Rules and ethics
Part of Out of home advertising rules: budget for consent risk
What an out of home advertising disclosure policy means for UK buyers
How to build an out of home advertising disclosure policy, covering CAP Code duties, UK GDPR rules for digital screens and 2024 consumer law changes.
What to take away
- The Digital Markets, Competition and Consumers Act 2024 changed how commercial messages must be presented, so disclosure is now a buying decision, not just a creative one.
- A working policy names who approves each placement, what is recorded before a campaign runs and where proof of consent sits.
- Digital place-based screens that process personal data need a lawful basis, usually consent, under the UK GDPR.
- The CAP Code applies to out of home copy, and CAP webinars are a free way to keep a buying team current.
- The Digital Markets, Competition and Consumers Act 2024 sits alongside existing advertising rules rather than replacing them.
What the model policy must cover
Decide what counts as disclosure
Disclosure is the information a buyer, site owner or platform must give before an audience sees a commercial message. In out of home advertising that means the advertiser's identity, any material connection to a publisher, and the basis on which audience data was collected.
What a disclosure policy must cover
- Advertiser identity before audience sees message
- Material connection to a publisher
- Basis audience data was collected
- List categories in plain terms
- One named role with final sign-off
- Second check where personal data involved
A model policy skeleton
A one-page policy can follow this order:
- Scopeformats and sites covered.
- Approverthe role with final sign-off, and a deputy.
- Disclosurewhat the audience is told, and where.
- Recordswhat is kept, where and how long.
- Reviewwho checks it, and when.
If your team is still assembling the wider rule set, the UK rules and compliance guide sets out the legal framework this policy sits inside.
Set a single approval route
Write down who signs off each format. A static poster, a digital six-sheet and a screen that measures footfall do not carry the same risk.
Give one named role the final say, and require a second check where personal data is involved. Keep the route short: standard copy should clear within one working day, and placements that involve personal data within three working days.
How to build the policy, step by step
Map each placement to its rule source
For each site, record the format, whether it captures any personal data, and which regulator guidance applies.
Building the policy step by step
- Map each placement to its rule source
- Record format, personal data capture, regulator guidance
- Write the evidence trail for every booking
- Store artwork, consent wording, approval date, approver
- Train the people who buy each quarter
Most out of home copy falls under the CAP Code, while screens that infer audience characteristics raise data protection questions. England has its own planning and licensing layer on top, which the England regulations guide explains for teams buying locally.
Write the evidence trail
For every booking, keep the approved artwork, the consent wording used, the date of approval and the name of the approver.
Store these in one place for 24 months from the campaign end, then delete them. Consent wording for a camera-based screen might read: "This screen counts passers-by and estimates age band. No images are stored. Scan the code to opt out."
Train the people who buy
Run a short session each quarter on the formats your team actually buys. The ASA runs free CAP webinars through the year, and they cover the areas most likely to generate complaints.
| Format | Main rule source | Evidence to keep |
|---|---|---|
| Static poster | CAP Code | Approved artwork, booking date |
| Digital screen, no capture | CAP Code | Approved artwork, loop schedule |
| Digital screen with audience measurement | CAP Code and UK GDPR | Consent wording, data flow note |
| Sponsored content on a screen | CAP Code and consumer law | Advertiser identity, material connection note |
Common questions
Does a small advertiser need a written policy?
Yes, though it can be short. Even a one-page document naming the approver and the records kept is better than an informal arrangement.
Who enforces out of home advertising rules?
The Advertising Standards Authority administers the CAP Code for most out of home copy, while the Information Commissioner's Office handles data protection and the Competition and Markets Authority covers consumer law.
How often should the policy be reviewed?
At least once a year, and again whenever you add a format that captures data. Consumer law changed with the Digital Markets, Competition and Consumers Act 2024, so check that older wording still reflects current duties.
What happens if a disclosure is missed?
A missed disclosure can be reported to the ASA, which assesses the complaint, investigates, publishes a ruling and asks for the ad to be changed or withdrawn. Repeat breaches can be referred to Trading Standards.
The ICO can investigate data protection failures and fine up to £17.5 million or 4 per cent of worldwide turnover. The CMA enforces consumer law and can fine up to 10 per cent of global turnover or £300,000.
This article is general guidance only, so take advice from a qualified adviser on any individual case.
