AI Marketing Ethics

What this guide is, and is not

This is general information about the UK rules most relevant to AI in marketing, as we understand them in September 2026, with sources. It is not legal advice, and some areas, copyright in particular, are genuinely unsettled. Before acting on any rule below, check the regulator's current guidance, and where a decision carries real legal or commercial risk, take advice from a qualified professional.

The good news is that there is no separate "AI marketing law" to learn. Most obligations come from rules that already applied to marketing. AI changes how easily they can be broken at scale.

The rules that already apply

UK rules relevant to AI in marketing

Regime	What it covers for AI marketing	A practical step
UK GDPR and Data Protection Act 2018 (ICO)	Using personal data in AI tools, profiling and personalisation; fairness, transparency, lawfulness; solely automated decisions with significant effects	Keep personal data out of tools without an approved basis and contract; update privacy notices to describe AI use
PECR (ICO)	Marketing emails, texts, calls and cookies, including AI-written and AI-sent messages	Confirm consent or soft opt-in for every list before any automated send
CAP Code (ASA)	Whether AI-made ads mislead, offend or are socially irresponsible; when AI use needs disclosing	Apply the same claim checks to AI-made ads; disclose AI where the audience would otherwise be misled
Consumer law on reviews (CMA, DMCC Act)	Fake reviews, including AI-generated ones, and concealed incentivised reviews	Never generate or buy reviews; keep a published policy on reviews
Copyright (CDPA 1988)	Ownership of AI-assisted output and use of others' work	Keep a human creative contribution on key assets; avoid prompts that imitate identifiable works or artists

Data protection: the ICO's position

The Information Commissioner's Office's guidance on AI and data protection is organised around the UK GDPR principles and includes material on fairness, transparency and accountability, as well as on when solely automated decision-making engages Article 22. The ICO describes transparency as being clear, open and honest with people from the start about who you are and why and how you process their data.

For marketing, the common issues are practical: customer data pasted into a general AI tool, profiling that customers would not expect, and privacy notices that say nothing about AI. None requires a lawyer to spot. All are easy to create by accident.

Electronic marketing: PECR, now with larger penalties

The ICO explains that unsolicited marketing email to individual subscribers needs their consent or all the conditions of the soft opt-in, and that the soft opt-in does not cover bought-in lists. AI does not change these rules; it just makes it possible to breach them to thousands of people in an afternoon.

The stakes rose with the Data (Use and Access) Act 2025. The ICO's published summary of the changes describes the Act as aligning PECR fines with the UK GDPR maximum and removing the need to show that a contravention caused substantial damage or distress. Check the ICO's current guidance for which changes are in force and the exact penalty levels.

Advertising: no blanket disclosure rule, but no exemption either

The Committee of Advertising Practice has published guidance on disclosing AI in advertising, which, as summarised in published commentary, sets no blanket requirement to disclose AI use in UK ads. Instead, marketers should ask whether the audience is likely to be misled if AI use is not disclosed, and, if so, whether a disclosure clarifies the ad's message or contradicts it. Ads made using AI are subject to the same rules on misleadingness, harm and social responsibility as any other. Read CAP's current guidance before a campaign that relies heavily on AI-generated imagery.

In practice: an AI-generated image showing a skincare result the product cannot achieve is misleading with or without a label. An AI-drafted headline that a person has checked is simply your ad.

Reviews: AI-generated reviews are banned practice

Under the Digital Markets, Competition and Consumers Act, certain review practices are banned outright. The Competition and Markets Authority's fake reviews guidance (CMA208) covers fake reviews and concealed incentivised reviews, and requires businesses that publish consumer reviews to take reasonable and proportionate steps to prevent and remove them. Generating reviews with AI, or commissioning someone who does, falls squarely within what is prohibited.

Copyright: unsettled, so be careful

Two questions matter for marketers: who owns what AI produces, and whether using AI risks infringing someone else's work.

On ownership, section 9(3) of the Copyright, Designs and Patents Act 1988 provides that for a computer-generated work, the author is taken to be the person by whom the arrangements necessary for its creation are undertaken. Computer-generated means a work with no human author. We are not aware of a court ruling on how this applies to modern generative AI, and some academics have argued for its repeal.

On training and inputs, the UK government has published a Report on Copyright and Artificial Intelligence following its consultation on the subject. Published commentary describes the report as stepping back from the earlier preferred option of a broad commercial text and data mining exception with an opt-out, leaving the existing narrow non-commercial research exception in place, and naming labelling of AI-generated content, transparency, creator control and digital replicas as areas for further work. Read the report itself before relying on its position, and expect this area to keep moving.

Practical caution: keep meaningful human creative input on assets you need to own, do not prompt for work "in the style of" a named living artist or copy identifiable material, and check your AI tools' terms on ownership and indemnity.

The questions the law does not answer

Legal compliance is the floor. These questions cover decisions the rules leave to you:

1. • Would the customer be surprised? If people would be uncomfortable learning how their data or behaviour shaped a message, reconsider it, even where it is lawful.
2. • Does it exploit a vulnerability? AI can find the moment someone is most susceptible. Using that on people in debt, ill health or distress is wrong regardless of the targeting rules.
3. • Is the persona honest? A chatbot or social account that lets people believe they are talking to a human, when that matters to them, is deceptive.
4. • Is anyone accountable? For every AI-assisted output that reaches the public, a named person should be able to explain and defend it.
5. • Would we publish how we did it? If a method would embarrass you on the front page, it is probably not one to use.

How we apply this

At AI for Marketing, AI prepares work and a person approves anything that reaches a client or the public, and we do not generate reviews or testimonials. How a client's data is handled is agreed with that client before any access is given. The guide for professional services covers extra obligations in regulated sectors.

FAQ

Do I have to label AI-generated marketing in the UK?

There is no blanket legal requirement. CAP's position is that disclosure is needed where the audience would otherwise be misled. Some platforms have their own labelling rules for AI-generated media, so check those too.

Can I use AI to write replies to customer reviews?

Yes. Drafting replies to genuine reviews is not the issue. Generating reviews, or having AI post as customers, is what consumer law prohibits.

Who owns marketing copy written with AI?

Where a person makes a real creative contribution, ordinary authorship rules are likely to apply. For output with no human author, UK law has a specific computer-generated works provision that, as far as we are aware, no court has yet applied to modern generative AI. Check your tool's terms as well.

Is personalising emails with AI lawful?

It can be, if you have a lawful basis for the data used, the email rules are met, and the personalisation is something recipients would reasonably expect. Solely automated decisions with significant effects on people raise further requirements.