What rules apply to AI marketing content in the UK?
The same rules as any other marketing. The CAP Code applies however the content was made, and it covers much of what a business posts on its own website and social media. Your marketing must not mislead, must be clear that it's marketing, and must only use genuine reviews.
The ASA calls the CAP Code media-neutral: the rules apply whether a person or a machine made the ad. It warns that a fake celebrity endorsement made with AI, convincing enough to mislead, is likely to break the Code. There's no blanket legal requirement in the UK to say you used AI. The ASA suggests asking whether your audience would be misled if you didn't.
Two rules come up most often. Rule 3.1 says marketing must not materially mislead, and rule 2.1 says it must be obviously identifiable as marketing. The ASA's advice on social media says posts on a business's own channels can be covered where they're directly connected with what it sells.
Can AI help with reviews and testimonials?
It can help you ask for reviews and share them, but it must never write them. Fake reviews are a banned practice under the Digital Markets, Competition and Consumers Act 2024. The CMA describes a fake review as one that claims to be based on a person's genuine experience, but isn't.
The CMA's fake reviews guidance lists buying reviews that were really produced by software, such as bots, as a banned example. Under the CAP Code, you must hold evidence that a testimonial is genuine, with contact details for the person who gave it (rule 3.47). You must also make it clear when a review was incentivised (rule 3.45).
So in the system, reviews are quoted word for word and never rewritten by AI. A customer is never named without their permission.
Can I use photos and videos of customers, staff or children?
Only with care, and usually with permission. If someone can be recognised in a photo, it's normally their personal data under UK GDPR. The ICO says using customers' or staff photos in marketing needs its own lawful basis, and in its example the business asks for consent first. Children need extra protection.
The ICO's point about recognisable faces comes from its advice on taking photographs. Staff need particular care. The ICO says consent is harder to show as freely given where there's an imbalance of power, such as between employer and employee. So give people a real choice, keep a record, and make it easy to change their mind later.
For children, UK GDPR says they merit specific protection, particularly when their data is used for marketing. If in doubt, leave them out.
Can I use any music or image I find online?
No. Photos, illustrations and music recordings are usually protected by copyright, so you need the owner's permission or a licence. Use your own photos, licensed stock, or the music libraries platforms provide for businesses. TikTok, for example, says businesses can't use its general music library for commercial posts.
The Intellectual Property Office's copyright notice on images explains that photographs are generally protected as artistic works, so you'll usually need the owner's permission. GOV.UK confirms copyright protection is automatic for sound and music recordings too. TikTok points businesses to its Commercial Music Library, which it describes as pre-cleared for commercial use.
