Before you publish affiliate claims, check the five rule sets

What to take away

A three-person agency in Leeds publishes a comparison page for two rank tracking tools. One link is an affiliate link. The page quotes a client result, and both tools hold client keyword data. Five rule sets touch that page, and none of them announce themselves.

Who the rules apply to

Four rule areas shape SEO tools rules and ethics: what you claim, how you identify yourself, what data you hold, and what you sign. Each has a different regulator and a different remedy.

The Advertising Standards Authority writes and enforces the advertising codes. The Information Commissioner's Office covers data protection. The Competition and Markets Authority pursues breaches of consumer law. Contract disputes end up in court.

Scope covers agencies, in-house teams, freelance affiliates and the vendors themselves. A solo consultant running an affiliate review site carries the same advertising duties as a listed software company.

England, Wales, Scotland and Northern Ireland share advertising and data protection rules. Contract law and accessibility legislation differ, so check the jurisdiction before reusing a template.

Our breakdown of the data and sources behind SEO tools advertising rules lists the documents worth keeping before you publish a claim.

Advertising claims and the CAP Code

Comparison pages are marketing communications. That brings them inside the CAP Code rules for non-broadcast advertising, alongside blog posts, emails and social content.

The code expects evidence before publication, not after a complaint arrives. A claim that one tool outranks another needs a stated method and a dated test.

Testimonials must be genuine and relevant to the claim they support. A quote about support quality cannot prop up a ranking claim.

Absolute wording is the usual trap. "The most accurate rank tracker" invites a challenge. "Tracked 500 keywords with a median position difference of two places in our June sample" invites a reader.

Keep the raw evidence behind each claim. Dated screenshots, exported tables and the keyword list travel well if a complaint lands.

Information duties for online services

The Electronic Commerce (EC Directive) Regulations 2002 set information requirements for online service providers. Name, geographic address and an email contact must be easy to find.

Pricing has to be clear before a purchase decision. If a licence renews automatically, the renewal price belongs on the page rather than in a help article.

Commercial communications must be identifiable as commercial. A page styled as editorial that is really an advertisement creates a separate problem under consumer protection law.

One page carrying company details, registration number and contact routes does the job. Link it from the footer of every page you publish.

Keep those details accurate. A discontinued trading address on a contact page undermines trust and raises its own compliance question.

Pricing claims and consumer law

A headline price should include what a buyer must pay. If VAT applies, show it beside the figure rather than at checkout.

Drip pricing, where extra fees appear late in a purchase, breaches consumer law. Setup charges belong in the first table a reader sees, not at the payment step.

Discounts need a genuine earlier price. A permanent "50% off" badge is a misleading action, not a house style.

Tool vendors carry the same duties, so a reseller arrangement puts you in the middle. Ask what claims the vendor will stand behind before you repeat them.

Accessibility and indexability

Accessibility duties for service providers sit under the Equality Act 2010 in England, Wales and Scotland. Northern Ireland has separate disability discrimination law. The benchmark most teams work to is the WCAG 2 overview from the W3C.

Search engines read what people can read. Missing heading structure, empty link text and colour-only signals hurt assistive technology users and crawlers alike.

Build pages that work before JavaScript runs. GOV.UK's guidance on progressive enhancement explains why the underlying HTML should carry the content.

Keyboard and screen reader checks before launch cost far less than retrofitting a live template.

Ask vendors for a current accessibility statement and a named contact for remediation. Public sector buyers in England expect one, and private buyers increasingly do too.

Technical audits and site health

A crawling tool surfaces broken links, redirect chains and duplicate titles quickly. Semrush's technical site audit features show the categories a typical crawl reports, from crawlability through to internal linking.

Ethics apply to crawling as much as to publishing. A crawl should respect a site's robots file, stay inside an agreed rate, and leave personal data alone.

Do not crawl a competitor's site to lift content, pricing tables or customer lists. That can breach the contract terms you accepted when you signed up.

Store audit output with a date on it. If site health later appears in marketing, that file is your evidence.

Search engine guidelines and penalties

Search engines publish their own rules, and they can enforce them without a regulator. Paid links, cloaking, scraped content and doorway pages all attract manual action.

Those guidelines are not law, but they sit inside most tool contracts. Vendors commonly reserve the right to suspend an account used for link schemes.

Documentation changes quietly. A tactic that was acceptable last year may now sit outside the guidance, so record the date you checked.

Build the habit before a new tactic goes live, not after a traffic drop.

Data protection in SEO tooling

Client keyword lists, CRM exports and call tracking data are personal data when they identify a person. Loading them into a third-party dashboard makes that vendor a processor under UK GDPR.

A written processor agreement should cover purpose, security, sub-processors and deletion. Ask where the vendor stores data and where it backs up.

Transfers outside the UK need a lawful mechanism, such as an adequacy finding or the international data transfer agreement. Ask which one applies before client data leaves.

Our guide to data protection for SEO tools covers retention settings and the transfer questions worth raising before signature.

Switch off features you do not use, set a retention period, and remove client data when a contract ends.

Client data and retention

An SEO tool account often holds more than rankings. Search console exports, backlink profiles and on-page crawls can carry names, emails and contact form submissions.

Set a retention period per client and write it down. Indefinite storage is hard to justify once a contract has ended.

Subject access requests reach the agency as controller, not the vendor. You need a route to find, export and delete one person's data across every platform in use.

A breach at a vendor is still your notification problem. The ICO expects notification within 72 hours of becoming aware.

Disclosure of paid placements

Affiliate links and paid placements must be obvious before a reader clicks. A line buried under a newsletter form does not meet that test.

Disclosure belongs beside the recommendation, in plain words. Three words at the top of a comparison table usually suffice.

The disclosure policy data and sources for SEO tools article shows where to record who paid, when and for what.

Log every commercial arrangement. It answers a reader question and a regulator enquiry with the same file.

AI content and disclosure

Generated copy is not banned, but unverified claims stay your responsibility whoever typed them. A tool cannot substantiate a benchmark on your behalf.

Say when a page was produced with assistance, particularly where a reader might assume human testing. Several regulators treat omission as misleading.

Keep a review step before publication. Someone named should check every figure, link and comparison in a page before it goes live.

Contracts, licences and renewals

Seat counts, term length and notice periods drive the real cost of a platform. Check whether unused seats can be removed at renewal or only at signature.

Watch for minimum term clauses that survive termination. Some agreements keep charging for 90 days after notice, and a few require notice in writing by post.

Data export on exit deserves its own clause. Ranking history, annotations and audit records should leave with you in a usable format.

Businesses in England sign under English contract law, and Scotland differs on some points. This article is general guidance, so take advice from a qualified solicitor on your own facts.

Our explainer on commercial contracts for SEO tools in England covers renewal traps and termination wording.

Working with freelancers and contractors

Freelance writers and link builders act for you, and their output becomes your marketing communication. Brief them on claim standards in writing.

An engagement letter should require evidence for any statistic and name who signs off publication.

Payment on results creates risk. A contract that pays per published link can push a writer towards tactics you would not approve.

Keep one named person accountable for each page, even when several contractors contributed.

A worked compliance budget

Illustrative figures only. A three-person consultancy in England might pay £600 a month for platform licences across three seats, or £7,200 a year.

Licence fees repeat every year. Remediation is usually one-off, though a redesign resets it.

Staff time for audits is the item most often left out. A single upheld advertising complaint costs more in staff hours than the row above it.

Ethics beyond legal minimums

Legality sets the floor rather than the standard. A comparison can be lawful and still misleading through omission.

Say who funds the work. If a vendor pays for the test, that fact belongs in the same paragraph as the result.

Do not publish a ranking change without naming the location, device and date. Rank tracking varies by postcode and by day.

Treat client data as borrowed rather than owned. Delete what you no longer need and answer questions about it plainly.

Correct errors in public. An updated note with a date does more for credibility than a silent edit.

Records worth keeping

Keep a dated file per published claim. The keyword list, the export, the tool version and the person who ran it make a complaint answerable in an afternoon.

Store licence agreements, processor terms and disclosure logs in one place with renewal dates. Diarise notice periods at signature, not three weeks before renewal.

Retain audit reports for as long as the claim stays live. Old pages keep working long after a campaign ends.

Review the file once a year. Closed accounts, retired pages and expired licences should drop out of the set you keep.

Enforcement and complaint routes

The ASA publishes rulings, and a complaint can be filed by a competitor, a customer or a member of the public. Rulings are public and indexed.

The ICO handles data protection complaints and can issue fines, reprimands and enforcement notices. The CMA can act on consumer law breaches.

None of these routes require a large budget from the complainant. That is the practical reason to fix wording and disclosure before publication.

Reviews, benchmarks and fair comparison

A comparison should state the date, the sample and the metric. Rankings move weekly, so an undated table misleads by default.

Blind tests reduce bias but need consistent conditions: the same keyword set, location and device type across every tool.

Score what you can observe. Interface speed, export options and support response times are easier to defend than a single accuracy verdict.

Publish the raw scores where you can. A reader who can see the table behind a verdict is less likely to feel misled, and a regulator can follow the working.

Our guide to review and comparison methods for 2027 sets out a scoring approach you can repeat each quarter.

Common questions

Do the UK advertising codes cover SEO comparison pages?

Yes. The CAP Code covers non-broadcast marketing communications, and a comparison page promoting a tool is one. Claims need evidence you can produce on request.

Do I need to pay the ICO data protection fee?

Most organisations processing personal data in the UK must pay it unless an exemption applies. Check the ICO's registration self-assessment, since exemptions are narrow.

Must affiliate links be labelled?

In practice, yes. The link must be identifiable as commercial before a reader clicks, and a footnote at the bottom of a long page is not enough.

Can a plan price rise mid-contract?

It depends on the clause you signed. Many agreements allow increases with notice, so check the variation term before you commit to a fixed budget.