Event marketing rules and ethics: check before you plan

Event marketing rules and ethics decide whether a campaign can run at all. Before you brief an agency or book a platform, work through the rules that apply to your promotion and the judgement calls they do not settle. This guide names both, so your compliance sheet can cite the right code, regulator and duty.

What to take away

The responsibility sits with the brand, not the agency

Event marketing teams often outsource creative work and assume the agency carries compliance risk. That is wrong. The business promoting the product or service is normally responsible for the claims, even if an agency wrote them.

The rules that apply are the CAP Code, which covers non-broadcast advertising, and the BCAP Code, which covers broadcast advertising. Both explain how the Advertising Standards Authority treats promotions, and both apply to event marketing. They also show why sign-off should sit with a named person inside the brand, not be delegated entirely.

The Advertising Standards Authority enforces the UK advertising codes for event marketing promotions. These cover misleading claims, comparative statements and promotional offers.

A ticket page claiming "limited availability" when untrue breaches the codes, no matter who built it. A social post implying a discount ends tonight, but it runs all month, does the same.

A practical control is a one-page compliance sheet for each campaign. It should name the person who signs off claims, the evidence held for each claim, and the date the promotion ends. This takes an hour to prepare and prevents the most common breach: a claim that was true when written but stale by publication.

Advertising codes and the claims you can make

Event promotions often rely on urgency, exclusivity and price comparisons. Each of these has a rule attached. Urgency claims must be accurate. Exclusivity claims must be genuine. Price comparisons must compare like with like and show the previous price for a meaningful period.

Influencer activity is covered too. If a creator is paid, gifted tickets or given commission, the commercial relationship must be clear. A caption tag is not always enough if the audience cannot see it before engaging.

The CAP Code requires paid partnerships to be labelled so the commercial relationship is obvious, and the Competition and Markets Authority takes action against influencers and brands that hide advertising. The label has to be visible before someone engages, not buried in a hashtag on a phone screen.

Competitions and prize draws add another layer. Free entry routes, closing dates and winner selection need to be stated before people enter. The codes treat a promotion as misleading if a significant condition is buried in terms and conditions. Put the key conditions next to the entry point, not three clicks away. Where a promotion amounts to a lottery, the Gambling Commission's licensing rules apply alongside the CAP Code.

The ethics that sit alongside the rules

Complying with the CAP Code is the floor, not the ceiling. Event marketers also make judgement calls that no code settles. A countdown timer that resets when it expires, pressure to buy before the terms can be read, or booking fees revealed only at the final step are dark patterns: they may not breach a rule, but they teach the audience not to trust the next campaign.

Sponsorship and endorsement need the same honesty. If a venue, a platform or a sponsor has paid for prominence, the audience should be able to tell. Accessibility is an ethical choice as well as a legal one, and honest descriptions of what a ticket includes cost little and widen who can attend.

The test worth applying before launch is simple: would the audience feel misled if they saw how the campaign was built? If the answer is yes, change the campaign, whether or not a regulator would act.

Data protection is where most event teams get caught

Collecting attendee data is normal for event marketing, but the lawful basis for holding it is not automatic. Consent needs to be specific, informed and easy to withdraw. Legitimate interests can apply in some cases, but that requires a documented assessment, not a default assumption.

The Data Protection Act 2018 sits alongside the UK GDPR and sets how personal data is handled in practice. Event teams routinely collect names, employers, dietary requirements and accessibility needs.

Some of that is special category data, which needs a higher standard of care. Storing it in a shared spreadsheet with open access is a risk a regulator can see immediately.

The Information Commissioner's Office publishes enforcement action against organisations that misuse personal data. Reading a few recent cases is a faster way to understand risk than reading the full legislation. Fines are not the only cost. Enforcement notices can force a change to how you market for months.

Electronic marketing has its own regime. The Privacy and Electronic Communications Regulations 2003, usually shortened to PECR, require consent for most marketing emails and texts to individuals, and the Information Commissioner's Office's direct marketing guidance explains how consent, the soft opt-in and the right to object work in practice. A campaign can satisfy data protection law and still breach PECR if the list was bought or inherited from a partner.

Retention is the quiet problem. Many event databases hold contact details from events that finished years ago, with no recorded basis for continued marketing. A simple rule, such as deleting marketing consent records after 24 months without engagement, is easier to defend than an indefinite archive.

Health and safety duties at the event itself

The Health and Safety Executive publishes The Event Safety Guide, HSG195, and the Events Industry Forum publishes the Purple Guide, the standard reference for larger events. The duties cover crowd management, temporary structures, electrical safety and fire precautions. These are not marketing tasks, but marketing teams influence them. Ticket sales determine crowd size, and campaign timing determines how quickly an event sells.

If a campaign oversells a venue, the organiser carries the consequence. Marketing should therefore have a direct line to the person responsible for capacity and safety planning. A campaign that fills a space beyond its licensed capacity is a compliance failure, not a success.

Capacity is also a licensing question. In England and Wales, the premises licence, or a temporary event notice for a one-off event, sets the permitted capacity and opening hours under the Licensing Act 2003. A campaign that sells beyond those limits creates a problem the organiser cannot fix on the day.

Accessibility claims also need care. If a promotion says a venue is fully accessible, that statement must be accurate across the whole visitor journey, including the route from the nearest transport link. Under the Equality Act 2010, organisers and venues also have duties to make reasonable adjustments for disabled attendees. A claim that only covers the main hall can mislead disabled attendees and breach the advertising codes.

Contracts with venues, platforms and suppliers

Event marketing rarely happens without third parties. Venues, ticketing platforms, caterers and production companies all sit in the chain. Each contract should state who is responsible for what, and what happens when something fails.

Agency, venue and platform contracts should cover cancellation, force majeure and liability caps, and should say who owns the creative work and the attendee data when the relationship ends.

First, a platform's own terms govern your use of it, and they can change. Eventbrite publishes legal terms covering the platform, organisers and attendees. Agencies should read those terms, not assume the venue's contract covers everything.

Second, liability caps should reflect the real exposure. A CAP set at the fee value is common, but if a supplier failure cancels an event, the marketing spend and lost ticket revenue can dwarf that fee. Negotiate the CAP against the consequence, not the invoice.

A worked example: where compliance sits in the budget

A fictional agency, Northfield Events, plans a two-day product launch in Manchester. The figures below are illustrative and stated in pounds sterling.

Item	Illustrative cost

The compliance review is the line most likely to be cut. At £1,000, it is under 4% of the budget.

If the campaign makes an unsubstantiated claim and the Advertising Standards Authority upholds a complaint, remediation, including amended creative and additional media, can exceed £5,000. Mishandled attendee data adds notification, legal advice and potential regulatory action.

Northfield's team also sets aside £2,000 for contingency. That is sensible, but contingency does not cover regulatory penalties. Those are managed by doing the compliance work before publication, not by holding a reserve.

Building a simple compliance routine

A repeatable routine beats a one-off audit. Before each campaign, confirm four things: the claims and the evidence behind them; the lawful basis for every data collection point; the safety and capacity limits agreed with the venue; and the contract terms with each supplier.

After each campaign, review what happened. Which claims attracted questions? Which data was collected and where is it now? Did any supplier miss a deliverable? Recording these answers takes twenty minutes and builds an evidence trail that is useful if a complaint arrives months later.

Audience research supports this routine. Understanding who the campaign reaches, and what they expect, reduces the chance of a misleading impression forming. Testing the messaging with a small group before launch, and keeping a record of what was tested, gives you evidence if a complaint arrives later.

For UK-wide teams, some rules differ by nation, and while advertising codes apply UK-wide, health and safety enforcement and some licensing are devolved.

For events in Scotland, Wales or Northern Ireland, check the relevant regulator, not an England-only summary. Health and safety enforcement and licensing are devolved, so the authority, the forms and the local rules are not always the same as in England.

Where teams commonly go wrong

Three patterns appear repeatedly. The first is treating compliance as a legal review at the end of a campaign, though most issues are created at the briefing stage.

Second, organisers assume a platform's terms transfer responsibility away from them. They do not.

Third, collecting data just in case, with no defined purpose, is the opposite of what data protection law expects.

A fourth pattern is subtler: using the same creative across all four nations without checking whether a claim is accurate everywhere. A price stated as inclusive of VAT in England is fine, but a promotion that references a specific devolved service may need different wording in Scotland or Wales.

This guide is general guidance only. Individual cases need a qualified adviser, particularly where contracts, data protection or health and safety duties are contested. Use the sources cited here as a starting point, and take advice on the specific facts.

Common questions

Does the Advertising Standards Authority cover social media event promotions?

Yes. The UK advertising codes apply to paid and organic promotional content on social platforms, including influencer posts where there is a commercial relationship. The ASA can act on complaints about misleading claims even when the content was posted by a creator rather than the brand.

Who is responsible for data protection at an event, the organiser or the venue?

It depends on who determines the purpose and means of processing. In most cases the organiser decides why attendee data is collected and is therefore the controller. Venues can be controllers for their own purposes, such as security. Contracts should state this clearly rather than leaving it to assumption.

Do health and safety rules differ across the UK?

Health and safety law is broadly consistent, but enforcement arrangements and some licensing rules differ in Scotland, Wales and Northern Ireland. If your event crosses borders, check the relevant regulator for each nation rather than relying on a single UK summary.

Can we reuse attendee data from a previous event for a new campaign?

Only if you have a lawful basis and the original collection explained that marketing would follow. Consent given for one event does not automatically cover a different event or a different brand. Check the original notice and, if in doubt, seek fresh consent or take advice.

What does ethics add beyond the advertising codes?

The codes set the minimum a campaign must meet. Ethics covers what a regulator is unlikely to catch: manufactured urgency, booking fees revealed at the last step, sponsorship the audience cannot see, and accessibility promises the venue cannot keep. A campaign can pass a compliance check and still leave people feeling misled, and that cost shows up later in complaints and lost trust.