There is a great deal to consider when advertising and marketing to children online. Regulation spans across a variety of legislation and sectors in terms of both content and placement or targeting of that content. Here we focus on placement and targeting of non-broadcast age-restricted ads online, but first, a word about the complex framework which governs advertising to children.
The starting point for marketers will be the CAP Code for non-broadcast media and the BCAP Code for broadcast media. Marketers should ensure that marketing communications do not contain anything likely to result in physical, mental or moral harm of a child. Advertisements should not exploit the credulity of children or undermine parentally authority. High pressure sell techniques must be avoided, and marketing communications must not take advantage of a child's vulnerability by appealing to emotions such as pity or fear, or imply that the advertised product somehow confers superiority.
This means adverts should not contain content considered to be particularly sensitive in relation to children or which is not socially responsible, including sexually suggestive content, content which might affect self-esteem, or create unhealthy perceptions, for example around use of social media, or promotion of self-harming. It also means ads should not encourage irresponsible or dangerous practices by children, nor contain material likely to be offensive or distressing to them.
However, marketers will also need to look at other overarching and sector-specific legislation when it comes to content of ads and marketing materials. This includes:
We explore sector-specific issues with creative content in our related articles in this series (see below).
Placement and targeting
Advertisers don't just have to be careful about content. They also need to follow rules on targeting of advertising and marketing relating to age-restricted products and services.
Again, the CAP Code covers this for non-broadcast media, and additional advice and rules are included in sector-specific guidance (see, for example, rules on gambling adverts). However, data protection rules and guidance including the UK GDPR, PECR and the ICO's Children's Code (or Age Appropriate Design Code) must also be taken into account because targeting and use of age verification tools are likely to involve processing of personal data.
This is not as straightforward as you might think. Different rules apply to different age groups and there is no universal definition of a "child" when it comes to targeting and placement of ads. Under the CAP Code a child is generally anyone under 16 (for example, for the purposes of content which is inappropriate for children), however, for the purpose of placing ads:
For data protection purposes, while the UK GDPR tends to regard under-16s as children, particularly around issues of digital consent, the Children's Code applies to under-18s.
To complicate matters further, the Gambling Commission distinguishes between children (15 and under) and young people (16 and 17) in rules about using children and young people in marketing material.
Under the CAP Code, age-restricted marketing communications should not be targeted at the protected age category through the selection of media or the context in which they appear.
For one-to-many media, marketers must apply a placement restriction if more than 25% of the medium's audience is in the protected age category. Marketers should exclude such media from their ad placements where they have direct control over where their ads appear, and/or use available tools provided by platforms or ad targeting systems to restrict access to relevant content by protected age groups.
In January 2021, CAP published guidance on non-broadcast media placement of age-restricted ads, to be considered in conjunction with general its guidance on media placement. The guidance is aimed at marketers using online media, principally for programmatic and paid-for advertising and organic content appearing on social media and video sharing platforms. It should also be used by affiliates and other third parties involved in the targeted advertising ecosystem.
The guidance suggests there are three key implications of the CAP rules for different approaches to ad placement:
The CAP guidance is based on the principal that just as marketers rely on data to serve ads to audiences likely to be most interested in them, so the data can be used to protect the vulnerable to make it less likely they will see unsuitable ads. The closer the age profile of the audience targeted by the advertiser is to the protected age group, the more care must be taken.
Data which enables targeting may be actively provided by users, but it may also be inferred. Directly provided data can be misleading – for example, children may lie about their age when creating a logon, or the same device may be used by people across a wide age range. This is even more true where ads are served to non-logged in users or when using programmatic targeting. As a result, marketers are strongly urged to rely on a combination of age-targeting tools to remove certain demographics – as many as are available.
Marketers should reinforce their use of demographic data with interest and behavioural data where available. This includes being clever about selecting and combining interest criteria. The guidance provides the example of combining those interested in football which would cover both adults and children, with those interested in buying property, which would cover adults. That would be likely to exclude the majority of children interested in football from the target audience.
External data should also be used where a platform facilitates this – for example, data on whether an individual has a credit or store card, as processes for issuing these include rigorous credit checking. Similarly, marketing data from customers who have passed mandatory age checks for gambling services at point of sign-up are also considered to provide robust evidence of age by CAP.
Some ad placements are acknowledged to attract low risk. For example, older adults can be targeted by using interest factors which naturally exclude children and young people, like insurance products, family holidays or readership of particular publications.
One of the issues with many age verification techniques is that they can involve processing large amounts of personal data. This means complying with the UK data protection law under which special care must be given to processing children's personal data. It is likely to require a Data Protection Impact Assessment and there may be issues with selecting a valid lawful basis to the processing. See more here.
In September 2020, the ICO's Children's Code came into force. It contains 15 standards for digital services likely to be accessed by under-18s. It covers services which are not necessarily targeted at children but which are likely to be accessed by them. Read more.
Marketers must be able to demonstrate they have taken the relevant media restriction into account for each part of their campaign and that they have acted to limit the exposure of the appropriate group to their ads. They must be able to show, primarily through audience data, that the group protected by the relevant placement restriction is unlikely to form more than 25% of the total audience.
CAP acknowledges that this data may not always be very precise but marketers must use whatever data they can access to build up as clear a picture as possible of the likely audience of a medium or specific piece of content.
This includes having a record of where ads appeared and their likely audience, as well as steps taken to ensure ads are served appropriately and the likelihood of access by restricted age groups has been limited. Marketers are also encouraged to ensure all parties involved in developing and publishing campaigns are aware of and follow media restrictions.
What will the ASA look at?
The ASA is responsible for enforcing the CAP Code and will investigate complaints about inappropriate placement or targeting.
Where audience data is unreliable or unavailable, the ASA will look at other factors. This includes an assessment of the media content in or around which an ad appeared, including themes, images, and context. If the ASA considers there is a reasonable risk that a significant proportion of the audience for an ad which should have been restricted was within the restricted group, there is likely to be a breach of the Code.
The ASA will look at where web users are likely to have seen an ad so, for example, a paid-for social media post by an influencer will be assessed based on their account and followers or subscribers, and a paid-for ad on a VSP will be assessed based on the audience for the specific video content and/or the specific video channel it appeared in or around.
The presumption will be that the organic marketing communications are available to the whole audience for the social media account or VSP in question. The ASA will, however, have regard to whether the account is public or only available to followers or subscribers. Marketers are advised to make use of tools provided by digital media companies to help ensure appropriate age access.
Who is responsible for compliance?
The advertiser, not the media owner or publisher is responsible for complying with the rules on age-restricted ads. However, the media owner or publisher may be expected by advertisers to play a role in providing tools to help the advertiser comply.
What happens if the ASA finds there has been a breach of the CAP Code?
In most cases, the primary impact of an ASA decision that there has been a breach of rules around placement and targeting of ads will be bad publicity. The ASA will typically require an offending ad to be withdrawn but may refer persistent or uncooperative offenders to other bodies including Trading Standards or Ofcom and require them to have their material vetted before publication. The ASA can also require search engines to remove marketers' paid-for search advertisements.
Recent enforcement decisions in this area show the ASA is likely to err on the side of caution when deciding whether or not there has been a breach of the rules on targeting age-restricted ads:
The ASA has also asked CAP whether it should be taking a more prescriptive approach in regulating dynamically-served age restricted ads, following the results of monitoring sweep to assess the placement of restricted ads, particularly in mixed-age online media, as we discuss here.
Advertisers should consider that the targeting of age-restricted ads is priority for the ASA and factor it in when appointing media agencies. They should work with their agencies to ensure media buying is appropriately targeted using as wide a combination of data, blocklists and selection tools as possible.
The ASA announced in November 2021 that advertising of cryptoassets, cryptocurrencies and NFTs was a 'red alert priority issue' for them.
1 of 9 Insights
Simon Jupp looks at the UK rules on influencer advertising and what is being done to regulate this area.
2 of 9 Insights
Timothy Pinto and Ella Bazini look at the rules on making environmental claims in advertising and at key ASA investigations into allegations of 'greenwashing'.
4 of 9 Insights
Alex Walton looks at the rules which govern advertising video games.
5 of 9 Insights
Adam Rendle and Lara Pentreath look at Ofcom's statement on the regulation of advertising on VSPs.
6 of 9 Insights
Alice Anderson and Louise Popple look at the ASA's consultation on harm and protected characteristics.
7 of 9 Insights
Debbie Heywood looks at existing and incoming rules on the placement of HFSS product adverts.
8 of 9 Insights
9 of 9 Insights