What are the shopping feed rules and ethics in the UK?

What to take away

The Competition and Markets Authority (CMA) and Trading Standards enforce consumer-protection rules; the applicable regime can depend on whether a sale is in Great Britain or Northern Ireland.
Product data in a feed can be advertising. The CAP Code applies to non-broadcast ads, including online listings, and its rules on misleading claims, substantiation and qualifications are relevant.
Google Merchant Center and Microsoft Advertising have their own product and advertising policies. Meeting the law does not guarantee that a platform will accept a feed.
The UK GDPR and Data Protection Act 2018 govern personal data in a feed or order pipeline. Controllers may also need to pay the ICO data protection fee unless exempt, and PECR applies to electronic marketing.

Why feed compliance matters now

A product feed is not a neutral data file. It is a shop window, a price list and a marketing channel rolled into one. When a customer sees a listing on a comparison site, a marketplace or a search result, that content is governed by advertising and consumer law.

Regulators have become more active. The Competition and Markets Authority has published detailed guidance for online traders. The Information Commissioner's Office has signalled it will look closely at how ecommerce businesses handle personal data.

A feed with inaccurate stock levels, misleading discounts or unverified reviews creates legal exposure. That exposure sits with the retailer, not the platform.

This guide covers the main rules and ethical expectations for shopping feeds. It looks at advertising standards, consumer protection, data protection, platform policies and practical steps a feed manager can take to stay on the right side of them. It is general guidance only, and individual cases need a qualified adviser.

The CMA and consumer law

Consumer protection is enforced by the CMA and local authority Trading Standards. The legal framework is not identical across the UK: the Digital Markets, Competition and Consumers Act 2024 provides the current unfair-commercial-practices regime in Great Britain, while the Consumer Protection from Unfair Trading Regulations (Northern Ireland) 2008 apply in Northern Ireland. The Business Protection from Misleading Marketing Regulations 2008 also apply to misleading business-to-business advertising. Check the territorial scope of a rule before applying it to a sale.

The CMA publishes guidance on the operation of its UK internal market functions; this is distinct from the consumer-protection duties that apply to online selling. For feed managers, the practical points are these:

Prices in the feed must match the price on the landing page and at checkout.
Any reference price, such as a was/now price, must be genuine and evidenced.
Stock availability shown in the feed must reflect reality. Listing an out-of-stock item as available is a misleading action.
Reviews and ratings must come from real customers and must not be edited to remove negative feedback.

The CMA can take enforcement action directly. The consumer-protection provisions of the Digital Markets, Competition and Consumers Act 2024 came into force in Great Britain on 6 April 2025, giving the CMA powers to decide consumer-law cases and impose fines without going to court. For a retailer, a feed with persistent pricing errors is not just a technical problem.

For further detail on English traders, see our guide to shopping feeds UK regulations in England. The UK-level baseline and the territorial distinction are set out here.

Advertising rules for feeds

A shopping feed is advertising. The Advertising Standards Authority administers the CAP Code, which covers non-broadcast ads including online listings. The Code requires that ads are legal, decent, honest and truthful, and that they are prepared with a sense of responsibility to consumers.

The ASA's advice for businesses explains the standards expected of advertisers. Feed managers should note three recurring themes:

Substantiation.CAP Code rule 3.7 requires documentary evidence for objective claims before an ad is published. If you claim a product is "the best" or "number one", you need evidence.
Qualification.CAP Code rule 3.9 requires qualifications to be clear and not to contradict the main claim. If a price or offer has conditions, make them clear in the listing or immediately accessible from it; small print in a footer is not enough.
Recognition.CAP Code rule 2.1 requires marketing communications to be obviously identifiable as such. Paid placements in a shopping feed should be distinguishable from organic results.

The CAP Code also covers environmental claims. If a feed title says "eco-friendly" or "carbon neutral", the claim needs a clear basis and evidence. Vague or unqualified green claims risk misleading customers.

Legal compliance does not replace platform requirements. Google Merchant Center's product data specification sets requirements for submitted product data, and its Misrepresentation policy covers misleading information. Microsoft Advertising's Shopping ads policies also apply to Shopping ads. Check the current policies and feed diagnostics for each platform, correct rejected or inaccurate data, and do not assume approval by one platform means another will accept the listing.

For further detail on England-specific advertising rules, see our article on shopping feeds advertising rules in England. The CAP Code principles relevant to feed content are outlined above.

Data protection in the feed pipeline

Feeds can carry more than product data. They may include identifiers, order references, customer segments and email addresses. These can be personal data under the UK GDPR, which is supplemented in domestic law by the Data Protection Act 2018. The Information Commissioner's Office (ICO) is the UK's data protection regulator.

The Information Commissioner's Office publishes UK GDPR guidance and resources for organisations of all sizes. The key principles for a feed operation are:

Lawful basis.You need a lawful basis for processing customer data. Consent, contract and legitimate interests are common in ecommerce, but the basis must fit the purpose.
Data minimisation.Only include in a feed what the platform genuinely needs. A product feed should not carry customer email addresses unless there is a clear purpose.
Retention.Set a retention period for feed logs and order data, and delete what you no longer need.
Security and breaches.Use appropriate technical and organisational measures. If a personal data breach is likely to risk people's rights and freedoms, notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it.
High-risk processing.Carry out a data protection impact assessment before processing that is likely to result in a high risk to individuals.

Roles depend on what each party actually decides and does: a retailer is often a controller for customer data, while a feed platform may be a processor. Where a processor handles personal data on the controller's behalf, the parties need a written contract setting out the required processing terms. Controllers must also pay the ICO data protection fee unless an exemption applies; use the ICO's fee checker to establish the applicable fee.

The ICO's individual rights guidance explains what customers can ask you to do, including access, correction and erasure. A feed that cannot be purged on request is a compliance risk.

For further detail on England-specific data protection matters, see our article on shopping feeds data protection in England. The UK GDPR and Data Protection Act 2018 duties relevant to feed operations are outlined here.

Disclosure and transparency

Disclosure is the bridge between advertising rules and data protection. It covers what you tell customers about how their data is used and what you tell them about the nature of a listing.

In a shopping feed context, disclosure has two sides. The first is commercial disclosure: if a listing is sponsored, the customer should be able to tell. The second is data disclosure: your privacy notice should explain what data you collect through feeds, why, and who it is shared with. For distance sales to consumers, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 also require specified pre-sale information, including the product's main characteristics, the total price, delivery costs where applicable, and cancellation information.

The CMA's consumer-protection rules address hidden commercial practices, and the CAP Code requires marketing communications to be identifiable as such. A sponsored placement that looks identical to an organic result risks misleading customers. Apply the relevant legal and platform requirements to the listing and its presentation.

A written disclosure policy helps. It should cover who approves sponsored listings, how they are labelled, how the label appears across different devices, and how privacy information is kept accurate when feed data use changes. For an England-specific template structure, see our guide to shopping feeds disclosure policy in England.

Comparison table: who regulates what

Who Regulates What

CMA & Trading Standards

Pricing and misleading actions: Yes
Advertising content: No
Personal data: No
Environmental claims: Yes
Sponsored placements: Yes

ASA

Pricing and misleading actions: No
Advertising content: Yes
Personal data: No
Environmental claims: Yes
Sponsored placements: Yes

ICO

Pricing and misleading actions: No
Advertising content: No
Personal data: Yes
Environmental claims: No
Sponsored placements: No

Who regulates what

Regulator

Pricing and misleading actions: CMA and Trading Standards
Advertising content: ASA
Personal data: ICO
Environmental claims: CMA and ASA
Sponsored placements: CMA and ASA

Main rule

Pricing and misleading actions: Consumer Protection from Unfair Trading Regulations 2008
Advertising content: CAP Code
Personal data: UK GDPR and Data Protection Act 2018
Environmental claims: CAP Code and CMA green claims guidance
Sponsored placements: CAP Code and consumer law

Applies to feeds?

Pricing and misleading actions: Yes, for price, stock and availability claims
Advertising content: Yes, for titles, images, claims and offers
Personal data: Yes, for identifiers, order data and segments
Environmental claims: Yes, for sustainability wording in titles
Sponsored placements: Yes, for labelling of paid listings

Practical compliance steps

Compliance is easier to maintain than to retrofit. Use and record these baseline checks for each UK feed operation:

Compare feed prices and availability with the landing page and checkout before publication, and recheck them as data changes.
Keep evidence for reference prices, product claims, reviews and environmental claims; make offer conditions clear.
Check product data against Google Merchant Center's product data specification and Misrepresentation policy, Microsoft Advertising's Shopping ads policies, and any relevant marketplace rules. Review diagnostics and resolve policy warnings or rejections.
Confirm that paid placements are identifiable and that consumer pre-sale information is available before the customer is bound by a distance contract.
Map customer-data fields to a stated purpose, record the lawful basis, update privacy information, check whether the ICO fee applies, and follow PECR when using email or text for marketing.
Assign an owner, retain approval and change records, and review the feed and its data-processing arrangements regularly.

Practical Compliance Steps

Map your data flows
Review your titles and claims
Check your price logic
Label sponsored listings
Document your decisions
Train the team

These steps do not guarantee compliance, and they are not legal advice. They are a practical starting point. For a broader view of the market and platforms in England, see our England market guide for 2027.

Ethical considerations beyond the law

Legal compliance is the floor, not the ceiling. Ethical feed management means thinking about the customer's interests, not just the regulator's checklist.

One recurring issue is data reuse. A feed manager may be tempted to enrich a product feed with customer segments bought from a third party. That may be lawful in some circumstances, but it is rarely what the customer expects. The ICO's principle of fairness is relevant here: processing must not be unduly unexpected or intrusive.

Another issue is dark patterns. Countdown timers that reset, stock messages that are always low, and "only 2 left" claims that never change are all misleading. They also erode trust. A feed that uses them may win a click today and lose a customer tomorrow.

A third issue is accessibility. Feed content that relies on colour alone, or that uses images without useful alternative text where the platform supports it, can exclude some customers. Treat accessibility as part of responsible feed management.

Finally, there is the question of platform power. Feed managers often have limited control over how a marketplace displays their data. Where a platform's default settings conflict with your own disclosure policy, it is worth raising the issue. Silence can look like consent.

Keeping records and reviewing

Regulators expect evidence. If the CMA or ICO asks how you ensured a feed was accurate, "we checked it" is not a useful answer. A dated log with screenshots, price histories and approval records is.

A practical approach is a quarterly review. Pick a sample of listings, check them against the source data, and note any discrepancies. Record what you fixed and when. Keep the review under version control.

It also helps to assign ownership. One named person should be responsible for feed compliance, even if the work is shared. That person should have the authority to pause a feed if a serious error is found.

Review your privacy notice at the same time. If you have added a new platform or a new data field, the notice may need updating. The ICO expects privacy information to be clear and accessible, and it should be reviewed when processing changes.

Common questions

Do shopping feed rules differ across the UK?

The main consumer-protection regime is not identical across the UK: Great Britain and Northern Ireland have different unfair-commercial-practices legislation. Do not infer that product-feed disclosure duties vary by nation without checking the specific rule and sale. The UK GDPR and Data Protection Act 2018 apply across the UK, and advertising and platform requirements should be checked for the listing and channel concerned.

Who is responsible if a feed listing is misleading?

The retailer is normally responsible for the accuracy of its product information and for not misleading customers. Platforms also impose their own policies and may reject listings or suspend accounts for policy breaches. Platform approval does not transfer the retailer's legal duties.

Can I use customer data from a feed for marketing?

A lawful basis under the UK GDPR is not, by itself, enough to send electronic marketing. PECR generally requires consent for marketing emails and texts to individual subscribers, subject to the limited existing-customer soft opt-in where its conditions are met. Tell customers how their data will be used, provide the required opt-out, and check the ICO's guidance before using customer data for marketing.

What happens if I get it wrong?

The CMA can impose fines for consumer law breaches, and the ICO can fine up to £17.5 million or 4% of global turnover for serious data protection breaches. The ASA can require ads to be withdrawn and publishes rulings that name the advertiser.

This article is general guidance only and does not constitute legal advice. Individual cases should be discussed with a qualified adviser.