UK press release distribution: ASA and ICO rules to check before you send

What to take away

Where the CAP Code reaches a promotional press release

The UK Code of Non-broadcast Advertising and Direct and Promotional Marketing is known as the CAP Code. It is written and maintained by the Committee of Advertising Practice and enforced by the Advertising Standards Authority. The rules that apply to press releases used promotionally are set out in the Non-broadcast Code - ASA | CAP.

A press release is not automatically outside the code because it is addressed to media rather than the public. If the release makes a promotional claim about a product, service, price or brand, and that claim reaches consumers, the code can bite. That includes releases reproduced verbatim by regional titles, trade press or broadcasters.

The relevant clauses are the ones on misleading advertising, substantiation, comparisons, prices, availability and testimonials. Clause 3 covers misleading claims. Clause 4 covers comparisons with identifiable competitors. Clause 8 covers promotional marketing and Clause 8.1 requires that promotions are conducted fairly. Clause 12 covers online behavioural targeting where the release is also used as a digital ad.

A release that says "the UK's fastest broadband" needs evidence for the comparative claim. A release that says "from £9.99" needs the price to be genuinely available at that figure. A release that says "clinically proven" needs the study behind it, and the study needs to be strong enough to survive a challenge.

Regional variation matters. A release aimed at the North West England or Yorkshire and the Humber media market still sits under the same code as one aimed at Greater London. The difference is usually editorial, not regulatory.

BBC and ITV regional newsrooms and titles in the News Media Association apply their own verification, and a claim that cannot be substantiated will often be dropped before the ASA ever sees it.

Trade bodies such as the CIPR and PRCA publish their own codes of conduct. Those are professional standards, not advertising law. The CAP Code is the one that can produce a published ruling against a named advertiser.

If you are working through the wider set of rules that sit alongside the CAP Code, our guide to advertising rules to check covers the adjacent regimes.

When a release is editorial rather than promotional

A release that announces a genuine corporate event, such as a Companies House filing, a board appointment or an FCA authorisation, is usually editorial. A release that pushes a discount, a prize draw or a product claim is promotional. The line is about the dominant purpose, not the label on the document.

The financial and broadcast edges

Financial promotions sit under FCA rules as well as the CAP Code. Broadcast material sits under the Ofcom Broadcasting Code. A release that is also read out on air, or reproduced in a paid social ad, can be caught by more than one regulator. That is why a single compliance sign-off is rarely enough.

ASA remit, sanctions and the Copy Advice pre-send check

The ASA and CAP operate a self-regulatory system. The ASA investigates complaints and can act on its own initiative. Its remit covers ads in non-broadcast media, including online ads, paid search, social posts and promotional press releases. The structure is described in About ASA and CAP - ASA | CAP.

The sanctions available are published and cumulative. They include requiring the advertiser to withdraw or amend the ad, publishing the adverse ruling, asking search engines and social platforms to remove paid ads, and referring the case to trading standards or other statutory bodies. The full list is set out in Sanctions - ASA | CAP.

A published ruling names the advertiser and stays online. For a listed company or a regulated firm, that is a reputational cost that outlasts the campaign. For a small business, it can affect relationships with retailers and platforms.

The ASA provides Copy Advice, a free and confidential service offered before publication. It will look at a draft release and give a view on whether it is likely to breach the code.

It is not a binding clearance, and it does not cover every possible interpretation, but it is the cheapest way to test a claim before it goes out.

Use it when the claim is comparative, when a price is central, when a health or environmental claim is involved, or when the release is going to be reproduced as an ad. Do not use it as a substitute for legal advice on financial promotions or data protection.

The practical sequence is straightforward. Draft the release. Identify every claim that a reader could treat as factual. Check each claim against evidence. If any claim is uncertain, run it through Copy Advice before distribution. Keep the advice on file.

What a ruling actually looks like

A ruling typically states the ad, the complaint, the ASA's assessment and the action required. It is published on the ASA site and indexed by search engines. That is the concrete consequence that turns a compliance check into a business decision.

Where the CAP Code stops

The CAP Code does not cover editorial content that is genuinely independent of the advertiser. It does not cover political advertising in the same way. It does not replace consumer protection law, which trading standards enforce. It sits alongside those regimes.

ICO consent rules under UK GDPR and PECR for announcement emails

Sending a promotional announcement by email or text to individuals in the UK engages two regimes. UK GDPR governs the processing of personal data. PECR governs electronic marketing. The ICO's guidance on both is collected at Direct marketing and privacy and electronic communications | ICO.

PECR requires consent for electronic mail marketing to individual subscribers, unless a narrow soft opt-in applies. The soft opt-in requires that you obtained the contact details in the course of a sale or negotiations for a sale, that you are marketing similar products, and that you gave an opt-out at collection and in every message.

A press release list built from a conference badge scan will rarely satisfy that.

For consent to be valid under UK GDPR, it has to be given freely, be specific, informed and unambiguous. A pre-ticked box is not consent. A blanket "I agree to receive marketing from partners" clause is not specific. Silence is not consent. You need a record of what the person was told and what they did.

The lawful basis for the processing is usually consent, but it can be legitimate interests for some B2B activity. If you rely on legitimate interests, you still need a PECR gateway for the email itself. The two tests are separate and both must be passed.

Individual rights apply to announcement lists. A person can ask for access, correction, erasure, restriction, objection and portability. They can withdraw consent at any time, and withdrawal must be as easy as giving consent. You need a process that works within one month, extendable by two months for complex requests.

Data minimisation matters. A press list that holds job titles, direct dials, mobile numbers and personal interests is holding more than the announcement requires. Keep the fields you can justify. Delete the rest.

International transfers need a lawful mechanism if any part of the distribution chain sits outside the UK. Check the processor terms of your distribution platform, your CRM and your email service provider.

Our companion piece on provenance to deletion follows the data through the whole announcement cycle.

What consent records should contain

When the soft opt-in might apply

If a customer bought a similar product from you and you offered an opt-out at the point of sale, a follow-up announcement about a similar product may be lawful without fresh consent. The test is narrow. Document the reasoning before you send.

Business-to-business pitching to journalists at work addresses

B2B marketing sits under a different PECR rule. Corporate subscribers, which include many limited companies and public bodies, are not protected by the same consent requirement for email marketing. The ICO's position is explained in Business-to-business marketing | ICO.

A named journalist at a newspaper, broadcaster or agency is usually a corporate subscriber if the address is a corporate one. That does not mean anything goes. UK GDPR still applies to the personal data, and the ICO expects B2B marketing to be relevant, proportionate and easy to opt out of.

Sole traders and some partnerships count as individual subscribers. A freelance journalist working under their own name, using a personal-style domain, may be an individual subscriber. The distinction turns on the legal status of the subscriber, not the job title.

The practical approach for a press office is to keep a media list with a clear source for each contact, a note of the outlet, and a suppression flag. If a journalist asks to be removed, remove them from every list, not just the one that triggered the request.

Pitching is not the same as marketing a product. A genuine news pitch to a newsroom is editorial contact. A promotional announcement that happens to be sent to a journalist is marketing. The distinction matters because PECR applies to the second, and the first is ordinary journalism contact.

Keep the pitch relevant. A release about a Manchester retail launch sent to a Scotland business desk is not proportionate, even if the address is corporate. Relevance is part of the UK GDPR fairness principle.

You can map the different routes an announcement takes, from claims to supplier contracts, in our guide mapped route by route.

Work addresses and personal data

A work email that identifies a person is personal data. The corporate subscriber exemption affects the PECR consent rule, not the UK GDPR duties. You still need a lawful basis, a retention period and a way to handle rights requests.

Media list hygiene

Mailing list checks: provenance, lawful basis and individual rights

Mailing list checks for promotional announcements are the part most PR teams underdo. The list is often inherited, merged or bought. Each of those creates a different risk.

Provenance is the first check. Where did each contact come from? A web form, an event, a business card, a purchased list, a partner list or a previous campaign. If you cannot say, the contact should not be used for a promotional announcement.

Lawful basis is the second check. For individuals, that is usually consent. For corporate subscribers, it may be legitimate interests. Write down which basis applies to which segment. A single list with mixed bases is a compliance problem waiting to be tested.

Consent records are the third check. You need the wording, the date, the source and the scope. If the record only says "opted in", it is not enough to demonstrate consent under UK GDPR.

Suppression is the fourth check. Anyone who has opted out, objected or asked for erasure must be excluded before the send. Suppression must survive list merges and platform migrations.

Individual rights are the fifth check. You need a route for access, correction, erasure, restriction, objection and portability. You need a named owner and a response timeline. One month is the default.

Retention is the sixth check. A press list held indefinitely with no review is hard to justify. Set a review period, remove contacts that have not engaged, and document the decision.

Processor terms are the seventh check. Your distribution platform, CRM and email service provider are processors. You need terms in place, and you need to know where the data is stored and transferred.

If you are still working through the wider regulatory picture, our piece answering six questions on UK regulations covers the common sticking points.

A worked example

A UK software firm plans to announce a new product to 4,000 contacts. The list was built from a webinar, a purchased file and a partner co-marketing deal.

Step 1: separate the list by source. Step 2: apply consent records to the webinar segment and check the wording. Step 3: remove the purchased file unless the seller can evidence consent to the firm's own marketing. Step 4: review the partner deal for joint controller terms.

Step 5: apply suppression across the remaining segments. Step 6: run the release through Copy Advice because it contains a comparative claim. Step 7: record the decisions and send.

That is the difference between a distribution list and a defensible one.

Table: checks by contact type

A pre-send compliance checklist for press release distribution

Run this before every promotional announcement. It is designed for a UK PR team sending to media and to owned lists.

Numbered steps for a new campaign:

Keep the log. If the ASA or the ICO asks, the log is the difference between a documented decision and an unexplained one.

Common questions

Does the CAP Code apply to a press release sent only to journalists?

It can, if the release is promotional and reaches consumers, including through reproduction in media. Editorial announcements about genuine corporate events are usually outside it.

What sanctions can the ASA impose?

The ASA can require the ad to be withdrawn or amended, publish an adverse ruling naming the advertiser, ask platforms to remove paid ads, and refer the case to trading standards or other statutory bodies.

Do I need consent to email a promotional announcement to a work address?

Often no, because many corporate subscribers are outside the PECR consent rule. UK GDPR still applies, and sole traders and some freelancers count as individual subscribers.

What is the soft opt-in under PECR?

It allows email marketing without fresh consent where details were obtained in a sale or negotiations, the products are similar, and an opt-out was offered at collection and in every message.

How long can I keep a press list?

There is no fixed period. Keep it only as long as needed, review it regularly, and document why each contact is still on it.

What should a consent record contain?

The wording the person saw, the date and time, the source, the scope of consent and the method used, such as a tick box or double opt-in.