UK Law and Practice Contributed by: Huw Morris, Dominic Bray, Nick Swimer and Rebecca Coleman, Lee & Thompson LLP
ate language, and data should be used for specified legitimate purposes only. Profiling or targeted market - ing to children requires careful consideration to ensure it is appropriate and lawful. The ASA rules reflect the UK GDPR (see Section 10 of the CAP Code). The usual ASA and ICO sanctions apply (see 6.1 Email Marketing ). In 2023, the ICO fined TikTok GBP12.7 million for breaching the UK GDPR and misusing children’s data. TikTok failed to take sufficient steps to identify and remove underage children using its platform. 6.6 Other Rules The DPA supplements the UK GDPR to ensure that personal data collected during advertising activities is processed lawfully and transparently. In January 2025, having already reviewed the top 200 websites in the UK, the ICO announced its intention to extend its review of cookie usage and compliance to the top 1,000 UK websites to ensure that online tracking gives users clear choices and confidence in relation to how their information is used. The ICO confirmed that it had already communicated concerns to 134 organisations. At the same time, it published guidance on implementing “consent or pay” models where users are given the choice between consenting to personalised ad-tracking or paying in some way (or otherwise a non-tracking alternative). The ICO confirmed that such models need to ensure that the choice is genuine, fairly priced and not coercive. CAP has completed its consultation on the rules regarding the collection and use of data for market - ing, including Online Behavioural Advertising (OBA). As a result, it has introduced updated rules into the CAP Code, including replacing the former Section 10 (“Database Practice”) with a revised Section 10 that also includes the former Appendix 3 on OBA, now in force and renamed “Use of Data in Marketing”. These changes bring the Code into line with the UK GDPR, modernising the regulatory framework for data-driven marketing, strengthening requirements around trans - parency, valid consent and consumer opt-out mech - anisms, and clarifying marketers’ responsibilities for
lawfully processing personal data (including through OBA).
7. Sweepstakes and Other Consumer Promotions 7.1 Sweepstakes and Contests A sweepstake (prize competition) must comply with the provisions of the Gambling Act 2005 so as not to be an unlawful lottery. To be a lawful prize competi - tion, it must either: • be free to enter or have a free entry route; or • involve an element of skill, judgement or knowl - edge. If neither criteria apply, the competition will be deemed a lottery and must be licensed. Assuming that the promotion is lawful, marketers must also ensure that the competition terms and mechan - ics comply with CAP Code rules for prize promo - tions. These require that all significant conditions and restrictions are made clear upfront, that promotions are run fairly (eg, regarding rules changes, entry route and availability of prizes) and that the selection of win - ners is subject to independent supervision (unless randomly generated by computer). Marketers must not overstate the chances of winning and must antici - pate the likely demand for prizes. 7.2 Contests of Skill and Games of Chance Pay-to-enter competitions may be lawful if they pro - vide an easily accessible free entry route or if they involve an element of skill, judgement or knowledge. The skill, judgement or knowledge element must be sufficiently demanding to deter a “significant propor - tion” of entrants from entering the competition at all, or from winning a prize. It is a relatively low bar and there are limited instances of the Gambling Commis - sion taking enforcement action under the Gambling Act. 7.3 Registration and Approval Requirements If a competition is deemed to be a lottery, a lottery licence must be obtained. Most prize competitions will not be “lotteries”, in which case there is no require -
309 CHAMBERS.COM
Powered by FlippingBook