UK compliance for creator platforms, from public-source data to advertising recognition

An English buyer cannot make a creator discovery platform lawful or suitable by completing one compliance checklist. The work crosses personal data, electronic communications, advertising, consumer protection, rights, safeguarding, accessibility, security and contract controls. Each lane needs its own facts, owner and qualified reviewer.

This guide is general information, not legal advice. It distinguishes Acts and regulations from regulator guidance, the CAP advertising code, private platform terms and voluntary editorial controls. Those sources do different jobs. A supplier contract cannot rewrite legislation, and regulator guidance does not endorse a product or campaign.

What to take away

One compliance checklist cannot make a creator discovery platform lawful or suitable for an English buyer.
Public display of creator data does not establish unrestricted collection, enrichment or reuse under UK rules.
Data roles must follow actual decisions, not one label applied across the whole supplier relationship.
Research participation, promotional contact and advertising recognition are separate purposes with separate evidence.
The CAP Code is a non-broadcast advertising code, not an Act of Parliament.

Fix the geography and effective date

Most personal-data and electronic-communications material used here is UK-wide. The Equality Act 2010 applies in Great Britain, while separate equality law applies in Northern Ireland. Child performance licensing guidance cited below is specifically for England. A contract may choose the law and courts of England and Wales, but overseas suppliers, creators or processing can introduce other jurisdictions.

The Data Protection Act 2018 and UK GDPR remain central to UK personal-data processing. The Data (Use and Access) Act 2025 changed that framework and PECR. The ICO's DUAA overview for organisations, updated on 19 June 2026, states all DUAA provisions affecting data-protection law and PECR are in force.

Earlier commencement plans show staged activation, so an old summary may no longer describe the full position.

Several ICO topic pages display an under-review warning even after the commencement update. The creator-platform evidence register should capture that warning and require the page to be reopened before processing or publication. A prospective change, draft guidance or consultation is not current law.

The unfair-commercial-practices provisions in Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024 apply to commercial practices from 6 April 2025. This is per the CMA's current CMA207 guidance.

The CAP Code is a separate UK non-broadcast advertising code. CAP maintains it; the ASA self-regulatory system enforces it. It is not an Act of Parliament.

Define the creator-platform operation

Do not apply a platform label to unlike services. Record whether the buyer is considering a discovery database, creator marketplace, campaign-workflow product, affiliate service, talent-management function, managed agency or a combination. Identify the exact edition and configured purpose.

Separate the people whose records and authority differ:

an indexed creator whose details were obtained from stated sources;
a participating creator who applied, enrolled or supplied information through a defined route;
a represented creator with evidence of a current intermediary mandate;
the advertiser or buyer that defines the campaign need;
the agency or talent intermediary performing delegated work;
the platform or supplier that operates the service;
the audience member who may later encounter advertising;
the rights holder for each protected item.

The same organisation may perform several functions. The evidence still needs to show who decides each purpose, who may act, and who answers a correction or complaint.

Audit public-source creator data

Public display does not establish unrestricted collection, enrichment or reuse. Build a processing inventory for collection, indexing, inference, scoring, search, export, outreach, correction and deletion. Each field needs its provenance, source permission, definition, claimed or verified status, observation time, refresh rule and permitted recipient.

The ICO's guidance on information obtained from public sources says public availability does not automatically remove the need to provide privacy information, subject to the applicable exception or exemption. The wider right-to-be-informed guidance is marked under review after DUAA changes. Save the page version and have a privacy specialist determine the current requirement.

Do not infer age, residence, protected traits, interests, authenticity, suitability, representation authority, audience composition, reach or willingness from names, images, posts, scores or follower data. A location field might describe a profile setting, a self-declared service area, an audience estimate or a supplier inference. Those meanings cannot be merged.

The ICO's special-category data guidance explains that processing special-category data requires an Article 6 lawful basis and an Article 9 condition. In many cases relying on a DPA Schedule 1 condition also needs an appropriate policy document. This is a legal boundary, not permission to infer sensitive attributes because a tool can produce them.

Determine data roles from actual decisions

Write down who decides the purpose and essential means for every operation. The advertiser, supplier, agency and talent intermediary could be separate controllers, joint controllers or processors in different parts of the service. Do not accept one role label for the whole relationship without testing it against reality.

If the buyer appoints a processor, the ICO's Article 28 contract guidance describes provisions about documented instructions, confidentiality, security, subprocessors, assistance, deletion or return and audit information. A supplier that uses buyer or creator data for an independent model-training purpose may not be acting only on the buyer's instructions for that use.

Record every subprocessor and transfer. The ICO's international-transfer guidance discusses proportionate checks on receiving processors and onward transfers. The live assessment needs locations, functions, contractual mechanism, transfer-risk work, change notice and the buyer's objection or exit route.

Separate research from promotional contact

Browsing a record, recruiting someone for research and proposing a commercial collaboration are separate purposes. Give each its own source list, message, lawful-basis assessment, PECR analysis, suppression process and retention rule.

The ICO's direct-marketing guidance was updated in April 2026 to reflect the DUAA commencement schedule. The PECR rules depend on the actual communication, route and recipient. A public email address or social message function is not automatic consent.

Research participation does not select a UK GDPR basis. If a creator takes part in interviews or testing, keep the information sheet, participation agreement, recording choice, privacy assessment, withdrawal route and any later marketing permission apart. Do not turn qualitative feedback into an endorsement or a claim about English creators generally.

Keep advertising recognition and substantiation apart

A discovery tool can help record a relationship, but it cannot decide that an advert is recognisable or a claim is true. Section 2 of the CAP Code says marketing communications must be obviously identifiable. Section 3 addresses misleading advertising, evidence, comparisons, testimonials and pricing. Product-specific and audience-specific sections may also apply.

The ASA's August 2026 advice on influencer advertising states that it is CAP Executive advice, not legal advice, and does not bind the ASA or CAP panels. Use it as current interpretive material, then have the advertising reviewer examine the finished format, commercial control and audience.

Create an incentive record covering cash, commission, gifts, loans, services, event access or another benefit. The CMA's updated guidance for brands discusses formal arrangements, unsolicited gifts, intermediary instructions, monitoring and correction. Platform disclosure features remain technical controls. They do not clear the commercial relationship or claim.

Every objective claim needs a register entry: exact wording, likely interpretation, population, geography, period, evidence, owner, limitations and expiry. A supplier case study, creator statement or dashboard is attributed evidence, not an independent finding.

Handle reviews and testimonials as a separate risk

A discovery platform may display creator ratings, buyer reviews, case studies or testimonial excerpts. Do not publish or rank them without establishing what they are, who supplied them, whether experience was genuine, what incentive existed and how selection or ordering works.

Schedule 20 of the Digital Markets, Competition and Consumers Act 2024 includes provisions on fake consumer reviews, concealed incentivised reviews and misleading publication of review information. The CMA's platform principles, updated on 28 August 2025, express the regulator's view of steps for social-media platforms. Qualified consumer-law review must decide whether those rules apply to a particular platform record or publication.

Disclosure cannot make a fabricated review genuine. If experience, incentive or verification is unresolved, exclude the material.

Safeguard under-18s without guessing

An age estimate from appearance, voice, subject matter or audience profile is not a safe eligibility control. Define when the process pauses, what proportionate evidence can be requested, who may see it, how it is secured and who decides the safeguarding route.

The Department for Education's child performance and activities guidance applies to England and concerns specified performance, paid sport and modelling circumstances. The simpler GOV.UK performance-licence page directs organisers to the child's local council when unsure. Neither page determines whether an online creator arrangement requires a licence.

If the service itself is likely to be accessed by children, the ICO's Children's Code resources describe the statutory code and its standards. Platform access rules, safeguarding policy, data-protection duties and campaign approvals stay separate.

Prove creator authority and rights

Indexing a creator does not give the buyer authority to negotiate, publish or pay through a listed intermediary. Record the current mandate, permitted activity, territory, term, payment route and who can approve claims or assets.

Create a rights schedule for names, images, text, video, music, brand marks, source databases and campaign assets. The IPO's copyright permissions guidance explains that using protected work may require permission unless a relevant exception applies. The IPO's database-right page addresses separate protection for qualifying databases.

Platform terms, API permissions, data-protection law, copyright and database rights are distinct. Passing one lane cannot be presented as passing the others. The named IP reviewer needs the exact item and proposed act.

Test accessibility and security in configuration

The Equality Act 2010 applies across Great Britain. Section 20 of the Act defines the reasonable-adjustment duty used by the parts and schedules that impose it. Whether and how that duty applies depends on the actual service and relationship, so obtain qualified accessibility and equality review.

Test the configured user journey rather than relying on a conformance statement. Include creator notices, search, filters, candidate tables, messaging, consent or correction controls, exported documents and support. Record manual, automated and assistive-technology evidence with version, browser, tester and defects.

Security needs another evidence file. The NCSC's cloud shared-responsibility model explains that provider and customer responsibilities depend on service design. Map administrators, permissions, connected accounts, logs, incident contacts, recovery, data export and access removal. A contract or certificate does not prove the buyer configured the service safely.

Contract for evidence, change and exit

The contract schedule should name the entity, exact service and edition, data sources, permitted users, purpose, deliverables, support and evidence. Keep platform subscription, managed service, creator payment, gifts, agency fee, paid media and internal labour as separate financial lines.

Any commercial amount needs a dated source or quote with currency, VAT basis, unit, quantity, billing period, commitment, eligibility, inclusions and exclusions. Leave price, liability, insurance, service thresholds and remedies blank until the buyer and qualified advisers complete them. Do not invent standard or typical terms.

Cover subprocessor and transfer changes, model or training uses, source withdrawal, feature change, suspension, accessibility remediation, incident notice, audit access, export format, deletion evidence, renewal and termination. The Cabinet Office Sourcing Playbook is public-procurement guidance that promotes early transition planning and return of contract data. Private buyers can borrow that discipline without treating the document as governing their contract.

Prove exit before approval. Export synthetic records with provenance, permissions, corrections and status. Check the schema and integrity, then test deletion and return to a buyer-controlled manual register. If essential evidence cannot leave, the service remains HOLD.

Publish disclosures that describe the evidence

Keep four disclosure layers separate:

Editorialauthor status, reviewer status, research date, documents examined, limitations, corrections and whether work was desk-only or tested.
Commercialfunding, affiliate relationships, free access, gifts, referrals or other conflicts.
Evidencesupplier statements, observed records, independent checks, uncertainty and expiry.
Technical assistanceany documented AI or model use, task, system and version, input boundary, human owner, verification and fallback.

These do not replace the advert's commercial disclosure or the creator's privacy information. Nor do they establish lawful processing, rights, safeguarding, accessibility or claim truth.

Store the approved wording with its format, placement and timestamp. Monitor live rendering and change. Correct or withdraw when an incentive, relationship, claim, model, source or platform presentation changes.

Use a non-compensating release record

The release register should show pass, hold or reject separately for data protection, PECR, advertising, consumer protection, regulated products, safeguarding, rights, accessibility, security, contract, procurement, tax and exit. No overall score may offset a failed lane.

Name the evidence, reviewer, date, unresolved issue and restart condition. A buyer can narrow the purpose, remove a field, return to manual discovery or stop. It does not need to force a platform approval.

This article remains editorial-draft-hold. It requires named UK data-protection and PECR, advertising and consumer, IP, safeguarding, security, accessibility, commercial procurement, tax and AI-governance review. On publication day, re-open every cited source, record its update or under-review status, and compare it with the exact configured service and intended creator operation.

Before you act

Fix the geography and effective date before relying on any summary.
Record each creator type and the authority it holds.
Build a processing inventory with provenance and refresh rules.
Test every data role against actual decisions and subprocessors.
Keep research, marketing and advertising recognition evidence apart.
Save page versions where regulator guidance is under review.

Common questions

Does public availability remove the need to provide privacy information?

No. The ICO guidance on information obtained from public sources says public availability does not automatically remove the need to provide privacy information, subject to the applicable exception or exemption. The wider right-to-be-informed guidance is marked under review after DUAA changes, so save the page version and have a privacy specialist determine the current requirement.

What must a processor contract include under Article 28?

The ICO Article 28 contract guidance describes provisions about documented instructions, confidentiality, security, subprocessors, assistance, deletion or return and audit information. A supplier that uses buyer or creator data for an independent model-training purpose may not be acting only on the buyer's instructions for that use, so test the role against reality.

Can a discovery tool decide whether an advert is recognisable?

No. A discovery tool can help record a relationship, but it cannot decide that an advert is recognisable or a claim is true. CAP Code section 2 says marketing communications must be obviously identifiable, and section 3 addresses misleading advertising, evidence, comparisons, testimonials and pricing.