Why local SEO rules and ethics now decide which agencies win trust

What to take away

• The Digital Markets, Competition and Consumers Act 2024 gives the Competition and Markets Authority direct powers to fine businesses up to 10% of global turnover for unfair commercial practices, including fake reviews, once the relevant provisions are commenced.
• UK GDPR still governs every review request, contact list and location page built from personal data, with the ICO as the regulator.
• PECR sits alongside UK GDPR for email and SMS outreach, and consent standards have not loosened.
• The ASA's CAP Code applies to organic local content as well as paid ads when it amounts to marketing communications.
• Every rule below applies in England, and in Scotland, Wales and Northern Ireland the same primary legislation and regulators apply unless stated otherwise.

Why local SEO rules and ethics matter more in 2027

A local SEO campaign is a marketing operation with a data trail. It collects reviews, scrapes directories, builds citation lists and emails prospects. Each of those steps is regulated.

The regulatory picture has tightened. The DMCC Act 2024 created a direct enforcement route for consumer protection breaches. The CMA can act without going to court. That changes the risk calculation for agencies that treat compliance as an afterthought.

Ethics and rules overlap here. A campaign can be legal and still mislead. The ASA's CAP Code catches misleading claims that fall short of a statutory breach. Reputation damage follows either way.

This guide sets out the framework for England. Where a rule differs in Scotland, Wales or Northern Ireland, the difference is named. For a wider commercial picture of the market, the England market guide for 2027 covers demand, pricing and competitor structure.

The DMCC Act 2024 and fake reviews

The Digital Markets, Competition and Consumers Act 2024 is the biggest change to consumer protection enforcement in years. It bans fake reviews and practices that manipulate consumer choice.

Schedule 20 of the Act lists banned practices. These include submitting a fake review, incentivising a review without disclosure, and suppressing negative reviews. The banned list is not exhaustive. Other misleading practices fall under the general prohibition.

The CMA's enforcement powers are the key shift. Under the Act, the CMA can decide that a practice is unfair and impose penalties directly. Fines can reach 10% of global turnover, or £300,000 if that is higher.

For local SEO, the exposure sits in review generation. A campaign that offers a discount for a five-star review without disclosing the incentive is at risk. So is a campaign that filters out unhappy customers before they reach a public platform.

The Act's provisions come into force in stages. Check commencement dates before advising a client. The DMCC Act 2024 text on legislation.gov.UK is the primary source and should be read alongside CMA guidance as it is published.

This is general guidance. Individual cases need a qualified adviser.

UK GDPR and personal data in local campaigns

Local SEO runs on personal data. Prospect lists, review requests, email addresses and CRM records are all in scope.

The ICO's guide to data protection for organisations sets out the principles. Lawful basis is the first decision. Consent and legitimate interests are the two most common bases in marketing.

Legitimate interests require a balancing test. You must show the processing is necessary and that your interests are not overridden by the individual's rights. Document that test. An undocumented balancing test is a weak defence.

Data minimisation matters for citation building. Scraping contact details from directories and republishing them in bulk is hard to justify. Collect what you need for a stated purpose.

Retention is the other common failure. A review request list from 2023 that is still being emailed in 2027 breaches the storage limitation principle. Set retention periods and delete on schedule.

Subject access requests and erasure requests must be handled within one month. Agencies acting as processors need a written contract with the controller. Our data protection sources page lists the ICO tools and templates worth bookmarking.

PECR and outreach for local SEO

PECR governs electronic marketing. It sits alongside UK GDPR and applies to email, SMS and calls.

The ICO's direct marketing and PECR hub explains the rules. The core position for business-to-business email is often misunderstood.

Corporate subscribers are treated differently from individual subscribers. Sole traders and some partnerships count as individual subscribers in practice. That means consent is usually needed before the first email.

The soft opt-in is narrow. It applies where you obtained the details in the course of a sale or negotiations for a sale, and you offer an opt-out at every message. It does not cover a cold list bought from a data broker.

Cold outreach to local businesses is a common agency growth tactic. It is also a common source of complaints. Keep records of consent, and make opting out easy in every message.

Telephone marketing to numbers registered with the Telephone Preference Service is prohibited unless the subscriber has consented. Check the TPS register before any calling campaign.

The CAP Code and ASA enforcement

The Committee of Advertising Practice writes the CAP Code. The ASA enforces it. The code covers paid ads and marketing communications in non-paid space.

That second category matters for local SEO. A location page, a social post or an influencer arrangement can be a marketing communication. If it is, the CAP Code applies.

The rules on testimonials and endorsements are relevant to review content. Claims must be honest and substantiated. A review displayed on a landing page is a claim.

The ASA also rules on misleading pricing and comparative claims. A local page that says "cheapest in Manchester" without evidence is a problem. So is a "number one agency" badge from an unverifiable awards body.

Regulatory positions move. The ASA news pages carry rulings and guidance updates that affect digital marketing. Review them quarterly and log any change that touches a client's sector.

Disclosure, sponsored content and links

Disclosure is where ethics and law meet. Paid links, sponsored posts and affiliate arrangements must be identifiable as such.

For influencers and content creators, the CAP Code requires that ads are obviously identifiable. A label such as "ad" at the start is the standard approach. Burying a hashtag at the end of a long caption does not meet it.

For link building, paid links that pass ranking signals breach search engine guidelines. That is a platform rule rather than a statutory one, but the commercial consequence is real. A manual action can remove a site from local results.

Review platforms have their own policies. Incentivised reviews, review gating and bulk review exchange all breach most platform terms. They also now sit close to the DMCC Act banned practices.

Our disclosure policy sources page gathers the platform policies and regulator positions in one place. It is worth keeping open when drafting a client's review policy.

Ethics beyond the minimum

Compliance is the floor. Ethical local SEO goes further, and it is increasingly a commercial differentiator.

Honest representation of a business is the starting point. A service-area business should not claim a staffed office at an address it does not use. That misleads customers and breaches platform rules.

Review solicitation should be even-handed. Ask all customers, not just the happy ones. Do not write reviews on behalf of clients.

Environmental claims are the newest area of scrutiny. Terms such as "carbon neutral" and "eco-friendly" must be substantiated. The Chartered Institute of Marketing's Sustainable Marketing Hub offers guidance on making credible claims. For local businesses, a vague green claim on a location page is a live risk.

Accessibility is an ethical issue too. Local pages should meet basic contrast and navigation standards. That widens the audience and reduces legal risk under equality duties.

Working with clients on contracts and liability

Compliance responsibilities should be written into the agency contract. Who is the controller and who is the processor? Who owns the review data?

The ICO expects a written data processing agreement where an agency processes personal data for a client. That agreement should cover purpose, retention and security.

Indemnities matter. If a client insists on a review gating tactic, the contract should make the risk allocation clear. Our commercial contracts guide for England explains the clauses that most often cause disputes.

Scope should define what the agency will not do. Buying links, writing reviews and scraping personal data should be excluded in writing.

Professional indemnity insurance is worth checking. Confirm the policy covers marketing services and regulatory investigations.

This is general guidance only. Contract terms and liability positions need a qualified legal adviser.

Advertising rules that touch local campaigns

Paid local advertising sits under the same CAP Code, plus platform-specific policies. Google Ads has its own misrepresentation rules.

Location targeting claims need care. "Serving all of Greater London" is a claim that should be true. If the business only covers three boroughs, say so.

Price claims in ads must include VAT where the audience is consumers. A headline rate that excludes VAT can breach the CAP Code.

Lead generation forms must be clear about what happens to the data. A form that passes details to five buyers needs a prominent notice.

For a fuller list of the data sources that support these claims, see our advertising rules sources page. It maps each rule to the regulator page that states it.

A practical compliance checklist

Use this checklist at campaign setup and review it every quarter.

• Confirm the lawful basis for every contact list and document the legitimate interests test where used.
• Check consent records for email and SMS outreach, including the source and date of consent.
• Screen calling lists against the TPS register before any campaign.
• Confirm review requests do not offer incentives without disclosure, and that no reviews are filtered by sentiment.
• Ensure paid partnerships and sponsored content are labelled clearly at the start of the content.
• Verify that location pages describe real premises or a genuine service area.
• Keep evidence for any comparative, price or environmental claim.
• Set retention periods for prospect and review data, and delete on schedule.
• Put a data processing agreement in place with every client where personal data is handled.
• Log ASA rulings and CMA guidance relevant to each client sector, and review quarterly.

Common questions

Does the DMCC Act 2024 apply across the UK?

Yes. The Act is UK-wide primary legislation, and the CMA enforces it across England, Scotland, Wales and Northern Ireland. Commencement of individual provisions has happened in stages, so check the current position before relying on a specific power.

Do I need consent to email local businesses about SEO services?

Often yes. PECR treats sole traders and some partnerships as individual subscribers, so consent is usually required. The soft opt-in only applies where details were obtained during a sale or negotiations, and every message must offer an opt-out.

Can I offer a discount in exchange for a review?

Only with clear disclosure of the incentive. Undisclosed incentivised reviews fall within the DMCC Act banned practices and breach most review platform policies. Even with disclosure, platform terms may still prohibit the practice.

Who is responsible if a client insists on a non-compliant tactic?

The agency can still be liable as a processor or as a party to the marketing. Put the risk allocation in the contract, exclude prohibited tactics in writing, and take legal advice on the specific facts.

Does the CAP Code apply to organic local pages?

It can. Where a page amounts to a marketing communication, the CAP Code applies to its claims. That includes testimonials, price statements and comparative claims, even without paid promotion.

How often should an agency review its compliance position?

Quarterly is a sensible baseline. Regulator guidance and ASA rulings change through the year, and platform policies change more often. Review at campaign setup and after any significant rule update.