Most advice on how to run a marketing campaign is about tactics. The parts that actually get companies into trouble are the parts written down in regulation: what you must be able to prove before an advert runs, whether you may email a particular person at all, what an endorsement has to disclose, and whether your measurement is telling you what your marketing campaign caused or merely what it was present for. Those are checkable against published rules, which is what this guide does.
Updated October 2026. General information, not legal advice.
Evidence has to exist before the advert does
The UK Code of Non-broadcast Advertising is explicit about sequence. Rule 3.7 requires that before distributing or submitting a marketing communication for publication, marketers must hold documentary evidence to prove claims that consumers are likely to regard as objective and that are capable of objective substantiation. The Advertising Standards Authority adds that it may regard claims as misleading in the absence of adequate substantiation. Rule 3.1 requires that marketing communications must not materially mislead or be likely to do so, and rule 2.1 requires that they must be obviously identifiable as marketing communications.
Read together, those three rules set a practical workflow. Every objective claim in the brief needs a named piece of evidence attached to it before sign-off, obvious exaggeration that nobody would take literally is treated differently from a factual claim, and any placement that could be mistaken for editorial has to be labelled. That is a checklist, not a philosophy, and it is cheaper to run at briefing stage than after a ruling.
Who you may email, and on what basis
The Privacy and Electronic Communications Regulations govern this in the UK and the Information Commissioner’s Office summary is unambiguous: you must not send electronic mail marketing to individuals unless they have specifically consented to electronic mail from you. There is a limited exception, often called the soft opt-in, where the person bought or negotiated to buy a similar product or service from you in the past and you gave them a simple way to opt out both when you first collected their details and in every message since.
The ICO is equally clear about where the soft opt-in does not reach: prospective customers who have not bought anything, bought-in lists, and non-commercial promotions such as charity fundraising. Separately, you must not disguise or conceal your identity and you must provide a valid contact address so people can opt out. Corporate bodies may be contacted without consent, but sole traders and some partnerships get the same protection as individuals, and the ICO recommends keeping a list of any business that objects.
United States rules differ in shape. The Federal Trade Commission’s CAN-SPAM guidance requires accurate header information, a subject line that accurately reflects the content, disclosure that the message is an advertisement, a valid physical postal address, a clear and conspicuous explanation of how to opt out, and that opt-outs be honoured within 10 business days. It also states that you cannot contract away your legal responsibility to comply, and that each separate email in violation is subject to penalties of up to 53,088 dollars. The difference matters for a marketing campaign that crosses borders: consent first in the UK, disclosure and a working opt-out in the United States, and the stricter rule applied to any list you cannot cleanly separate.
Disclosure in anything that looks like a recommendation
The FTC’s endorsement guidance requires disclosure where there is a connection between an endorser and the marketer that a significant minority of consumers would not expect and that would affect how they evaluate the endorsement. That covers payment, free products, affiliate commissions and employment. Disclosures must be easily noticed, easily understood and hard to avoid, which rules out burying them in a description, a comment or behind a link. Responsibility is shared, and the FTC says the advertiser is ultimately responsible for what others do on its behalf. Buying likes or reviews from non-existent people is described as clearly deceptive.
What your marketing campaign actually caused
Last-click reporting tells you which touchpoint was nearest the purchase, not which spending caused it. The correction is not a better attribution model but a control group. Google’s own description of Conversion Lift sets out the method: the audience is split into a treatment group, who see your ads, and a control group, who do not, and the difference in conversions between the two groups is the lift caused by the presence of the ad. Google offers a user-based version, where groups are formed from aggregated user attributes, and a geography-based version, where they are formed from aggregated geographical data and offline data can be supported. It notes that Conversion Lift is not available for all Google Ads accounts and that you need to contact your Google account representative.
Even if you cannot access that specific product, the principle transfers. Hold the campaign back from a comparable group, compare outcomes, and you measure cause rather than coincidence. Without a holdout, a marketing campaign that reaches people who were going to buy anyway will report excellent numbers, and brand-name search will absorb credit for demand that something else created. Our pieces on how Google ranking works and building a brand on social media cover the channels; how to spot fake reviews covers what the FTC is enforcing against.
6 rules you must never break
- Never make an objective claim you cannot evidence before the advert runs. CAP rule 3.7 requires documentary evidence to be held before publication, not produced afterwards.
- Never run an advert that is not obviously an advert. CAP rule 2.1 requires marketing communications to be obviously identifiable as such.
- Never email an individual without consent or a valid soft opt-in. The ICO states that the soft opt-in does not cover prospective customers, bought-in lists or charity fundraising.
- Never send a commercial email without a postal address and a working opt-out. CAN-SPAM requires both, and opt-outs honoured within 10 business days.
- Never let a paid endorsement run undisclosed. The FTC requires clear and conspicuous disclosure of a material connection and holds the advertiser ultimately responsible.
- Never judge a campaign on last-click numbers alone. Use a holdout or a lift study so the figure you report is the difference your spending made.
Common questions
What should I check before a marketing campaign goes live? That every objective claim has documentary evidence attached, that each placement is obviously identifiable as advertising, that your email list has a lawful basis, that any endorsement discloses its material connection, and that a holdout group exists so you can measure the effect.
Can I email people who have not bought from me? In the UK, generally not without their specific consent. The ICO states that the soft opt-in applies only where someone bought or negotiated to buy a similar product or service from you and was given a simple way to opt out at collection and in every message.
What are the CAN-SPAM requirements? Accurate headers, a non-deceptive subject line, identification as an advertisement, a valid physical postal address, a clear opt-out mechanism, opt-outs honoured within 10 business days, and responsibility you cannot contract away.
How do I know whether a campaign actually worked? Withhold it from a comparable group and compare. Google describes Conversion Lift as splitting the audience into a treatment group that sees ads and a control group that does not, with the difference being the lift.
Who is responsible if an influencer fails to disclose? Both parties, and the FTC states that the advertiser is ultimately responsible for what others do on its behalf, which is why intermediaries are expected to run training and monitoring.
Sources and further reading
Where the figures and rules above come from, so you can check them:
- CAP rule 3.7 and the requirement to hold documentary evidence before publication: Advertising Standards Authority
- The CAP Code, including rule 2.1 on recognition and rule 3.1 on misleading advertising: Committee of Advertising Practice
- Electronic mail marketing: consent, the soft opt-in and its limits: Information Commissioner’s Office guide to PECR
- CAN-SPAM requirements and the penalty per violating email: US Federal Trade Commission
- Material connection disclosure, clear and conspicuous standards and fake reviews: FTC endorsement guides: what people are asking
- Treatment and control groups, user-based and geography-based methods, and availability: Google Ads Help, About Conversion Lift
Photo credit: Billboard in Menands, New York by Tyler A. McNeil, CC BY-SA 4.0, via Wikimedia Commons.
Join the discussion