Social media legal mistakes UK businesses make

Key takeaways

The social media legal mistakes UK businesses make most are unlabelled paid or gifted posts, claims they cannot prove, fake or selectively shown reviews, prize draws without clear terms, music and images used without a licence, and customer data or photos posted without consent. Most are accidental. A one-page policy and a second reader prevent nearly all of them.

• The ASA expects ads, including influencer posts, to be obviously identifiable.
• The CAP Code requires evidence for objective claims before you post them.
• The DMCC Act 2024 bans fake reviews; the CMA can fine firms directly.
• Photos of identifiable people are personal data under UK GDPR.

Which UK rules apply to business social media?

Business social media in the UK is covered by the same rules as other marketing: the CAP Code enforced by the Advertising Standards Authority (ASA), consumer protection law including the Digital Markets, Competition and Consumers Act 2024, UK GDPR and the Privacy and Electronic Communications Regulations (PECR), copyright law, defamation law and any sector rules, such as FCA rules for financial promotions.

• The most common social media marketing mistakes small businesses make
• ASA rules for social media advertising in the UK

What are the most common legal mistakes?

The most common legal mistakes fall into five groups, and each has its own guide in this series.

• Advertising: unlabelled ads and unproven claims.
• Reviews: fake, bought or selectively shown testimonials.
• Promotions: giveaways without clear terms.
• Copyright: music, photos and video you have no licence for.
• Data: customer details and photos shared without consent.

• Not labelling ads on social media: the ASA mistake
• Fake or edited testimonials on social media: the law
• Using popular music on business social media

What can happen if you get it wrong?

Consequences range from an ASA ruling published with your name on it, to posts removed by the platform, copyright claims, complaints to the Information Commissioner's Office (ICO) and, for serious consumer law breaches, CMA enforcement. For small businesses the reputational damage and lost account are usually the bigger risk.

How do you prevent legal mistakes?

Prevent them with a short social media policy covering ads, claims, reviews, promotions, copyright, data and staff posts, and a rule that anything paid, gifted, promotional or about a customer is read by a second person before it goes out.

• Social media policy for UK small businesses

Do regulated sectors need extra care?

Yes. Financial services, healthcare, legal services, alcohol, gambling and products for children all have extra advertising rules. A financial adviser's post can be a financial promotion; a clinic must not advertise prescription-only medicines to the public. Check your regulator's guidance before posting.

• Clinic social media mistakes: rules and trust

How do you spot legal risk in your recent posts?

Spot legal risk by scanning your last 30 posts for five things: paid or gifted content, objective claims, reviews or testimonials, promotions and images of people or other people's work. Each one is a point where a rule applies. Check those posts against the relevant guide in this series.

• Paid or gifted content.
• Claims such as 'best' or 'cheapest'.
• Reviews and testimonials.
• Images of people or others' work.

What does this look like in practice?

A pattern we see: a small business that has never read the CAP Code running a giveaway with no terms, posting a customer's photo from a WhatsApp message and claiming to be 'the best in the county'. None was deliberate. A one-page policy and a second reader fix all three.

• See client work
• Social Media Marketing for UK businesses

Legal checklist

• Label paid and gifted posts as ads.
• Hold evidence for every objective claim.
• Use only genuine, fairly shown reviews.
• Publish terms for every promotion.
• Use only licensed music and images.
• Get consent before posting people or data.

• Social media ROI mistakes: getting the sum wrong
• Not labelling ads on social media: the ASA mistake

Next step

Write a one-page social media policy this month and agree who reads promotional posts before they go out.