UK local SEO rules and ethics for agencies

Reviews that affect customer choice

Review activity creates consumer-protection exposure when an agency solicits testimonials or affects which feedback customers see. The Digital Markets, Competition and Consumers Act 2024 gives the CMA direct enforcement powers, including penalties, as relevant provisions come into force. Its core consumer rules apply across the UK.

Schedule 20 names prohibited practices including submitting fake reviews, offering an undisclosed reward for a review, or concealing negative feedback. That list is not exhaustive: conduct outside it may still breach the Act's general prohibition on unfair commercial practices. Review programmes should be even-handed, and agencies should not write testimonials for clients.

Offering a discount for a five-star review without disclosure creates risk, as does screening unhappy customers out of a public request process. Check review generation evidence and take care when scraping directories. Platform rules may impose additional restrictions, so check the relevant terms before a request process begins.

The Act's provisions have started in stages, making the commencement position relevant when advising on a review tactic. The Digital Markets, Competition and Consumers Act 2024 text is the primary legislation; check it alongside the CMA publication titled Fake reviews: advice for businesses. Specific cases may need qualified legal advice.

Personal information and contact rules

UK GDPR applies to personal information used in local campaigns, while PECR adds requirements for electronic marketing. A review-request list, CRM record, prospect email address or telephone campaign therefore needs a clear purpose and appropriate safeguards. Decide how the information will be used before collection or outreach begins.

Choose a lawful basis before processing starts. Consent and legitimate interests are common marketing bases, but the latter requires a documented balancing test. Record why the processing is necessary and why people's rights do not override the agency's interests, rather than relying on an unrecorded judgement.

Collect only information needed for a stated purpose. Bulk copying directory contact details can be difficult to justify, and a 2023 review list still being used for requests in 2027 would breach storage limitation. Consult the data protection sources for relevant ICO tools and checks.

Set retention periods and handle access or erasure requests within one month. When an agency processes client data, put the controller-processor relationship in writing. Check whether the agency must pay the data protection fee by using the ICO register and self-assessment, since exemptions can apply.

PECR distinguishes corporate subscribers from individuals. Sole traders and some partnerships count as individual subscribers, so consent is usually needed before emailing them. The soft opt-in is limited to details collected during a sale or sale discussions, with an opt-out in each message; it does not extend to a bought cold list.

Include an opt-out in every marketing email or text, and retain permission records. Before calling, screen numbers against the Telephone Preference Service register; marketing calls to registered numbers are prohibited unless the subscriber has consented. Consult the Guide to PECR when checking requirements for email, SMS and calls.

Claims made on local pages

The CAP Code can apply to unpaid local pages when they function as marketing communications. Organic visibility does not exempt claims, testimonials or endorsements from requirements concerning honesty, evidence and presentation. Review the page in the same way as other marketing material when deciding whether its wording is fair.

The ASA writes and enforces the CAP Code. A review displayed on a landing page is a marketing claim, so testimonial and endorsement rules matter alongside substantiation and non-misleading advertising. The ASA news and rulings pages provide updates to check during campaign reviews.

Claims need evidence. Calling a business the cheapest in a city, or presenting it as number one through an unverifiable award, can mislead. Comparative language requires support, and section 2 of the CAP Code is relevant when assessing whether an advertisement could mislead its audience.

Location and price details need the same care. Do not claim coverage across Greater London if the business serves only a few boroughs, and show VAT in consumer-facing price claims. A lead capture form should explain what will happen to people's details, especially if several buyers will receive them. Check the advertising rules sources when verifying campaign claims.

Paid promotion and search conduct

Paid placements and sponsored material must be recognisable as marketing, while platform policies may prohibit tactics that are not otherwise unlawful. Apply both checks when planning reviews, link building and location-page production. A lawful method can still conflict with a platform's terms.

For creators and influencers, make advertising obvious with a clear label such as ad at the start of the content. A label hidden at the end of a long caption is not an adequate substitute. Keep the disclosure visible wherever a paid relationship could affect how people understand the message.

Paid links intended to manipulate rankings breach Google Search Essentials spam policies, including its link spam policy. Doorway abuse and scaled content abuse can also affect near-identical location pages designed to funnel users to one destination; a manual action can remove a site from local results. Apply the Business Profile rules when reviewing profile eligibility and content.

Google Maps rules prohibit fake engagement, including incentivised reviews and selectively asking only satisfied customers for feedback. Trustpilot's business guidelines also prohibit incentivised reviews. Check platform terms before launching requests, because a tactic allowed by law may still breach a platform's rules.

Responsibilities across the client relationship

Written agency-client arrangements should identify who controls personal data, who processes it, who owns review information and who is responsible for campaign decisions. Clear scope can prevent a client request from becoming an undocumented risk. Agreeing boundaries before delivery also helps the agency explain what work it will not undertake.

A data processing agreement should cover purpose, retention and security when an agency handles personal information for a client. Define excluded work too, including buying links, writing reviews or scraping personal information. Specific contract terms may need qualified legal advice, while the England market guide offers wider commercial context.

If a client requests review gating or another questionable method, record the agency's position and agree responsibilities before proceeding. Check that professional indemnity cover includes marketing services and regulatory investigations. Compliance decisions depend on the actual work, so record the reasoning and revisit it when campaign activity or responsibilities change.

Ethical practice extends beyond minimum legal requirements. Represent a service-area business accurately rather than claiming a staffed office at an address it does not use. Substantiate environmental wording such as carbon neutral or eco-friendly, and make local pages accessible through basic choices about contrast and navigation.

At campaign setup, teams can check the following controls and repeat the review each quarter: