Rules and ethics
Part of UK local SEO rules and ethics for agencies
Sourcing local SEO UK regulations without guessing at the rules
A practical source map for local SEO UK rules: the ICO, UK GDPR, PECR, ASA/CAP and CMA, with the laws, registers and guidance agencies should cite.
What to take away
- For cold email, check the ICO's business-to-business marketing guidance alongside PECR; the rules depend on the type of subscriber.
- For personal data, cite the UK GDPR and Data Protection Act 2018, and check the ICO's fee guidance and register of fee payers.
- For advertising claims, use the CAP Code, including rule 3.7 on substantiation, and check the ASA's list of non-compliant online advertisers.
- For review claims, consult the CMA's online reviews guidance and the Digital Markets, Competition and Consumers Act 2024.
- The CIM code of professional conduct is a professional standard, not a regulator's rule or a statute.
- Where planning or licensing is relevant, name the applicable national law and local authority. Source every number in a client proposal and date it, or label it as an illustrative example.
Why the source matters more than the summary
Most agency blog posts about local SEO rules paraphrase each other, which is a poor basis for client advice. Start from the regulator's own page instead.
When a cold outreach sequence targets sole traders, start with the ICO's guidance on business-to-business marketing and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), particularly regulation 22 on unsolicited marketing emails. PECR treats sole traders and some partnerships as individual subscribers, so consent is generally needed unless the soft opt-in applies; different rules apply to corporate subscribers. Where personal data is processed, the UK GDPR and Data Protection Act 2018 also apply.
England, Scotland, Wales and Northern Ireland
For data protection and electronic marketing, name the UK GDPR, the Data Protection Act 2018 and PECR, then use ICO guidance to interpret them. For non-broadcast advertising, cite the CAP Code and ASA guidance; the ASA's enforcement list shows how the code is applied.
Devolved vs UK-wide rules
UK-wide
- Data protection
- Applies
- Marketing law
- Applies
- ASA codes
- Applies
- Planning
- Not devolved
- Licensing
- Not devolved
- Some consumer rules
- Not devolved
Devolved
- Data protection
- Applies
- Marketing law
- Applies
- ASA codes
- Applies
- Planning
- Devolved
- Licensing
- Devolved
- Some consumer rules
- Devolved
Planning and licensing rules matter when a campaign concerns premises, signage or regulated services, and the applicable requirements depend on the nation and locality. In England, the Town and Country Planning Act 1990 and the relevant local planning authority may apply; in Scotland, check the Town and Country Planning (Scotland) Act 1997 and the relevant council. Wales has the Planning (Wales) Act 2015, and Northern Ireland has the Planning Act (Northern Ireland) 2011. A Glasgow campaign may therefore face different local requirements from one in Bristol. Name the nation and confirm requirements with the relevant planning or licensing authority.
Use the enforcement record as a checklist
The ASA list of non-compliant online advertisers shows businesses that kept running ads after a ruling, which makes it a practical warning list.
Check the CMA's guidance on online reviews and endorsements when clients make review claims. The Digital Markets, Competition and Consumers Act 2024 bans fake reviews, so do not buy reviews or present fabricated review scores as genuine. A competitor appearing on an enforcement list is evidence for a pitch, not a tactic to copy.
The ethical layer clients now ask about
The CIM code of professional conduct covers honesty, transparency and conflicts of interest. CIM is a professional body, not a statutory regulator, so its code is a professional standard rather than a law; procurement teams may still ask suppliers to follow it.
State plainly what you will not do: buy reviews, hide paid placements, or edit a client's Google Business Profile in ways that mislead. For UK legal requirements, cite the applicable law and regulator guidance rather than relying on an internal summary.
Sourcing the numbers you quote
ONS releases are the safest public source for population, business counts and regional employment, and each carries a publication date you can cite.
Where no official figure fits, write a labelled illustrative example. A three-person agency in Leeds charging £650 a month per client across 12 retained accounts would show £93,600 a year before costs, none of it market data.
A worked example with pound figures
Suppose a Nottingham agency wants to add outreach to its local SEO service. It budgets £1,200 a month for a part-time researcher, plus £300 for a compliant email platform. Legal review of its privacy notice adds £150, so the total is £1,650 a month, or £19,800 a year.
Four new clients at £500 a month each would add £24,000 a year in recurring fees. That thin margin is why the compliance reading happens first.
This is general guidance only; individual cases around consent and data retention need a qualified adviser.
Common questions
Do local SEO agencies in England need to register with the ICO?
Most organisations that process personal data pay a data protection fee unless an exemption applies. Check the ICO's registration pages rather than assuming a small agency is exempt.
Can we email local businesses without consent?
Sometimes. Under PECR, marketing emails to corporate subscribers do not generally require prior consent, but sender identification and an opt-out must be provided. Sole traders and some partnerships are individual subscribers, so consent is generally required unless the soft opt-in applies. The UK GDPR and Data Protection Act 2018 also matter when personal data is used; check the ICO's B2B marketing guidance before building a list.
Where do we check whether an advertising claim is allowed?
The CAP Code on the ASA site sets the rules for non-broadcast marketing. Rule 3.7 requires marketers to hold documentary evidence for objective claims that consumers are likely to regard as capable of substantiation. The non-compliant advertisers list shows enforcement in practice; take advice on client-specific claims.
Does this guidance cover Scotland, Wales and Northern Ireland?
The UK GDPR, Data Protection Act 2018, PECR and CAP Code apply across the UK. Planning and licensing requirements can differ: for example, Scotland has the Town and Country Planning (Scotland) Act 1997, while the relevant authority's local requirements also matter. Name the nation and check with the local planning or licensing authority where it applies.
