. Our breakdown of connected TV advertising advertising rules groups the code by product category so you can check a script before production starts.

Substantiation is a paperwork task, not a creative one. Keep the evidence for every objective claim in one file, dated and versioned. If a claim comes from a survey, record the sample, the fieldwork dates and the questions asked.

The ASA handles complaints rather than pre-approval. Anyone can complain about an ad, including a competitor. The ASA assesses whether the ad breached the code and publishes its decision. Sanctions include a request to withdraw the ad, an ad alert to members and referral to Trading Standards for persistent breaches.

The ethics that sit alongside the rules

Rules set a floor, not a ceiling. An ethical CTV campaign is one a viewer would accept if they could see exactly how it was planned, targeted and measured. Five principles carry most of the weight.

  • Honestyevery objective claim should be one you can evidence before the ad runs, and the creative should not edge past what the evidence supports.
  • Transparencyviewers should always know when they are watching an ad, who is behind it and what data it used. Labelling and a current privacy notice do that work.
  • Respect for the audienceattention is not unlimited. Ad frequency, loudness, skip options and format choices are ethical decisions as much as commercial ones.
  • Protection of the vulnerablechildren, and viewers in sensitive contexts such as gambling or health content, need stronger safeguards, including targeting exclusions and careful scheduling.
  • Accountabilitya named senior owner should be responsible for compliance on each campaign, and complaints should reach a real decision rather than a ticket queue.

None of this replaces the CAP Code, the UK GDPR or the platform policies, but it is the test to apply when the rules themselves are silent.

Data protection and consent for CTV targeting

CTV advertising often uses audience data to target households. That data can include device identifiers, IP addresses and viewing behaviour. Under the UK GDPR, you need a lawful basis to process personal data.

Data protection steps for CTV targeting

  1. Choose a lawful basis for processing
  2. Obtain freely given, specific, informed consent
  3. Minimise data collected for the campaign
  4. Set short retention periods and delete data
  5. Check third-party data contracts and consent
  6. Pass consent withdrawal down the supply chain

The ICO's step-by-step guide to direct marketing and data protection explains how to choose a lawful basis and how to handle consent. For personalised CTV ads, consent is often the most appropriate basis.

Consent must be freely given, specific, informed and unambiguous. A pre-ticked box is not consent. If you rely on legitimate interests, you must complete a balancing test and offer an easy opt-out.

Data minimisation matters. Collect only the data you need for the campaign. If you can target a genre without collecting precise location, do so.

Retention periods should be short. A typical retention period for CTV targeting data is 12 months, but the exact period depends on the purpose and the platform's policy. Delete it when the purpose ends. Document your decisions in a record of processing activities.

If you use third-party data, check the contract. The data provider must have obtained valid consent for CTV advertising. You may need to carry out due diligence.

Consent signals must travel with the ad request. The IAB Transparency and Consent Framework (TCF) uses a consent string generated by a consent management platform. That string is passed in the bid request to each vendor, which must check it before processing. If a viewer withdraws consent, the CMP updates the string and vendors must stop.

Storage rules sit alongside data protection law. The Privacy and Electronic Communications Regulations 2003 (PECR) govern cookies and similar technologies, including information stored on or read from a viewer's device such as the identifiers used by smart TV apps. PECR requires clear and comprehensive information and consent before that storage or access happens, unless a narrow exception applies. PECR sits on top of the UK GDPR, so a campaign can breach one, the other, or both.

Children's data deserves separate attention. Where a service is likely to be accessed by children, the ICO expects privacy settings to be high by default and profiling to be off unless there is a clear reason. Household-level targeting cannot assume every viewer is an adult. 7 million in April 2023 for breaches of children's data protection rules.

Advertising disclosure and transparency rules

Disclosure is about making it clear when content is an ad. The CAP Code requires marketing communications to be identifiable as such. On CTV, that means a clear label or separator between programme content and advertising.

Native or branded content needs an upfront disclosure. If an ad looks like a programme segment, it must still be obvious that it is advertising. The ASA has published guidance on recognising ads.

Influencer ads on streaming platforms also need disclosure. If a creator is paid to feature a product in a CTV show or on a connected app, the commercial relationship must be clear.

Political advertising has separate rules. Non-broadcast political ads are subject to the CAP Code, but there are also election law requirements. Check with the Electoral Commission if you are unsure.

For a practical template, see our guide to a connected TV advertising disclosure policy. It explains how to write a policy that covers labels, placements and record-keeping.

The ASA publishes every ruling in a searchable index on its website, listed by advertiser and sector. Filtering it for on-demand and online video shows how the code is being applied to CTV, including trends such as complaints about misleading prices, targeting and ad recognition.

Creative made with generative tools raises its own questions. If an ad uses a synthetic presenter or a generated voice, check whether viewers could be misled about who is speaking.

Keep your privacy notice current. It should say what data the campaign collects, how long it is held and who it is shared with. If the notice describes last year's campaign, it is not doing its job.

Before and after: compliance checklist

The table below compares common gaps with the steps that bring a CTV campaign into line. Use it as a working checklist before launch.

CTV compliance gaps and fixes

Before (common gap)

Lawful basis
No documented basis
Consent
Pre-ticked opt-in or no opt-out
Consent signals
Preference held by one partner
Ad substantiation
Claims made without evidence
Disclosure
Ad looks like programme content
Children's targeting
Ads served in family content without checks

After (compliant approach)

Lawful basis
Consent or legitimate interests recorded
Consent
Clear opt-in with easy withdrawal
Consent signals
Withdrawal passed down supply chain
Ad substantiation
Evidence file held before campaign
Disclosure
Clear label or separator
Children's targeting
Age-appropriate targeting and exclusions

Before (common gap)

Lawful basis
No documented basis for audience data
Consent
Pre-ticked opt-in or no opt-out
Consent signals
Preference held by one partner only
Ad substantiation
Claims made without evidence
Disclosure
Ad looks like programme content
Children's targeting
Ads served in family content without checks
Privacy notice
Notice describes an older campaign
Complaints
No route for ASA or ICO queries
Contracts
No data processing clauses
Policy
No written policy
Roles
Unclear ownership
Pre-launch review
No check before flight
Training
Staff unaware of the rules
Records
No campaign file

After (compliant approach)

Lawful basis
Consent or legitimate interests recorded and reviewed
Consent
Clear opt-in with easy withdrawal
Consent signals
Withdrawal passed down the supply chain via the IAB TCF consent string
Ad substantiation
Evidence file held before the campaign runs
Disclosure
Clear label or separator before the ad
Children's targeting
Age-appropriate targeting and exclusions
Privacy notice
Notice matches the live data flows
Complaints
Named contact and response within 10 working days for ASA queries and one month for ICO data requests
Contracts
Written agreement with data roles set out
Policy
Documented policy covering content, data, disclosure and complaints, reviewed yearly
Roles
Named compliance owner and data protection lead, documented
Pre-launch review
Every ad checked against the CAP Code, claims verified, lawful basis confirmed, record kept
Training
Creative, media buying and ad ops trained on the CAP Code and UK GDPR, refreshed when rules change
Records
Brief, substantiation, targeting rationale and approval trail kept, so a regulator query can be answered in hours

This checklist is general guidance. A specific campaign may need a qualified adviser to review the facts.

Building a CTV compliance process

  1. Write a policy covering content, data, disclosure, complaints
  2. Assign regulatory and data protection roles
  3. Run a pre-launch review and keep records
  4. Train creative, media buying and ad ops staff
  5. Monitor live campaigns and respond to complaints
  6. Line up supplier contracts before signing

Line up your suppliers before you sign. Your connected TV advertising commercial contracts should set out who owns compliance, who owns the data and what happens if a claim is challenged.

Plan for take-downs. If an ad is found to breach the rules, you need a process to pause or remove it quickly, with a named owner, a route to the platform and a written record of what was changed and when.

Platform standards that affect compliance

CTV platforms have their own ad policies. These often go beyond the CAP Code, for example by limiting ad frequency or banning certain creative formats. You must comply with both the platform policy and the law.

Platform standards and user experience checks

  • Comply with platform ad policies and the law
  • Follow Coalition for Better Ads video standards
  • Set your own ad frequency limits
  • Make interactive ad instructions clear
  • Ensure ads are legible and accessible
  • Review brand safety controls as a set
  • Check current platform policy before each flight

The Coalition for Better Ads sets standards for video ads, including length and skip options. The Coalition for Better Ads status page from IAB UK explains the current standards. Following them reduces the risk of user complaints and platform penalties.

Ad frequency matters. The Coalition for Better Ads video standard caps video ads at two per 10 minutes of video content. Platforms may also limit ad breaks to two to four per hour, but advertisers should set their own limits too. Too many ads in a short period can annoy viewers and lead to complaints.

Interactive ads need clear instructions. If a viewer can click for more information, the interaction should be obvious and not misleading. Any data collected through the interaction must comply with data protection law.

Brand safety controls are not a substitute for checking placement. Exclusion lists, verification tags and post-campaign reports each catch different problems, so review them as a set.

Platform policies change without much notice. Before each flight, check the current ad policy for the platforms you are buying. A creative that passed last quarter may need a new disclaimer this quarter.

Common questions

Do ASA rules apply to CTV ads in England?

Yes. The CAP Code covers non-broadcast advertising, including on-demand and online video. The ASA enforces the code across the UK, but enforcement priorities may differ in Scotland, Wales and Northern Ireland. Check the ASA website for local variations.

What is the lawful basis for CTV ad targeting?

Consent is often the most straightforward basis for personalised advertising. Legitimate interests can be used if you complete a balancing test and offer an opt-out. The ICO's direct marketing guide explains how to choose.

Do I need to disclose that an ad is an ad on CTV?

Yes. The CAP Code requires ads to be identifiable. A clear label or separator is usually enough. Native formats need extra care to avoid misleading viewers.

What happens if the ASA upholds a complaint about my CTV ad?

The ASA will publish the ruling and ask you to change or withdraw the ad. You may also face reputational damage. Repeat breaches can lead to further sanctions, including referral to Trading Standards.

Can I use the same creative on CTV and linear TV?

Not always. Linear TV is regulated by Ofcom under the Broadcasting Code and its ads are covered by the BCAP Code, while CTV is covered by the CAP Code. Some rules differ, especially around product categories and scheduling. Check both codes before reusing creative.

This guide is general information, not legal advice. For your specific circumstances, consult a qualified adviser.

In this guide

  1. Connected TV advertising UK regulations rest on statute, codes and consentA UK guide to connected TV advertising rules: the Communications Act 2003, AVMS Regulations 2020, CAP and BCAP codes, Ofcom, PECR consent and UK GDPR.
  2. When to check connected TV advertising rules before you launch a campaignA connected TV advertising checklist for UK campaigns, covering ASA, Ofcom, CAP and BCAP, data protection, Clearcast and gambling, alcohol and HFSS rules.
  3. What should you check in connected TV advertising commercial contracts?A UK connected tv advertising contract checklist covering inventory, brand safety, measurement, fees, data, liability, governing law and exit terms.
  4. Before you publish a connected TV advertising disclosure policyA practical guide to drafting a connected TV advertising disclosure policy that covers CAP ad labelling rules, UK GDPR consent wording and a worked budget example.

More in Rules and ethics