Legal and ethical gates for one England UGC commission, with no marketplace shortcut

UGC marketplaces do not remove the ordinary legal and operational questions around commissioning an advert. For one English brand unit buying one short-form creator-made asset, the work has to be separated into claims, commercial recognition, consumer treatment, rights, personal information, safeguarding, accessible presentation, account control, payment and contracts.

The correct answer for a live commission today is HOLD. No configured brand, asset, claim, contract, channel or final render exists to approve.

Ugcmarketplace.co.uk checked the legal source set for this guide on 6 September 2026. It is general information about a planning journey, not advice on a particular case. The brand, agency, marketplace operator, creator, featured person and publisher may each make different decisions. Their labels do not transfer duties or prove authority.

What to take away

A green tick in one lane cannot clear another lane of a UGC commission.
Record the territory and legal weight beside each source you rely on.
Payment for production does not necessarily buy copyright in the asset.
Map each personal information field by source, purpose, basis and retention.
Keep creator cash, gifts, services, discounts and affiliate commission in separate rows.
The current answer for a live commission is HOLD until every lane has current, named evidence.

Read the geography and status first

"UK rules" can hide important differences. Record the territory and legal weight beside each source.

Source type	Relevant territory here	What it can establish
UK Act or statutory instrument	depends on the provision	enacted text, extent and commencement
CMA consumer guidance	UK context	regulator interpretation and examples, not a court ruling on this asset
CAP Code and ASA or CAP advice	UK non-broadcast advertising remit	code requirements and published interpretation, not legislation or prior clearance
UK GDPR, DPA 2018 and PECR material	UK	data and electronic-communications framework, subject to the actual processing
Equality Act services code	England, Scotland and Wales	statutory guidance on existing law, not new obligations
child performance guidance	England where specified	licensing and safeguarding framework requiring fact-specific review
contract and tax records	depends on parties and activity	terms, invoices and reporting facts, not an automatic legal conclusion

The 2027 date is a planned recheck point. It does not mean a proposal has commenced or that current guidance will stay unchanged.

Fix the object of review

The buyer journey is narrow. An English brand unit wants one creator to make one short-form asset. The brand must approve product claims and presentation, obtain the required rights, pay the correct parties, publish only through an authorised channel, and keep enough evidence to correct or withdraw the material.

Start a file with the brand's legal entity, product, asset, creator, any representative, featured people, marketplace or agency, publisher, social account and rights inputs. Do not fill gaps from profiles. A username does not prove identity, residence, age, professional status, rights ownership or willingness to contract.

If a UK incorporated company is involved, the Companies House company information service can confirm limited filed particulars. It cannot establish that the company currently performs the claimed service or that an individual can bind it. Unincorporated and overseas parties need an appropriate identity and authority route of their own.

Keep advertising recognition apart from evidence

There are two immediate questions. Will an audience understand that the material is advertising? Can the brand substantiate what it says?

CAP Code Section 2 covers recognition of marketing communications. The August 2026 CAP article on social-media and influencer ads is CAP Executive advice, not legal advice, and does not bind the ASA or CAP.

It discusses upfront prominence and cautions that a platform label may be insufficient in some presentations. The final asset therefore needs a channel-specific visual and audio check.

CAP Code Section 3 contains the substantiation rule for objective claims. Before distribution, the brand's evidence owner should record the claim, documentary source, population, test method, geography, date, qualifications and expiry. A creator's experience does not broaden product evidence. Nor does clear disclosure turn an unsupported statement into a supported one.

Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024 deals with unfair commercial practices. The CMA's current guidance states these provisions apply to commercial practices from 6 April 2025.

The guide is not a substitute for the legislation or a definitive interpretation. A consumer-law specialist should review the overall impression, omitted information and intended transaction in the configured campaign.

Trace the incentive and publication route

The commercial relationship is part of the evidence. Keep creator cash, gifts, services, discounts, affiliate commission, marketplace charges and paid media in different rows. Identify who offered and received each item, which content it relates to, and which agency or representative handled it.

CMA social-media endorsement guidance for brands was updated in August 2025 after the DMCC Act changes; check the CMA social media endorsements page. It addresses incentives, brand responsibility, monitoring and correction. Apply its questions to the real arrangement. Do not turn an independent editorial mention into commissioned UGC, and do not present commissioned work as independent coverage.

Store a disclosure card per channel: exact wording, placement, timing, contrast, spoken treatment, caption or transcript, platform label, creator approval, publisher approval, screenshot, device and test date. This record supports review. It does not create legal clearance.

Sample caption wording for an illustrative commission: '#ad Paid partnership with [Brand]. I was paid to make this video.' The spoken version needs the same words near the start.

Contract for rights that match the intended use

Payment for production does not necessarily buy copyright. IPO guidance on ownership of commissioned works says the creator is usually the first copyright owner unless the parties agree otherwise in writing. A court may find an implied licence in some circumstances, but a buyer should not build a reusable campaign on that uncertainty.

Prepare an asset schedule: performance, script, raw footage, edited video and photographs, plus artwork, music, product materials, trademarks and each featured person's contribution. For each item, record owner, evidence, licence or assignment, territory and media, term, edit authority, reuse, sublicensing and credit, plus expiry and takedown consequence.

Sample row, with illustrative values:

Item	Owner	Evidence	Rights route	Territory and media	Term	Edit authority	Reuse	Credit	Expiry and takedown
Background music track	composer or library named in the contract	licence reference held on the schedule	licence, not assignment	England, paid social and brand site	12 months from first publication	brand may re-cut to 15 and 30 seconds	no sublicensing	credit in the caption	licence expiry, then takedown

The IPO's guide to using another person's copyright distinguishes obtaining a licence, acquiring copyright and relying on an applicable exception. A marketplace upload cannot prove one such route covers the intended use.

Likeness, privacy, passing off, performer and contractual questions may arise outside copyright. The named IP and commercial lawyer must identify the correct route rather than infer a universal UK image right.

Map personal information field by field

The Data (Use and Access) Act 2025 altered parts of the UK GDPR, Data Protection Act 2018 and PECR. According to the ICO's organisational overview, all data-protection provisions were in force on 19 June 2026. The Act amended the framework; it did not sweep it away.

For each creator, representative, featured person and operator field, record source, purpose, controller, lawful basis, access, sharing, transfer, retention, accuracy, correction, suppression and deletion. If the field came from somewhere other than the individual, transparency still requires analysis. The ICO's page on privacy information covers controller identity, purpose, basis, recipients, retention and rights.

Do not classify people by protected traits, age, audience makeup or likely interests from their names, images or activity. The ICO explains that deliberate special-category inference can engage Article 9 even where the inferred result may be wrong. A public profile is not an unrestricted data source.

Treat creator contact as its own operation

Marketplace membership may authorise a defined service message within the contracted service. It does not automatically authorise the brand, agency or another supplier to send promotion elsewhere.

ICO guidance includes direct messages on social media within the concept of electronic mail marketing. The privacy and PECR reviewer should record the sender, purpose, route, subscriber type, solicited status, lawful basis, suppression evidence and objection mechanism. Genuine research, creator recruitment and marketing need separate purposes; relabelling a pitch does not change what it does.

When a marketplace or agency processes personal data, decide its role from factual control. ICO controller and processor contract guidance addresses instructions, confidentiality, security, subprocessors, rights assistance, audits and end-of-contract return or deletion. The page is explicitly under review following DUAA changes. Save the version reviewed and reopen it on the contracting date.

Stop when age is uncertain

Do not estimate whether a creator or featured person is a child from voice, appearance, profile language or audience comments. Write an uncertainty state into onboarding and block contact or production until the safeguarding owner resolves it through an appropriate, minimised process.

Department for Education licensing guidance concerns children taking part in specified performances and activities in England. It contains scope detail and exceptions, including discussion of user-generated content. That makes fact-specific classification essential. The person organising the activity, the child's local authority and a qualified safeguarding lawyer may need to be involved. Marketplace acceptance is not a safeguarding decision.

Test accessibility in the final channel

Accessible source files can still fail when cropped, overlaid, auto-captioned or rendered by a social platform. Set requirements for captions, transcripts, text alternatives, contrast, flashing content, essential audio and visual information, reading order and controls as relevant. Inspect the actual device and channel version before release.

The EHRC services code of practice became statutory guidance on 5 August 2026 and applies to England, Scotland and Wales. It interprets the Equality Act 2010 but adds no new legal obligations.

The equality lawyer and accessibility specialist should note the service, audience and content features examined. An automated pass is not a verdict on the complete experience.

Protect accounts and the evidence trail

The brand should retain publication authority. Give agencies, creators and marketplace operators only the access needed for a stated task and period. Record who approved access, which account and permission were used, log availability, incident contacts, revocation and tested recovery. Do not share master credentials.

NCSC guidance for important online accounts recommends two-step verification and removing accounts that are no longer required. These are useful controls, not proof that an entire supplier chain is secure. Security review should also cover asset transfer, confidential product data, subcontractors, backups and exported records.

Put commercial terms around the whole journey

The contract set should identify the parties and authority; brief and acceptance; claim evidence; disclosures; creator and featured-person permissions; content, music and image rights; data roles; security; accessible deliverables. It should also cover safeguarding; fees; taxes; cancellation; corrections; complaints; suspension; export; deletion and exit.

Marketplace terms, a brand order and a creator agreement may conflict, so a lawyer should map priority and governing law.

Amounts need a legal payee, currency, VAT basis, unit and quantity. They need period, term, deductions, source date.

Keep brand expenditure, creator consideration, agency or platform charge, paid media and internal labour apart.

HMRC's guidance for people selling through a digital platform explains information collection and reporting, and a platform report does not automatically establish tax due; accounting and tax reviewers must decide the real treatment.

Where terms are offered to a person acting as a consumer, the CMA's July 2026 page on fair customer contracts explains the scope of Part 2 of the Consumer Rights Act 2015. It also states that those rules do not apply to employment contracts. The lawyer must classify each counterparty and contract before applying consumer, business or employment analysis.

Worked example: one England brand commission

Illustrative only, with placeholder names. An England brand unit commissions one creator to make one 30-second paid social video. The creator is an adult; a child appears briefly. The product carries one objective claim.

Each lane records pass, fail or unresolved against named evidence:

Lane	Test	Result in this example
Recognition	Will the audience know it is advertising within the first seconds?	Pass: disclosure card approved for this channel, on screen and spoken
Substantiation	Does the brand hold evidence for every objective claim?	Fail: no test report for the headline claim, so the claim comes out or the release stops
Incentive	Is each incentive identified and attributed?	Pass: cash fee and free product listed
Rights	Is there a written route for footage, music, artwork and likeness?	Unresolved: music licence not produced
Personal information	Is each field mapped with source, purpose, basis and retention?	Pass for the creator; unresolved for the child's data
Safeguarding	Is age confirmed and the licence position checked?	Unresolved: local authority licence not seen
Accessibility	Do captions and contrast survive the final render?	Pass on the test device; re-test on publication
Account control	Is brand publication authority recorded?	Pass: named approver, two-step verification, no shared master credentials
Payment and tax	Are payee, currency, VAT basis and reporting identified?	Pass: invoice terms in the contract
Contract	Do marketplace, brand and creator terms agree on priority?	Unresolved: no conflict clause

The decision tree runs in three steps. List every lane. Mark each one pass, fail or unresolved. Release only when every lane reads pass.

Fees, terms and territories here are placeholders. What sets each figure is the scope, the territory and media, the licence term, the edit authority and the paid media plan.

Operate a hold, correction and withdrawal process

Before release, every lane records pass, fail or unresolved against its own evidence. The release owner cannot average the results. A missing music right is still a stop even if the disclosure is clear. An advertising pass cannot compensate for unsafe account access.

Monitor only the authorised channels and versions. Create triggers for a missing label, unsupported claim, rights complaint, safeguarding concern, privacy objection, inaccessible render, account incident, payment dispute or supplier change. For each trigger, name the person who can pause media, restrict access, correct the asset, notify affected parties, withdraw publication, preserve evidence and authorise a retest.

The publication file should contain the approved asset hash, claim register, disclosure capture, rights schedule, data map, accessibility result, access log, contracts, payment evidence, monitoring record and decision history. Retention and deletion periods need case-specific approval rather than an invented universal term.

Publication-day checks for 2027

Four sources need a fresh check before a 2027 release. Recheck each on the publication date and record the version you used.

The Digital Markets, Competition and Consumers Act 2024. The CMA's current guidance states that the unfair commercial practices provisions in Chapter 1 of Part 4 apply to commercial practices from 6 April 2025. The remaining consumer provisions commence by commencement regulations, so check the order on legislation.gov.uk instead of assuming a date.
The Data (Use and Access) Act 2025. The ICO's organisational overview states that all data-protection provisions were in force on 19 June 2026. Pages marked under review after those changes, including the controller and processor contract guidance, need the version you saved and a fresh check.
The EHRC services code of practice, statutory guidance since 5 August 2026 for England, Scotland and Wales, interprets the Equality Act 2010 and adds no obligations. Check for a revised version.
The CAP Code version, the ASA and CAP advice pages, the terms of each platform used, and the local authority position on child performance licences.

Recheck lane by lane:

Claim register against the current substantiation rule.
Disclosure card against current recognition advice.
Rights schedule against amended copyright or performer rules.
Data map against current ICO guidance.
Safeguarding file against the current licence guidance.
Accessibility test against current platform behaviour.

Named people do the final review. The lawyer roles, the privacy and PECR reviewer, the safeguarding lead, the accessibility practitioner, the security reviewer and the tax adviser depend on the parties and the product.

Before you act

Record territory and legal weight beside each source.
Start a file listing every party and rights input.
Store a disclosure card for each publishing channel.
Prepare an asset schedule covering every contributed element.
Map each personal information field before processing.
Do not classify people by protected traits from profiles.

Common questions

Does a platform label make a creator ad clearly recognisable?

The August 2026 CAP article on social-media ads discusses upfront prominence and cautions that a platform label may be insufficient in some presentations. The final asset therefore needs a channel-specific visual and audio check before distribution.

Can the brand rely on the creator's own experience as product evidence?

No. CAP Code Section 3 contains the substantiation rule for objective claims. A creator's experience does not broaden product evidence, and clear disclosure does not turn an unsupported statement into a supported one. The brand's evidence owner should record the claim, source, method, geography and date.

What should the brand do about personal information from a public profile?

Record source, purpose, controller, lawful basis, access, sharing, transfer, retention, accuracy, correction, suppression and deletion for each field. If the field came from somewhere other than the individual, transparency still requires analysis. A public profile is not an unrestricted data source.