Rules and ethics
Part of Four overlapping UK regimes govern digital PR rules and ethics
What UK advertising rules mean for digital PR source vetting
A vetting checklist for digital PR teams who must evidence every claim they pitch, covering source quality, advertising rules, privacy and consent.
What to take away
- Before you brief a client or pitch a journalist, prove you can name the exact source, date and licence behind every figure.
- Advertising rules bite on anything promoting a client's product, including data-led stories and social posts.
- Cold outreach by email or phone falls under the Privacy and Electronic Communications Regulations, enforced by the ICO.
- Weak sourcing costs placements and relationships, not just credibility.
- Score each source against the rubric below and log the result. The rules cited here apply across the UK.
Source quality: what counts as evidence
Primary sources versus recycled statistics
A primary source is the body that produced the number: a statistics agency, a regulator, a court, or a company's filed accounts. Anything else is secondary. If a figure reaches you through a round-up, trace it back. If the trail ends at a dead link, drop the claim.
Licensing and reuse checks
- Open Government Licenceattribute accurately
- Use the version you actually used
- Crown copyright, Ordnance Surveyown terms
- Commercial datasetscheck before campaign
- User-generated contentlawful basis needed
- Consent for one purpose does not cover another
Primary vs secondary sources
Primary source
- Who produced it
- Statistics agency, regulator, court
- Verification
- Public and dated
- Method
- Published methodology
- If trail ends
- Claim stands
Secondary source
- Who produced it
- Round-up or repost
- Verification
- Trace back to origin
- Method
- Often not stated
- If trail ends
- Drop the claim
Companies House filings are public and dated, so company claims can be verified quickly. ONS releases publish methodology alongside the figures, which lets you state the sample and period. If a supplier will not name its method, label the number as illustrative in the pitch.
Licensing and reuse
Open Government Licence material can be reused with attribution, but the attribution must be accurate and the version must be the one you used. Crown copyright, Ordnance Survey and commercial datasets carry their own terms. Check before you build a campaign on someone else's data.
Where a story uses user-generated content, screenshots or scraped posts, you need a lawful basis for processing and a clear route to removal. Consent for one purpose does not cover another.
Advertising and outreach rules that apply
When content becomes advertising
The Advertising Standards Authority's rules cover marketing communications, which can include a data-led story promoting a client. Its social and political topic category sets out how the codes treat sensitive-issue content, which matters if a campaign touches politics, health or identity.
Ask one question before you pitch: does this content promote a product, service or brand? If yes, the CAP Code applies and the claim must be substantiated. Hold the evidence at the time the claim is made, not after a complaint.
Outreach, consent and market conduct
Outreach is regulated separately. The ICO's guide to PECR explains when electronic marketing needs consent and when soft opt-in may apply. A journalist's work address is still personal data, and a press list is still a marketing list if you are selling.
Keep records of who was contacted, on what basis, and when they opted out.
Where a campaign misleads a market or distorts competition, the CMA can act. GOV.UK explains how to report a competition or market problem. The wider framework sits in the digital PR rules and compliance guide.
Applying the checklist
Scoring rubric
Score each source from 1 to 5. A total below 16 means it should not carry a headline claim.
| Criterion | 1 (weak) | 3 (workable) | 5 (strong) |
|---|---|---|---|
| Origin | Anonymous round-up | Named secondary source | Primary producer |
| Date | Undated | Within three years | Within twelve months |
| Method | Not stated | Partly described | Full methodology |
| Licence | Unclear | Attribution required | Open and reusable |
| Verification | Single mention | Two independent mentions | Direct confirmation |
Record keeping and sign-off
Keep a source log for every campaign: URL, publisher, publication date, the exact figure used, and who checked it. Store it with the client brief so evidence is available if a complaint arrives.
Name one person to sign off data-led claims. That person confirms the claim is substantiated, the licence permits reuse, and any consent basis for outreach is documented. For disclosure wording, the digital PR disclosure policy guidance explains what to publish and where. Individual cases still need a qualified adviser.
Common questions
Do advertising rules apply to digital PR stories?
Yes, where content promotes a client's product or service. The CAP Code requires claims to be substantiated, so hold the evidence before publication.
Can I cold email journalists without consent?
Sometimes. PECR allows limited contact in a business context, but you must identify yourself, explain how you got the address, and honour opt-outs promptly.
What should I do if a source disappears?
Withdraw the claim and re-brief. A dead link or retracted study is a substantiation failure, and the risk sits with the brand making the claim.
How long should I keep source records?
Long enough to answer a complaint, which in practice means the life of the campaign plus a margin. Two years is a reasonable working minimum.
