Rules and ethics
Part of Reviewing a creator media kit against UK rules on claims, permissions and personal data
Creator Media Kits UK Regulations: Rules for Email Pitches
Creator media kits UK regulations for email pitches: check PECR consent, soft opt-in, CAP Code remit and business-to-business advertising rules.
Creator media kits UK regulations for email pitches come down to three questions: what PECR requires for marketing emails, how business-to-business advertising rules differ, and when an email may fall within the CAP Code.
The recipient's legal status and the message's purpose matter more than whether the kit is attached as a PDF or sent as a link. Use the distinctions below to prepare a focused question for a solicitor; an email to a brand is not automatically exempt from every marketing rule. The wider UK rules and compliance guide covers the rest of the kit.
Separate the rules before sending
A single email can raise more than one issue. The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) govern certain electronic marketing messages. The Business Protection from Misleading Marketing Regulations 2008 (BPR) address misleading business-to-business advertising.
The CAP Code is a self-regulatory code for marketing communications within its remit, while UK GDPR and the Data Protection Act 2018 may apply when the email uses personal data.
These rules do different jobs. PECR concerns whether a marketing email may be sent and what it must contain; BPR concerns whether advertising to traders is misleading. CAP Code remit depends on the communication and its audience. Data protection is a separate layer where the message uses personal data, such as an individual recipient's name or email address.
PECR: consent depends on the subscriber
PECR distinguishes individual subscribers from corporate subscribers. A limited company is generally a corporate subscriber; a sole trader is an individual subscriber. Do not decide from a recipient's job title alone: consider the legal person or business receiving the email.
For unsolicited direct marketing by email to an individual subscriber, PECR generally requires consent unless the sender can rely on the soft opt-in.
That exception is limited: the contact details must have been obtained directly during a sale or negotiations for a sale, the marketing must be for the sender's own similar products or services, and the person must have had a clear chance to refuse marketing both when their details were collected and in each message.
A previous conversation or an existing client relationship, by itself, does not establish that every condition is met.
PECR does not impose that prior-consent requirement for emails to corporate subscribers. However, regulation 23 requires the sender of direct marketing emails to identify themselves and provide a valid address at which the recipient can ask for the messages to stop. Make opting out straightforward, and keep suppression information so an opt-out is respected in later campaigns.
PECR is not the whole data-protection picture. If a named contact's details are personal data, UK GDPR and the Data Protection Act 2018 may also apply. The sender needs an appropriate lawful basis and must respect the individual's right to object to direct marketing. The Information Commissioner's Office (ICO) regulates these rules and is the relevant authority for concerns about electronic marketing and personal data.
CAP Code: a one-to-one email is not a shortcut
The CAP Code is written by the Committee of Advertising Practice and administered by the Advertising Standards Authority (ASA). It is self-regulatory, not an Act or regulation.
Its Scope section excludes private correspondence, including some communications about an existing relationship or past purchase, provided the message is not soliciting new business or advertising new products or services. The ASA/CAP private-correspondence guidance explains that boundary.
That means the fact that an email is individually addressed does not settle whether it is private correspondence. A note about an existing commission may have a different purpose from a pitch inviting a new booking. An email to a past client that also promotes a new service needs careful consideration rather than an automatic exemption based on the existing relationship.
Where a marketing communication is within the CAP Code's remit, rule 2.1 says it must be obviously identifiable as a marketing communication; rule 2.3 says its commercial intent must be clear if it is not apparent from the context.
An upheld ASA ruling may be published, and the advertiser is expected to amend or withdraw the communication. Continued non-compliance can lead to stronger action within the self-regulatory system, including referral to a statutory authority.
A brand pitch and a public kit are different uses
A pitch sent to a brand employee to sell creator services is business-to-business advertising. Regulation 3 of the BPR prohibits misleading advertising to traders, and the Competition and Markets Authority (CMA) enforces the Regulations.
A truthful email still needs to be considered under PECR if it is direct marketing by email; BPR and PECR address different questions.
If the same kit is also posted on a page available to consumers, assess that public version separately. Consumer-facing commercial practices may engage the unfair commercial practices provisions of the Digital Markets, Competition and Consumers Act 2024, in force from 6 April 2025, as well as the CAP Code where the communication falls within its remit.
Do not carry a classification from a private email across to a public page, or vice versa.
For a wider choice between email, a hosted page and other delivery routes, see the channel strategy guide. If the separate question is which sections belong in the kit, use the media kit contents guide. For the claims inside a public kit, the advertising rules go further.
Prepare a focused question for a solicitor
Before seeking advice on a proposed email, gather the material that shows its purpose and route. A concise briefing can include:
- The exact email wording, subject line and call to action.
- The kit version attached or linked, and whether that version is also publicly available.
- Whether the recipient is a company, sole trader or another type of business, and whether they are an existing client or a new prospect.
- How the recipient's contact details were obtained, whether they consented, and whether you believe the soft opt-in applies.
- The opt-out wording and sender details that appear in the email.
- Whether the message promotes a new service, seeks a new commission or relates only to existing work.
Ask separately whether PECR permits the email to be sent, whether the soft opt-in conditions are met if relevant, whether the CAP Code's private-correspondence exclusion applies, and whether any claim to a trader needs review under BPR regulation 3.
If personal data is involved, ask what data-protection obligations apply. This keeps the advice on the email and its context, rather than turning the question into a general audit of every element of the kit. Contracting-party questions belong in the commercial contracts record.
Common questions
Does PECR always require consent before emailing a brand?
No. The requirement depends on whether the recipient is an individual or corporate subscriber. The soft opt-in may be available for an individual subscriber only when its conditions are met; corporate subscribers are treated differently under PECR.
Does an existing client relationship make an email private correspondence?
Not automatically. The CAP Code's Scope section excludes qualifying private correspondence, but the exclusion does not cover a message that solicits new business or advertises new products or services.
Does the CAP Code replace PECR?
No. The CAP Code addresses marketing communications within its remit; PECR governs requirements for electronic marketing, including consent rules for individual subscribers and opt-out details. A message may need to be considered under more than one framework.
