Seven steps to a shopping feeds disclosure policy your team can audit

What to take away

Why the mistake is usually timing

Retailers often treat disclosure as a footer on the website. The feed is where the claim travels. A title, image or promotion can reach a marketplace before anyone reads the policy.

Write the policy before the first upload. Then the feed team knows what it may publish, and the legal team knows what to check. The steps below identify the core UK rules and the channel specifications to record in the policy.

Step 1: list every data source

Start with the source of each attribute in the feed: stock levels, prices, reviews and audience segments. For every field, record its source system, feed mapping, accountable source owner and evidence, such as an inventory export or price record. If you buy marketing data from a broker, the ICO explains your obligations when using data broker marketing services; retain your checks and evidence of the data's provenance.

Name the source next to the field. Treat a field as audit-ready only if another team member can trace it from the feed back to its source evidence; mark missing or unknown sources as a failure and resolve them before upload.

Step 2: label AI-generated content

AI tools now write titles, descriptions and lifestyle images. For AI-generated titles or descriptions, check the Google Merchant Center product data specification for structured_title or structured_description and the digital_source_type value trained_algorithmic_media. Check each other channel's current feed or listing requirements too; Google Ads label settings are not a substitute for feed-level metadata.

For every channel, record whether its current rules require an AI disclosure, the feed field or metadata used, and the validation result. If the requirement or treatment is unclear, record that as unresolved and do not assume an advertising setting covers the feed.

Step 3: check the claim before it ships

Every feed claim must match the product. Compare titles, images, prices, sizes, materials and delivery times with the relevant product and fulfilment records. Mark each field pass only when it matches its source and any evidence needed to substantiate the claim is retained; block uploads with missing or conflicting fields.

Assess advertising and consumer-protection claims against the CAP Code, applied by the ASA, and the Digital Markets, Competition and Consumers Act 2024. Advertising rules in England add specific duties on promotions and pricing. Read the advertising rules in England before you approve a discount feed, because the wording of a saving can decide whether the claim is fair.

Step 4: document consent and lawful basis

For personal data used in email or retargeting audiences, record the applicable UK GDPR lawful basis for each audience, not just for each campaign. Also check the Privacy and Electronic Communications Regulations (PECR) requirements for electronic marketing and cookies or similar technologies: a UK GDPR lawful basis alone does not establish PECR compliance. Where consent is used, keep the date, wording, source, audience and evidence of the user's choice.

If the team cannot evidence the applicable lawful basis and any PECR requirements, exclude the audience until the gap is resolved. Record any withdrawal or suppression so the audience is not reused in error.

Step 5: set platform-specific rules

Map the policy to the channels actually used: Google Merchant Center, Meta Commerce Manager, Amazon Seller Central and Microsoft Merchant Center are examples of shopping-feed destinations. For Google, record the product data specification; for Meta, the Commerce Manager catalogue data-source requirements; for Amazon, the relevant Seller Central listing policies and category product template; and for Microsoft, the Merchant Center product feed specifications. LinkedIn advertising documentation is for advertising campaigns, not a substitute for shopping-feed requirements.

Write one page per channel. Record the applicable specification or policy, the date checked, required fields and labels, prohibited claims, where validation or rejection issues appear, and the evidence to retain. A channel passes review only when its live feed meets those recorded requirements and any failures have been resolved.

Step 6: assign owners and a review date

The policy needs a named owner, a deputy and a review date. Review quarterly, and after any platform policy change. That means checking live feeds against the document, not rereading it.

Use an audit log with these fields for each decision: date checked, channel, feed or SKU, field or claim checked, source evidence, applicable rule or specification, pass/fail result, failure action and owner. Keep the dated evidence with the log so a reviewer can reproduce the decision.

Step 7: test before you scale

Run a sample feed through the policy before a full upload. For each sampled product, compare titles, images, prices, stock, delivery information and other required attributes with their source records; check required labels and trace any audience data to its source and consent or lawful-basis record. Mark each check pass only when the source matches and the channel requirement is met; record every failure and fix it before widening the catalogue.

Keep the test record with the sample checked, channel specification, evidence reviewed, pass/fail results, failures raised and fixes completed. It shows whether the policy works in practice and lets another team member repeat the audit.

Short glossary

Common questions

Does a shopping feeds disclosure policy differ across the UK?

Consumer protection and data rules apply across the UK, but enforcement and some trading standards practice differ in Scotland, Wales and Northern Ireland. Check local guidance if you sell outside England.

Who enforces feed claims in England?

The ASA handles advertising complaints under the CAP Code. Trading Standards can act on consumer protection law, including the Digital Markets, Competition and Consumers Act 2024. The ICO covers personal data under the UK GDPR, Data Protection Act 2018 and PECR. Each has a different remit.

How often should the policy be reviewed?

Quarterly is a sensible baseline, plus a review after any platform change. A named owner should sign off each review.

Do small retailers need a written policy?

Yes. A short written policy is easier to follow than an unwritten one, and it gives you something to show if a claim is questioned.