There is a great deal to consider when advertising and marketing to children online. Regulation spans across a variety of legislation and sectors in terms of both content and placement or targeting of that content.  Here we focus on placement and targeting of non-broadcast age-restricted ads online, but first, a word about the complex framework which governs advertising to children.

A complex framework

The starting point for marketers will be the CAP Code for non-broadcast media and the BCAP Code for broadcast media.  Marketers should ensure that marketing communications do not contain anything likely to result in physical, mental or moral harm of a child.  Advertisements should not exploit the credulity of children or undermine parentally authority.  High pressure sell techniques must be avoided, and marketing communications must not take advantage of a child's vulnerability by appealing to emotions such as pity or fear, or imply that the advertised product somehow confers superiority. 

This means adverts should not contain content considered to be particularly sensitive in relation to children or which is not socially responsible, including sexually suggestive content, content which might affect self-esteem, or create unhealthy perceptions, for example around use of social media, or promotion of self-harming.  It also means ads should not encourage irresponsible or dangerous practices by children, nor contain material likely to be offensive or distressing to them.

However, marketers will also need to look at other overarching and sector-specific legislation when it comes to content of ads and marketing materials.  This includes:

• the Consumer Protection from Unfair Commercial Practices Regulations 2008 (CPUT Regs), which protect consumers from unfair trading practices and contain additional rules specific to children
• sector-specific rules on advertising and marketing age-restricted products which include HFSS food and drink, alcohol, e-cigarettes, gambling and lotteries
• media-specific rules, for example, for video service providers or influencers.

We explore sector-specific issues with creative content in our related articles in this series (see below).

Placement and targeting

Advertisers don't just have to be careful about content.  They also need to follow rules on targeting of advertising and marketing relating to age-restricted products and services. 

Again, the CAP Code covers this for non-broadcast media, and additional advice and rules are included in sector-specific guidance (see, for example, rules on gambling adverts).  However, data protection rules and guidance including the UK GDPR, PECR and the ICO's Children's Code (or Age Appropriate Design Code) must also be taken into account because targeting and use of age verification tools are likely to involve processing of personal data.

Who is a child?

This is not as straightforward as you might think.  Different rules apply to different age groups and there is no universal definition of a "child" when it comes to targeting and placement of ads.  Under the CAP Code a child is generally anyone under 16 (for example, for the purposes of content which is inappropriate for children), however, for the purpose of placing ads:

• rules apply to under-16s in relation to HFSS food and drink and lotteries, and to
• under-18s (children and young people) for products like gambling, alcohol and e-cigarettes.

For data protection purposes, while the UK GDPR tends to regard under-16s as children, particularly around issues of digital consent, the Children's Code applies to under-18s.

To complicate matters further, the Gambling Commission distinguishes between children (15 and under) and young people (16 and 17) in rules about using children and young people in marketing material.

What are the CAP rules on media placement of age-restricted ads?

Under the CAP Code, age-restricted marketing communications should not be targeted at the protected age category through the selection of media or the context in which they appear. 

For one-to-many media, marketers must apply a placement restriction if more than 25% of the medium's audience is in the protected age category.  Marketers should exclude such media from their ad placements where they have direct control over where their ads appear, and/or use available tools provided by platforms or ad targeting systems to restrict access to relevant content by protected age groups.

In January 2021, CAP published guidance on non-broadcast media placement of age-restricted ads, to be considered in conjunction with general its guidance on media placement.  The guidance is aimed at marketers using online media, principally for programmatic and paid-for advertising and organic content appearing on social media and video sharing platforms.  It should also be used by affiliates and other third parties involved in the targeted advertising ecosystem.

The guidance suggests there are three key implications of the CAP rules for different approaches to ad placement:

• No age-restricted ads should appear in or around media obviously directed at the protected age category, irrespective of the method of targeting.
• Where marketing communications are directed at audiences based on data held by the marketer, media platform and/or other third party, targeting measures must be utilised to prevent the likelihood of those in the relevant protected age category from receiving them.
• In one-to many media, marketers must not place ads where children and young people are likely to make up more than 25% of the audience.

Tools for compliance

The CAP guidance is based on the principal that just as marketers rely on data to serve ads to audiences likely to be most interested in them, so the data can be used to protect the vulnerable to make it less likely they will see unsuitable ads.  The closer the age profile of the audience targeted by the advertiser is to the protected age group, the more care must be taken.

Data which enables targeting may be actively provided by users, but it may also be inferred.  Directly provided data can be misleading – for example, children may lie about their age when creating a logon, or the same device may be used by people across a wide age range.  This is even more true where ads are served to non-logged in users or when using programmatic targeting.  As a result, marketers are strongly urged to rely on a combination of age-targeting tools to remove certain demographics – as many as are available. 

Marketers should reinforce their use of demographic data with interest and behavioural data where available.  This includes being clever about selecting and combining interest criteria.  The guidance provides the example of combining those interested in football which would cover both adults and children, with those interested in buying property, which would cover adults.  That would be likely to exclude the majority of children interested in football from the target audience. 

External data should also be used where a platform facilitates this – for example, data on whether an individual has a credit or store card, as processes for issuing these include rigorous credit checking.  Similarly, marketing data from customers who have passed mandatory age checks for gambling services at point of sign-up are also considered to provide robust evidence of age by CAP.

Some ad placements are acknowledged to attract low risk.  For example, older adults can be targeted by using interest factors which naturally exclude children and young people, like insurance products, family holidays or readership of particular publications.

The data question

One of the issues with many age verification techniques is that they can involve processing large amounts of personal data.  This means complying with the UK data protection law under which special care must be given to processing children's personal data.  It is likely to require a Data Protection Impact Assessment and there may be issues with selecting a valid lawful basis to the processing.  See more here.

In September 2020, the ICO's Children's Code came into force.  It contains 15 standards for digital services likely to be accessed by under-18s. It covers services which are not necessarily targeted at children but which are likely to be accessed by them.  Read more. 

Enforcement

Demonstrating compliance

Marketers must be able to demonstrate they have taken the relevant media restriction into account for each part of their campaign and that they have acted to limit the exposure of the appropriate group to their ads.  They must be able to show, primarily through audience data, that the group protected by the relevant placement restriction is unlikely to form more than 25% of the total audience. 

CAP acknowledges that this data may not always be very precise but marketers must use whatever data they can access to build up as clear a picture as possible of the likely audience of a medium or specific piece of content. 

This includes having a record of where ads appeared and their likely audience, as well as steps taken to ensure ads are served appropriately and the likelihood of access by restricted age groups has been limited.  Marketers are also encouraged to ensure all parties involved in developing and publishing campaigns are aware of and follow media restrictions.

What will the ASA look at?

The ASA is responsible for enforcing the CAP Code and will investigate complaints about inappropriate placement or targeting. 

Where audience data is unreliable or unavailable, the ASA will look at other factors.  This includes an assessment of the media content in or around which an ad appeared, including themes, images, and context.  If the ASA considers there is a reasonable risk that a significant proportion of the audience for an ad which should have been restricted was within the restricted group, there is likely to be a breach of the Code.

The ASA will look at where web users are likely to have seen an ad so, for example, a paid-for social media post by an influencer will be assessed based on their account and followers or subscribers, and a paid-for ad on a VSP will be assessed based on the audience for the specific video content and/or the specific video channel it appeared in or around.

The presumption will be that the organic marketing communications are available to the whole audience for the social media account or VSP in question.  The ASA will, however, have regard to whether the account is public or only available to followers or subscribers.  Marketers are advised to make use of tools provided by digital media companies to help ensure appropriate age access.

Who is responsible for compliance?

The advertiser, not the media owner or publisher is responsible for complying with the rules on age-restricted ads.  However, the media owner or publisher may be expected by advertisers to play a role in providing tools to help the advertiser comply.

What happens if the ASA finds there has been a breach of the CAP Code?

In most cases, the primary impact of an ASA decision that there has been a breach of rules around placement and targeting of ads will be bad publicity.  The ASA will typically require an offending ad to be withdrawn but may refer persistent or uncooperative offenders to other bodies including Trading Standards or Ofcom and require them to have their material vetted before publication.  The ASA can also require search engines to remove marketers' paid-for search advertisements.

Recent enforcement decisions in this area show the ASA is likely to err on the side of caution when deciding whether or not there has been a breach of the rules on targeting age-restricted ads:

• In February 2019, a gambling advertiser was told not to include its ads in an app for I’m A Celebrity, Get Me Out Of Here because the app had some under-18 users and there were no mechanisms built into the app to target ads towards, or direct them away from, certain groups of users. The gambling ads could only be used with specific targeting to minimise the likelihood of under-18s being exposed to them.
• In March 2020, the ASA ruled on a Warner Bros ad for a film on Spotify. The complaint was that the ad was inappropriately scary for the playlist in which it appeared which was intended to be heard by young children.The ASA held that Warner Bros (as the advertiser) did take steps to target the ad responsibly by using the Spotify parameters "Age is 18-44" and "Real Time Genre is not Children" (also known as "No Kids Music"). Spotify (as the media owner/publisher) failed to target the ad appropriately, because it was played during a playlist designed to be heard by young children. Even though Spotify was at fault, it was Warner Bros as the advertiser which was held to be liable for breaching the advertising code and not Spotify.
• In 2020, Brewdog placed posters in various cities, press ads in Metro, The Week and The Economist and near a school, stating:'F**k You CO2. Brewdog Beer is Now Carbon Negative'. The letters between F and K were obscured by a can of Brewdog Punk IPA.The posters had been placed in accordance with guidelines on proximity to schools and religious buildings. The ASA found that while the adverts in the Economist and the Week were targeted at an adult audience due to the fact the magazines were paid-for and usually bought in a shop or on subscription, the street posters and Metro ad were to a general audience rather than a targeted one and were therefore likely to cause serious and widespread offence and were not appropriate for display in untargeted media.

The ASA has also asked CAP whether it should be taking a more prescriptive approach in regulating dynamically-served age restricted ads, following the results of monitoring sweep to assess the placement of restricted ads, particularly in mixed-age online media, as we discuss here.

Advertisers should consider that the targeting of age-restricted ads is priority for the ASA and factor it in when appointing media agencies.  They should work with their agencies to ensure media buying is appropriately targeted using as wide a combination of data, blocklists and selection tools as possible.