The five kinds of authority a retail media launch must satisfy before release

A retail media launch must satisfy five kinds of authority before release: consumer protection law, the CAP Code, UK GDPR, PECR and the placement contract.

Retail media rules and ethics need separate decisions about the advert, the shopper data and the agreement behind the placement. A retailer's permission to sell space does not settle all three. This guide covers retailer or marketplace controlled advertising inventory and the associated data operations, with England as the practical starting point.

The 2027 title identifies a planning edition prepared from sources checked on 6 September 2026. It does not certify the law for a future campaign. This is general information, not legal advice or a compliance guarantee; publication and campaign decisions need qualified UK advertising, consumer-law and privacy review.

What to take away

Start with the placement and its data path

Describe the proposed unit before opening a legal checklist. Record the retailer property, placement type and advertiser. Then record the product category, intended audience and geographical delivery. A paid search position within a marketplace creates different questions from a screen in a shop, even when the same brand buys both.

Then draw the data path separately. Identify any account identifier, purchase history, device access, audience match or report export. State which organisation chooses the purpose of each operation. Do not substitute labels such as first-party data, clean room or contextual for a description of what actually happens.

As an editorial control, keep the inventory description next to a diagram of collection, matching, selection, delivery and measurement. Mark any stage that has no personal information or device access only after technical inspection.

The reader's task is to prepare an evidence pack that specialists can assess. A completed checklist records the work done; it cannot prove that every applicable requirement has been identified. Product-specific restrictions and cross-border delivery deserve their own assessment rather than a footnote on a general approval.

A simple register can have columns for: the placement, the authority, the evidence inspected, the open question and the owner.

The five kinds of authority: DMCC, CAP, UK GDPR, PECR and contract

The five kinds of authority are separate. A launch must satisfy each one on its own terms.

The Digital Markets, Competition and Consumers Act 2024, Schedule 20 is legislation listing practices prohibited in all circumstances. Its paragraph 12 concerns paid editorial promotion. The wider framework also addresses misleading acts and omissions, whose legal tests need separate consideration. The linked official XML contains the revised provision, with UK territorial extent.

The CMA's unfair commercial practices guidance explains the consumer regime and confirms that these provisions apply to practices occurring from 6 April 2025. That is UK-wide guidance relevant to England; it is not a court determination about a particular sponsored listing.

CAP rules form an advertising code. For example, section 2 addresses recognition of marketing communications. Describe the rule as a CAP requirement rather than presenting the code itself as an Act of Parliament.

Keep any industry measurement standard in another column. Record its issuing body, version and whether the parties adopted it in their contract. A measurement definition answers how a metric is calculated; it does not establish a lawful basis for collecting the underlying shopper information.

Finally, label house controls as editorial or operational recommendations. This guide recommends a release owner, evidence register and retained creative version. Those proposed working arrangements should never be described as universal statutory requirements merely because they help organise a review.

Check recognition at the shopping decision

A paid product position should be recognisable in the form in which the shopper encounters it. Review the full search result, recommendation carousel or retailer content page. A label visible in the design file may be lost when a product title wraps or a mobile layout changes.

Under CAP rule 2.1, marketing communications must be obviously identifiable. Apply that principle to the actual unit rather than assuming the shopper knows that premium positions can be bought. Keep commercial intent distinct from information about why a particular person received the advert.

Schedule 20, paragraph 12 of the DMCC Act separately addresses undisclosed paid promotion within editorial content. For sponsored search, ask the reviewer to assess misleading presentation and omitted commercial intent under the wider framework, including the applicable transactional-decision test. A retailer buying guide and a sponsored search tile should not inherit one legal classification without examination.

Take a labelled sponsored search tile that says 'Sponsored' and sits above organic results. Compare it with a retailer buying guide that ranks products by an editorial method. The first presents paid placement; the second presents editorial selection. The label and surrounding context differ, so the recognition test applies differently.

For an internal release record, capture the label, its location, the surrounding organic results and the advertiser identity. Record the smallest supported display where the unit remains available. These are proposed evidence fields, not a claim that any label has passed consumer testing.

Substantiate the product claim before release

The CAP misleading-advertising rules require documentary support for objective claims before publication under rule 3.7. Rules on material information, qualifications and price presentation also matter. Approval should cover the claim as displayed, including any restrictions that affect its meaning.

Give the retailer reviewer access to the evidence behind a performance, comparative or savings statement. Identify the product variant and the period covered. Avoid accepting an advertiser's general assurance when the creative makes a narrower claim that the assurance does not address.

Use a separate release question for stock and price feeds: what happens if the promoted item becomes unavailable or the offer changes? The recommended operational response is to name the person who can pause the placement and the feed condition that triggers review. Do not invent a universal legal refresh interval.

Treat seller badges and review extracts cautiously. Establish what the badge means, who issued it and whether the display implies an endorsement beyond that evidence. The review pack should preserve the original context so that a short extract does not become a broader product claim.

Assess food and other restricted categories

Grocery inventory needs a product eligibility decision before a brand purchases a placement. CAP's less healthy food advertising update records restrictions effective from 5 January 2026, including paid online advertising for identifiable less healthy food or drink products, subject to scope and exemptions.

Do not infer that every retailer-owned online position is exempt or that every food product is prohibited. Ask for the product classification, the payment arrangement and the proposed execution. Have the specialist assess any claimed exemption against current legislation and detailed guidance.

Keep online advertising restrictions distinct from England's retail promotion and placement rules. A store screen, a physical product location and a paid online tile are different objects of review. This guide does not clear food, alcohol, gambling, medicines or financial-product advertising for use.

In the booking workflow, route categories needing specialist input before accepting a launch date. Keep the reason for the referral attached to the creative version. If the advertised product changes, reopen the category decision rather than preserving an approval given to another item.

Treat device access and personal data separately

The revised PECR regulation 6 prohibits device storage or access subject to Schedule A1. Read that current structure rather than relying on the original 2003 wording. For the current advertising application, the ICO says advertising storage and access technologies require consent, including technologies involved in selection, delivery, tracking and profiling.

Separately identify the lawful basis and safeguards for each use of personal information under the UK GDPR. The ICO's principles guidance covers purpose limitation, minimisation and accountability. Retailer possession of purchase records does not itself answer why they may be reused for an advertising audience.

An appropriate technical review should follow events through the system, including refusal and withdrawal. Document what leaves the retailer environment and what remains available to suppliers. A server-side operation still needs its own assessment; moving it away from the browser is not a legal conclusion.

For measurement, specify the output needed before requesting a wider dataset. Consider whether the business question can be answered with a less detailed report. Treat this as a design question to document, not an assertion that an aggregate output makes every earlier processing stage anonymous.

Resolve roles and risk before matching audiences

The ICO explains that joint controllers need a transparent arrangement under Article 26. A processor relationship has different requirements. Determine the role from the decisions each party makes about the operation, then have the legal documents reflect that assessment.

The processor-contract guidance explains Article 28 terms, including instructions, security, assistance and end-of-contract handling. A purchase order for impressions does not substitute for the necessary processing provisions where a processor is used.

Screen the proposed audience matching against the ICO's DPIA guidance. A DPIA is required where processing is likely to create high risk to individuals. The decision should consider the actual data, profiling and people affected, rather than the supplier's product name.

Ask how objections will reach every affected operation. The ICO's right-to-object guidance states that direct-marketing objections are absolute, including related profiling. A retailer should be able to explain how the relevant audience stops being used, not merely how an email unsubscribe button works.

These are negotiation topics, not model legal clauses. The appropriate allocation of liability, governing law, termination and dispute resolution depends on the transaction. An England operating example does not establish that every party's agreement is governed by the law of England and Wales.

Make the agreement usable during a problem

Write the inventory schedule so that both parties can identify what was booked. Specify eligible environments, creative approval, reporting definitions and the treatment of rejected or withdrawn assets. Keep commercial remedies separate from the statutory duties that remain applicable.

For a reporting disagreement, agree which event records can be examined, by whom and with what confidentiality protections. Avoid making unrestricted access to shopper-level data the default remedy. Ask the privacy reviewer to assess any proposed evidence exchange before the contract promises it.

Set out who receives complaints about the advert and who handles privacy requests. A retailer support desk needs a route to the relevant owner even when the advertiser supplied the copy. Contract drafting should anticipate a paused campaign, an expired permission and the end of supplier access.

Recheck the 2027 edition before publication

The Data (Use and Access) Act 2025 amends the privacy framework. The government's commencement record confirms that most Part 5 data protection and privacy provisions commenced on 5 February 2026. Do not turn that statement into a claim that every provision commenced together.

Some linked ICO material carries an update notice following DUAA. Record that limitation and have the reviewer check the current legal position against the precise processing proposal. Consultations and proposed changes belong in a watch list until their legal status and effective date are established.

The next useful document is a placement-specific decision record: what is proposed, which authority applies, what evidence was inspected, what remains unresolved and who can authorise release. Preserve the answer with the exact creative and configuration it covers.

Before you act

Common questions

What are the five kinds of authority a retail media launch must satisfy?

Consumer protection law, the CAP Code, UK GDPR, PECR and the placement contract. Each needs its own evidence and decision record. A retailer's permission to sell space does not settle any of them.

What should a reader produce before asking specialists to assess a retail media launch?

The reader's task is to prepare an evidence pack that specialists can assess. A completed checklist records the work done, but it cannot prove that every applicable requirement has been identified. Product-specific restrictions and cross-border delivery deserve their own assessment rather than a footnote on a general approval.

How should a reader treat a measurement standard adopted by the parties?

Keep any industry measurement standard in another column. Record its issuing body, version and whether the parties adopted it in their contract. A measurement definition answers how a metric is calculated, but it does not establish a lawful basis for collecting the underlying shopper information.

What does the article say about food and drink advertising restrictions?

CAP's less healthy food advertising update records restrictions effective from 5 January 2026, including paid online advertising for identifiable less healthy food or drink products, subject to scope and exemptions.

Do not infer that every retailer-owned online position is exempt or that every food product is prohibited. Ask for the product classification, the payment arrangement and the proposed execution.