Social media rules for small businesses in the UK and EU: a plain-English guide

Social media feels informal, but the same consumer, advertising and data protection laws apply to a post as to a printed leaflet. The good news is that the essentials are simple. This guide covers what most small businesses in the UK and EU need to know — in plain English.

1. Make ads obviously identifiable

If you pay someone to post about you — with money, free products, free services or other perks — and you have any control over what they post, the content is an advertisement and must be clearly labelled.

In the UK, the Advertising Standards Authority (ASA) enforces the CAP Code, which requires ads to be obviously identifiable as such. Its guidance for influencers recommends a clear label such as “#ad” at the start of the post; vague wording like “thanks to…” or “in collaboration with” isn’t enough on its own. EU countries apply similar rules under consumer protection law, which prohibits hidden advertising.

For your business: when you gift a treatment, meal or product to a creator in exchange for a post, agree upfront that it will be labelled as an ad. Both you and the creator can be held responsible.

2. Reviews must be genuine

• UK: since 6 April 2025, the Digital Markets, Competition and Consumers Act 2024 bans fake reviews and reviews that conceal incentives, and lets the Competition and Markets Authority fine businesses up to 10% of global turnover.
• EU: the Omnibus Directive (2019/2161), applied since 28 May 2022, prohibits fake reviews and misleading presentation of reviews, and requires businesses that display reviews to explain whether and how they check them.

Never write, buy, swap or filter reviews, and don’t offer rewards for them. Our guide to getting more reviews the honest way explains what you *can* do.

3. Personal data: photos, messages and lists

Under UK GDPR and EU GDPR, information about identifiable people is personal data — including photos and videos where someone can be recognised, direct messages and contact details from forms.

• Ask before posting photos or videos of customers or staff, and explain where they’ll appear. Take particular care with children.
• Keep messages and enquiries secure, share them only with people who need them, and don’t keep them longer than necessary.
• Don’t add people to marketing emails or messages without the right basis — usually consent.
• Have a privacy notice on your website that explains what you do with personal data.

Serious breaches can lead to large fines — up to £17.5 million or 4% of global turnover under UK GDPR, and up to €20 million or 4% under EU GDPR — though regulators generally focus on guidance and proportionate action for small businesses.

4. Competitions and giveaways

Giveaways are popular, but they need care:

• Publish clear terms: who can enter, how, closing date, the prize, how the winner is chosen and notified.
• Make sure it’s a prize promotion, not an illegal lottery or gambling — rules differ by country, especially for paid entry.
• Follow the platform’s own rules for promotions (for example, Meta’s promotion guidelines).
• Collect only the personal data you need, and tell entrants how you’ll use it.

5. Prices and offers must be accurate

Consumer protection law in the UK and EU prohibits misleading prices and offers. In your posts:

• State prices correctly and say whether they include VAT where that matters.
• Give the conditions of an offer: dates, availability, exclusions.
• Don’t create false urgency (“only today!”) if it isn’t true.
• Keep claims honest and backed up — avoid “the best in town” unless you can justify it.

6. Music, images and other people’s content

• Use music from the platform’s own library, within its terms. Business accounts may have a more limited, commercially licensed selection.
• Use your own photos, properly licensed stock, or content you have written permission to repost.
• When reposting a customer’s post, ask first and credit them.
• Don’t use other brands’ logos or characters in ways that suggest endorsement.

7. Sector-specific rules

Some sectors have extra rules for marketing, including alcohol, food claims (health and nutrition claims), cosmetics and aesthetics, medical and health services, and financial products. If you work in one of these areas, check the specific guidance in your country before posting claims.

A simple pre-post checklist

1. Is this paid, gifted or sponsored? Label it as an ad.
2. Are the prices, dates and conditions accurate?
3. Do we have permission for every identifiable person, photo and song?
4. Are any reviews genuine and fairly shown?
5. Is any claim something we can back up?

Frequently asked questions

Do I need to put #ad on gifted posts?

If a creator posts about your business because they received something free, and you had any control over the content (including asking them to post), it is generally an advertisement and should be clearly labelled, for example with “#ad” at the start.

Can I post photos of customers on social media?

Only with their permission if they can be identified. Photos of identifiable people are personal data under UK GDPR and EU GDPR. Explain where the photo will appear and respect requests to remove it.

Are fake reviews illegal in the UK?

Yes. Since 6 April 2025 the Digital Markets, Competition and Consumers Act 2024 explicitly bans fake reviews and concealed incentivised reviews, with fines of up to 10% of global turnover.

Can I run an Instagram giveaway?

Yes, with clear terms, a fair way of choosing winners, compliance with the platform’s promotion rules and care with entrants’ personal data. Avoid structures that could count as an illegal lottery.

Can I use any song in my business videos?

No. Use music from the platform’s licensed library within its terms, or music you’ve licensed for commercial use.

The bottom line

Label ads, keep reviews genuine, ask permission for people and content, protect personal data, run competitions with clear terms and keep prices and claims accurate. Follow those principles and you’re compliant in the vast majority of everyday situations.

At Viraluna every post is checked for accurate offers, clear ad labelling where needed and permission for people in photos — and you approve everything before it’s published. See how it works.