ASA Influencer Rules 2026: CAP Code Section 2, CMA Enforcement and the UK Compliance Playbook for Brand Teams

ASA influencer rules in the UK are set by Committee of Advertising Practice (CAP) Code Section 2 — the "Recognition of marketing communications" rules — and enforced by the Advertising Standards Authority with statutory backstop powers now held by the Competition and Markets Authority under the Digital Markets, Competition and Consumers Act 2024. The DMCC consumer protection provisions are now in force. The substance of the rule is short: every paid UK influencer post, including gifted content above a de minimis value, must be obviously identifiable as a marketing communication at the very start of the caption (or first frame of video / first second of audio), in language an ordinary UK consumer recognises. "#ad", "Ad", "Advertisement", "Advertorial", or the platform-native "Paid Partnership" label combined with a text disclosure all qualify; abbreviations like "#sp" or "#aff" do not, and a platform-only Paid Partnership tag with no caption disclosure is also not sufficient under ASA practice.

The five things brand teams running paid UK creator campaigns must do in 2026: (1) write the disclosure obligation into every creator contract so the brand has a paper trail if the ASA opens a case, (2) audit every piece of campaign content before it goes live, not after, with a five-pass check covering caption opening, video first frame, voice opening, platform Paid Partnership tag, and any gifted-product mention, (3) hold the final invoice payment until the disclosure audit clears, (4) keep a documented record of the audit for each post for at least 12 months in case of an ASA complaint, and (5) for cross-border UK-brand to EU-creator campaigns, run the disclosure in the local language of the audience (French for a French audience, German for a German audience) per the equivalent rules in Loi 2023-451, UWG §5a, AGCom Codice di Condotta and RD 444/2024.

Creator-side TL;DR: put "#ad" or "Ad" at the start of the caption, not buried in 22 hashtags at the end, and pair it with the platform Paid Partnership tag when the campaign uses one. For gifted content where the brand sent a product worth more than roughly £40-50, add "Gifted" or "#gifted" — the ASA treats the gift as a material connection even when no cash changed hands. Whether you are a UK brand team paying creators or a UK creator taking brand briefs, the audit framework below applies on both sides of the marketplace.

The ASA — the Advertising Standards Authority — is the UK self-regulatory body responsible for ensuring advertising across all media (print, broadcast, online, influencer) is "legal, decent, honest and truthful". The ASA itself does not write the rules. The rules sit in two codes: the CAP Code (Committee of Advertising Practice — non-broadcast, which includes all online and influencer content) and the BCAP Code (Broadcast Committee of Advertising Practice — TV and radio). For influencer marketing, the CAP Code is the relevant text, and Section 2 — Recognition of marketing communications is the section that matters most.

What triggers an ASA case: a complaint. The ASA does not patrol Instagram or TikTok in real time. Anyone can submit a complaint via the ASA online form — a competitor brand, a campaign group, a single member of the public, or a journalist building a story. The ASA receives several hundred influencer-related complaints per year and progresses cases that show clear breaches of CAP Code Section 2. Cases that meet the bar for investigation go through a written exchange between the ASA, the creator and the brand, and result in a published ruling on the ASA website. Rulings are either Upheld (a breach was found), Not Upheld (no breach), Informally Resolved (the parties fixed the post and the ASA closed the file) or Withdrawn.

What an upheld ASA ruling actually does: it requires the offending content to be removed or amended, it names the brand and the creator publicly on the ASA website, and it becomes part of the public record that journalists, competitors, and other complainants reference for years afterwards. The ASA itself does not fine. The teeth come from elsewhere — repeated breaches are referred to the Competition and Markets Authority, which under the Digital Markets, Competition and Consumers Act 2024 (DMCC Act 2024, now in force) now has direct enforcement powers against misleading commercial practices, including hidden advertising. The CMA can impose substantial penalties under its new direct-enforcement consumer protection regime — the exact penalty levels are set by the CMA on a case-by-case basis under DMCC Part 4 Chapter 1 (Protection from unfair trading), but the regime is materially heavier than the pre-2026 settlement-only model.

Two other UK statutes overlap with the ASA framework for influencer content. The Online Safety Act 2023 imposes duty-of-care obligations on platforms (Instagram, TikTok, YouTube, X) for content targeting children, with knock-on effects for any creator marketing alcohol, gambling, HFSS food or other restricted categories to under-18 audiences. The Consumer Protection from Unfair Trading Regulations 2008 — partly replaced by the DMCC Act 2024 — historically governed misleading commercial practices and remains relevant for pre-DMCC cases still in pipeline. For most 2026 brand-team purposes, CAP Code Section 2 plus DMCC Act 2024 is the working framework.

CAP Code Section 2 establishes that all marketing communications must be obviously identifiable as such. For influencer content, the ASA has spent the better part of a decade clarifying through individual rulings what "obviously identifiable" actually means in practice. The following 8 obligations are the working framework brand teams should treat as a pre-publication checklist for every paid UK creator post.

1. Caption disclosure at the start, not the end. The disclosure word (#ad, Ad, Advertisement) must appear in the opening lines of the caption — visible without the audience having to tap "more" to expand. Disclosures buried at position 18 of 22 hashtags fail Section 2. The ASA's position, repeated across rulings, is that a disclosure the audience has to hunt for is not obviously identifiable.
2. Video disclosure in the first frame, not in the description. For Reels, TikTok videos and YouTube content, the disclosure must be visible in the first frame as an overlay or in the on-screen caption — the audience should not need to read the video description below the player to know they are watching an ad. Spoken disclosure in the audio also qualifies if it comes within the first few seconds.
3. Audio-only content needs spoken disclosure up front. Podcast ads and audio-only Instagram Stories audio must include the disclosure within the first few seconds of the segment, in clear spoken English. Background music with the word "ad" buried in the lyrics does not qualify.
4. Platform Paid Partnership tag alone is not enough. The platform-native paid-partnership label (Instagram's Paid Partnership tag, TikTok's Branded Content tag, YouTube's Includes Paid Promotion banner) is a useful supplement but is not, on its own, a sufficient disclosure under ASA practice. The audience can scroll past the small label without noticing. The disclosure word must also appear in the caption text or video overlay. Use both belt and braces — platform tag plus caption disclosure.
5. Acceptable wording is a short list. "#ad", "Ad", "Advertisement", "Advertorial" are the safe defaults. "Paid Partnership with [brand]" written into the caption qualifies. "#sp" (sponsored), "#aff" (affiliate), "#spon", or "#collab" alone do not — the ASA position is that these abbreviations are marketing-industry shorthand that ordinary UK consumers do not reliably recognise. "Thanks to [brand]" without "#ad" also does not qualify.
6. Gifted product is a material connection — disclose as "Gifted" or "#gifted". When a brand sends a creator product with no cash payment but the creator posts about it, the ASA treats the gift as a material connection requiring disclosure. The accepted UK wording is "Gifted", "#gifted", or "Thanks to [brand] for the gift" combined with one of the standard "#ad" / "Advertisement" labels. PR packages above approximately £40-50 in retail value should always be disclosed when covered.
7. Affiliate links require disclosure even with no other brand relationship. An affiliate commission is a material connection. Posts featuring affiliate links must include "#ad" or "#affiliate" in the caption — the link disclosure alone (e.g. "link in bio for X%") does not satisfy Section 2 in isolation. Combined disclosure ("Ad — affiliate link in bio") is the safe form.
8. Whitelisted / dark-post / boosted creator content carries the brand's responsibility. When a brand boosts a creator's post as a paid ad on the platform's ad network (Meta whitelisting, TikTok Spark Ads, YouTube creator collab ads), the boosted content is a marketing communication originating from the brand. The brand bears legal responsibility under CAP Code Section 2, and the disclosure must remain visible across all served impressions including the boosted versions.

One additional pattern worth calling out: retrospective disclosure does not save the original post. Adding "#ad" to a caption three days after publication when the ASA receives a complaint does not retroactively make the original publication compliant — the breach occurred at the moment of publication. Brands and creators should treat the first publication as the only one that matters for compliance, and audit pre-publication, not post-complaint.

The Digital Markets, Competition and Consumers Act 2024 (DMCC Act 2024) is the most significant change to UK consumer protection law in a decade. The Act received Royal Assent in May 2024 and its consumer protection provisions — Part 4 — entered into force in stages, with the DMCC consumer protection regime now in force. For influencer marketing, three elements of the Act matter most to brand teams.

First, direct CMA enforcement powers. Before the DMCC Act 2024, the Competition and Markets Authority had to go through the courts to fine a business for breaches of consumer protection law. Under the new regime, the CMA can impose civil monetary penalties directly without first obtaining a court order, on the same model as the Information Commissioner under the UK GDPR. This compresses the enforcement timeline from years to months and removes a key practical deterrent that previously protected brands engaged in low-grade non-compliance.

Second, the unfair trading regime is consolidated and modernised. Part 4 Chapter 1 of the DMCC Act 2024 (Protection from unfair trading) replaces large parts of the Consumer Protection from Unfair Trading Regulations 2008. Section 227 (Misleading omissions) explicitly catches situations where a commercial practice omits material information that the average consumer needs to make an informed transactional decision — exactly the situation when an influencer fails to disclose a paid post. Section 228 (Aggressive practices) covers high-pressure techniques. Combined, these sections provide the CMA with clear statutory hooks for influencer enforcement under the new direct-penalty regime.

Third, fake reviews and hidden incentives are explicitly named. The DMCC Act 2024 expanded the list of always-unfair commercial practices to include publishing fake consumer reviews and failing to disclose paid incentives for reviews — both of which catch the classic influencer pattern of a paid review presented as organic. For brand teams running review-led creator campaigns (the "honest review" framing that briefly became popular in 2023-2024), the DMCC Act 2024 makes that framing legally indefensible without an explicit paid-partnership disclosure.

The practical brand-side impact: an ASA ruling that previously stayed within the self-regulatory framework can now escalate to a CMA investigation and a direct civil penalty under the DMCC regime, without the years-long court process that previously slowed enforcement. For repeat offenders or campaigns at scale, this is a material change in risk. Treat DMCC Act 2024 as the statutory floor beneath the ASA — not as a replacement for CAP Code compliance, but as the layer that turns a public name-and-shame ruling into a financial penalty.

The brand-side compliance audit is a five-pass workflow run before payment, not after publication. It takes 8-15 minutes per creator deliverable for a competent marketing-ops team, and it costs vastly less than fixing a published breach under ASA or CMA pressure. Every UK paid creator campaign on a vetted marketplace like Collabios should treat this audit as a non-negotiable internal control before releasing the final invoice payment.

Pass 1 — Caption opening check. Open the post. Read only what is visible above the "more" / "see more" fold without expanding. Confirm the disclosure word ("#ad", "Ad", "Advertisement", or "Paid Partnership with [brand]") appears in that visible opening. If it does not, the post fails this pass — request a re-publish or an edit before payment.

Pass 2 — Video first-frame check. For Reels, TikTok videos and YouTube Shorts, play the video. Pause at the first frame. Confirm the disclosure is visible as an on-screen overlay, in the creator's spoken opening, or in a hard-coded caption visible within the first second. The disclosure cannot be in the video description below the player only — most viewers never read descriptions.

Pass 3 — Voice / audio opening check. For podcast spots, audio Stories, or video content where the disclosure is verbal, confirm the spoken disclosure happens within the first 5 seconds of the segment and uses clear English ("This episode is sponsored by [brand]" rather than music-buried mentions).

Pass 4 — Platform Paid Partnership tag check. Confirm the creator has activated the platform-native paid-partnership tag (Instagram's Paid Partnership label, TikTok's Branded Content disclosure, YouTube's Includes Paid Promotion option). The platform tag is a supplement — it does not replace the caption disclosure from Pass 1 — but its absence is a separate breach because most platforms require it for transparency under their own community rules in addition to ASA.

Pass 5 — Gifted-product and affiliate-link check. If the campaign involved sending product (any value above approximately £40-50), confirm the post includes "Gifted" or "#gifted" alongside the "#ad" disclosure. If the campaign included an affiliate link or discount code with creator commission, confirm "#affiliate" or equivalent appears. Either is a material connection requiring its own disclosure layer under ASA practice.

The audit is documented on a simple spreadsheet with one row per deliverable: post URL, date checked, Pass 1-5 results, name of auditor, payment release date. For an ASA complaint or a CMA investigation, the audit log is the brand's primary defence — it shows the brand operated reasonable internal controls and acted in good faith, which goes to the question of culpability under DMCC Act 2024 enforcement discretion. Internal audit cost per UK campaign is typically £10-30 per deliverable in marketing-ops time, against a downside of (a) public ASA ruling + take-down, (b) press-cycle reputation hit, (c) CMA referral with direct civil penalty. The arithmetic always favours the audit.

For UK brand teams running cross-border campaigns into the EU, the audit adds one extra dimension: the disclosure must be in the language of the audience, not the creator. A UK brand running a French-audience campaign through a French creator needs "Publicité" or "Collaboration commerciale", not "#ad" — that is Loi 2023-451 territory not ASA territory. Our EU disclosure rules by country guide covers the per-country wording, and the free EU disclosure generator returns the exact text per country + platform + partnership type.

The most common creator concern about ASA rules is that they sound complicated. They are not. Once you know the five wording rules and the placement rules, ASA compliance is a 30-second decision before you hit publish. The penalty for getting it wrong is real — an upheld ASA ruling against your handle stays on the public ASA website indefinitely and reads "[Your Name] — Instagram post not obviously identifiable as an ad" — which is the kind of search result you do not want when brand teams Google you before booking.

Rule 1 — disclosure at the start, always. The first words of your caption, the first frame of your video, the first second of your podcast. "#ad" or "Ad" at the beginning. Not at position 18 of 22 hashtags. Not in the second paragraph. Not "more" / "see more". At the start.

Rule 2 — use accepted wording. "#ad", "Ad", "Advertisement", "Advertorial", "Paid Partnership with [brand]" all work. "#sp", "#spon", "#aff", "#collab", "#brandlove", "#thankyou", "@brand sent me this" all fail. If in doubt, pick "#ad" — it is the shortest universally-accepted form.

Rule 3 — platform tag plus caption tag together. Toggle on the Paid Partnership tag (Instagram) / Branded Content disclosure (TikTok) / Includes Paid Promotion (YouTube). Then ALSO write the disclosure in the caption. Belt and braces. The platform tag alone is not sufficient under ASA practice, even though brands occasionally ask you to skip the caption disclosure to keep the post "looking organic". Politely refuse — the ruling lands on your name, not theirs.

Rule 4 — gifted is material connection too. If a brand sent you a product (PR package, gifted clothing, gifted hotel stay, gifted experience) and you are posting about it, add "Gifted" or "#gifted" alongside "#ad". The ASA treats the gift as a benefit just like cash payment, particularly when the value is above roughly £40-50. There is no minimum-value bright line in CAP Code Section 2, but the working norm is to disclose any meaningful gift.

Rule 5 — affiliate links are paid content. If you have an affiliate link in your bio, in a Story sticker, or in a YouTube description, the post that drives traffic to that link is paid content. Add "#ad" or "#affiliate" to the caption. The argument that "I would post about this even without the commission" does not satisfy Section 2 — the commission is a material connection regardless of editorial preference.

For AI-generated content (image, voice, or video) used in a paid post, the ASA has been clear since 2024 that the disclosure obligation is unchanged — the creator and the brand are still responsible for disclosing the marketing nature of the post, and additionally for ensuring AI-generated content does not breach other CAP Code sections (misleading claims, image manipulation rules). If you generate or heavily edit imagery with AI for a brand campaign, add the standard "#ad" plus disclose the AI use in the caption ("AI-generated image" or "Created with AI"). The ASA has not yet published a fully-codified AI-disclosure rule, but acting transparently here avoids becoming the test case.

For UK creators working with EU brands or US brands, the rule extends: disclose in the language of your audience. UK creators posting to a UK audience use English (#ad). UK creators with significant French / German / Spanish / Italian audience share need to consider whether the EU per-country rules apply additionally — Loi 2023-451 in France, UWG §5a in Germany, RD 444/2024 in Spain, AGCom in Italy. The safest practice is to add the local-language disclosure as a second tag when the audience is substantially non-UK. If you run a UK-based account but get booked by a French brand for a campaign targeted at France, the disclosure is governed by Loi 2023-451 ("Publicité" in French) not ASA — the brand should brief you on this in the contract, but if they don't, ask.

The escalation path for a non-compliant UK influencer post in 2026 has five possible stages. Most cases stop at stage 1 or 2. Stages 3-5 are reserved for serious, repeated, or large-scale breaches and apply more often to brands than to individual creators — but the public ruling at stage 2 still lands on the creator name.

Stage 1 — informal complaint. A member of the public, a campaign group or a competitor submits a complaint via the ASA online form. The ASA reviews and either dismisses (clearly no breach), informally resolves (asks the creator to edit or add disclosure), or progresses to formal investigation. Most informal complaints are resolved at this stage in 2-4 weeks with a quiet edit, no public ruling.

Stage 2 — formal ASA ruling. The ASA opens a formal investigation. The creator and the brand receive a written notice and have an opportunity to respond. The ASA issues a ruling: Upheld, Not Upheld, Informally Resolved, or Withdrawn. Upheld rulings are published on the ASA website naming the brand, the creator, the platform, the offending post URL, and the specific CAP Code section breached. The post must be removed or edited. A representative 2026 upheld ruling against Guangzhoushi Yingyi Maoyi Youxiangongsi t/a LANPN concerning a Gemma Markland Instagram post (27 May 2026) was decided on exactly this basis — the post "was not obviously identifiable as an ad" under CAP Code Section 2. The ASA has issued similar rulings against creators and brands continuously since 2018; the LANPN/Markland ruling is one of many on the live record.

Stage 3 — ASA sanction escalation. Repeated breaches or non-compliance with a ruling trigger ASA sanctions: removal of paid search advertising privileges (the ASA can ask Google to delist non-compliant pages), placement on the ASA non-compliant online advertisers list, and referral to the relevant statutory regulator. For most creators and SME brands this is the point where the reputational cost becomes operationally painful.

Stage 4 — CMA referral under DMCC Act 2024. The ASA refers serious or repeated breaches to the Competition and Markets Authority. Under the DMCC Act 2024 direct-enforcement regime now in force, the CMA can open an investigation and impose civil monetary penalties without going through the courts. The CMA has published its preferred enforcement model (engagement before penalty) but the penalty option is now real, immediate, and material.

Stage 5 — criminal liability for serious or persistent breaches. In the most serious cases — typically involving misleading commercial practices that cause measurable consumer harm — criminal proceedings under the Consumer Protection from Unfair Trading Regulations 2008 (legacy provisions) or DMCC Act 2024 enforcement powers can lead to fines or, in extreme cases, custodial sentences. Stage 5 is rare for influencer marketing and is reserved for the worst pattern offences. The realistic risk for most brands and creators is stages 1-3, and occasionally stage 4 after the DMCC Act came into force.

The single most underrated cost across all five stages is the press cycle. An upheld ASA ruling against a notable brand or creator is a near-guaranteed story in The Drum, Marketing Week, Campaign UK and the consumer press. The Google search results for the brand and the creator now include the ruling for years afterwards. The financial penalty under DMCC Act 2024 is recoverable; the reputational damage compounds. This is why the brand-side audit workflow above costs a fraction of what fixing a published breach costs after the fact.

I run Collabios. We are a manually vetted creator marketplace operating across the UK plus 13 EU markets, with built-in compliance tooling. Specifically for UK paid creator campaigns we did three things that matter for ASA + CMA compliance.

Every UK creator profile is verified and contactable. ASA enforcement starts with the brand and creator being identifiable — the ASA needs to send the formal notice to a real party. Collabios profiles carry verified contact information, the trading name of the creator (sole trader or limited company), and the operating jurisdiction. For UK brands this removes the "the creator vanished after taking payment" risk that the ASA cannot help with retrospectively.

The contract engine bakes CAP Code Section 2 wording into every UK creator agreement. Brands using the Collabios contract template for a UK creator campaign get an automatic clause requiring the disclosure word ("#ad" / "Advertisement" / "Paid Partnership") at the start of every deliverable, plus the platform Paid Partnership tag, plus gifted-product disclosure if relevant. If the creator publishes without the required disclosure, the breach is also a contract breach, which means the brand can withhold payment and require a re-publish without escalating to the ASA. This is the single biggest practical risk-reduction lever for UK brand teams: enforce ASA-compliance contractually so most cases never reach the ASA at all.

The disclosure layer is language-aware for cross-border UK-EU campaigns. When a UK brand books an EU creator on Collabios, the platform surfaces the appropriate national disclosure wording for the audience country — "Publicité" for France (Loi 2023-451), "Werbung" for Germany (UWG §5a), "Pubblicità" for Italy (AGCom), "Publicidad" for Spain (RD 444/2024), and "#ad" for the UK and the Netherlands. The brand-creator message thread reminds both parties of the obligation at the moment the deliverable is committed, and the contract clause embeds it. This was built specifically because most UK brand teams do not realise that an ASA-compliant "#ad" disclosure is not enough for the French portion of their audience, and that the per-country fines (€300,000 in France under Loi 2023-451, €250,000 in Italy under AGCom, hundreds of thousands of euros in Spain under RD 444/2024) materially exceed what the ASA itself imposes.

For UK brand teams running a first paid creator campaign, the cleanest path is to browse the Collabios marketplace, filter to UK creators in your niche, run the booking with the platform contract engine handling the CAP Code clause automatically, and execute the 5-pass audit (above) before releasing final payment. For UK creators wanting to be booked by brands that take compliance seriously and pay reliably, create a Collabios profile with verified contact details, your niche and your audience demographics — that is enough to start receiving paid briefs within days, with the disclosure obligations clearly stated by the brand in writing before you accept the work.

Working from the founder seat watching UK brands run creator campaigns on Collabios in 2026, the single most consistent finding is that the brands which treat ASA compliance as a cost are the ones that eventually pay it. The brands which treat ASA compliance as a quality control on the campaign itself — the same way a finance team treats VAT compliance — never pay it, and their creator relationships are also materially better because the creators they book trust the contract terms.

The UK in 2026 sits in a slightly awkward regulatory transition. The DMCC Act 2024 consumer protection regime is in force, the CMA has direct enforcement powers it did not have a year ago, and the press cycle around influencer marketing accountability is louder than it has been at any point since 2018. At the same time, the practical effort required to be compliant has not increased — the rules are the same five-pass audit they were in 2023. What changed is the size of the penalty if you skip it.

If you are a UK brand starting a paid creator campaign in 2026, the one thing I would tell you that nobody else will: write the CAP Code Section 2 wording into your contract and audit pre-payment, not post-publication. That single discipline removes 90 percent of the practical ASA risk for the same operational cost as one extra spreadsheet column. If you are a UK creator taking paid briefs, the one thing I would tell you that nobody else will: refuse the brief that asks you to skip the disclosure to make the post "look organic". The ruling lands on your name, not the brand's — and the brand teams worth working with will respect you more for holding the line.