Private social messages count as electronic mail, and other UK rules for B2B sellers

B2B social selling rules and ethics do not fit into a consent box or an #Ad label. An English seller may publish advertising, process a buyer's personal information, send an electronic message and commission a specialist in the same piece of work. Each act raises a different legal or code question.

This guide maps the main UK-wide frameworks as they stood on 5 September 2026. It applies them to operations aimed at organisations or business contacts in England.

It does not settle the law for a particular campaign, regulated product, overseas audience or contract. The ICO marks some business-marketing guidance as under review after the Data (Use and Access) Act 2025, so a qualified reviewer must check the live position before a 2027 launch.

What to take away

Identify the act before choosing a rule

Start with the proposed action, not the job title of the recipient. Record whether the team will:

Several rows may apply. A post from a salesperson can be both a marketing communication and a use of personal information if it tags or targets an identifiable buyer. Calling the work social selling does not create an exemption.

For business-to-business advertising, GOV.UK's marketing and advertising law overview points to the Business Protection from Misleading Marketing Regulations 2008. The regulations themselves prohibit misleading advertising to traders and set conditions for comparative advertising.

Consumer-facing or mixed-audience work can raise separate issues, including the unfair commercial-practices provisions of the Digital Markets, Competition and Consumers Act 2024. Audience and likely effect matter more than an internal B2B label.

Check whether the CAP Code is in scope

The CAP Code covers defined non-broadcast marketing communications. Its current scope section includes paid online ads and certain marketing on an organisation's own online space, with specific cross-border criteria. It does not cover every statement made by every employee. The marketer should document why each placement is in or out, not assume all professional posts are treated alike.

Where the Code applies, three decisions are central.

First, make the commercial nature apparent. Section 2 requires marketing communications to be obviously identifiable and prohibits a marketer from pretending to act outside its trade or profession where commercial intent is unclear.

Second, hold evidence before publication. Section 3 requires documentary substantiation for objective claims capable of proof and sets conditions for comparisons. A customer result cannot support a universal promise unless the evidence justifies that breadth. A qualification should narrow a claim clearly, not contradict the headline after the reader has acted.

Third, check specialist sections. Financial promotions, employment opportunities, health claims, environmental statements and other subjects can carry additional rules. Send the exact words, audience, placement and evidence to a reviewer with the relevant subject expertise.

Treat private social messages as electronic mail

A direct message is not merely a conversation because a platform calls it InMail or messaging. The ICO's current business-to-business marketing guidance says PECR's definition of electronic mail includes stored direct messages through social media.

Subscriber type changes the analysis. Companies, limited liability partnerships and some other bodies are corporate subscribers. Sole traders and certain partnerships are individual subscribers.

The ICO says PECR's consent rule for electronic-mail marketing does not apply to corporate subscribers. Identity and a valid opt-out address are still required. For individual subscribers, consent or a valid soft opt-in is generally needed. If status is uncertain, the ICO recommends treating details as an individual subscriber.

This is only the PECR layer. A named business contact's details are personal information, so UK data-protection duties can still apply when PECR does not require consent. The detailed ICO electronic-mail marketing guidance was updated on 28 April 2026. Build the channel and audience decision from that live record, not an old sales playbook.

Give personal information its own workflow

Names, profile identifiers, work email addresses, inferred seniority and message histories may relate to identifiable people. Public visibility does not remove UK GDPR duties. The B2B guidance says sellers must have a lawful basis, provide privacy information and respect the right to object when personal data is used for direct marketing.

If relying on legitimate interests, record the purpose, necessity and balancing tests. The ICO's legitimate-interests guidance was updated on 23 March 2026 for Data (Use and Access) Act amendments. It does not make legitimate interests an automatic permission for every prospecting activity. Expectations, proportionality, other marketing rules and an individual's rights remain part of the decision.

An operational record should show:

The ICO's guidance on planning direct marketing covers targeted social-media activity and platform advertising. It asks organisations to consider fairness, transparency, lawful basis and whether people would expect information to be shared with a platform.

Do not outsource responsibility with the data

A list supplier, agency or software provider cannot warrant away the seller's regulatory duties. The ICO tells organisations using marketing services from data brokers to check collection source, privacy information, age and method. They should also check lawful basis and intended use. Accepting a supplier's broad assurance is not enough.

Map the relationship for every service handling personal information. A processor acts on the controller's documented instructions; another party deciding its own purposes may be a controller. Where Article 28 applies, the ICO lists required controller-processor contract terms, including processing details, confidentiality, security and sub-processors. It also covers rights assistance, end-of-contract treatment and audits.

Commercial terms should cover more than privacy: state who owns commissioned words and images, and which claims need approval. Say where content appears.

Add how commercial relationships are disclosed, who monitors live posts, and how access is removed at termination. The Intellectual Property Office's copyright ownership guidance says a contractor usually retains copyright in commissioned work unless the parties agree otherwise in writing.

Make endorsements and employee advocacy recognisable

Payment is not the only relationship that can affect how a post is understood. Gifts, commission, discounts and loans can matter. Event access, employment and ownership interests may also affect a disclosure decision. A label should be visible before the audience interprets the claim, not hidden on a profile or beyond a click.

The CMA's current guidance for businesses and brands says brands should put disclosure obligations into formal or informal arrangements, check published content and correct inadequate labelling. That record covers consumer protection. A business-only placement needs its own legal analysis, but the CAP Code's recognition rule and the ethical need to expose a material commercial relationship remain relevant.

Do not describe a commissioned quotation as an independent buyer view. Verify permission, wording, scope and current accuracy. If the speaker received an incentive, capture that fact before approval. If the organisation cannot prove an experience or result, omit the endorsement rather than polish it into a stronger claim.

Assign responsibility at five gates

A workable compliance route gives one owner authority at each point:

Sales owns relevance and the hand-off. Marketing owns the brief and asset record. A privacy lead reviews personal-information use. Legal or a suitably qualified adviser settles law, contract and sector questions. Security controls account access and recovery. Senior management decides whether a residual risk is acceptable; it should not ask a junior publisher to make that decision silently.

The National Cyber Security Centre's organisational social-media guidance supports authorised publishing, content review, two-step verification, access logging where available and an emergency recovery plan. These controls also preserve evidence when a post is challenged or an agency relationship ends.

Pause on evidence, contact or disclosure failure

Stop a release when a claim lacks dated support, the recipient category is unknown, or an objection has not reached every sending system. Also stop when the privacy notice does not describe the use, a paid relationship is hidden, or no one can revoke publishing access. Correct the process before changing the wording.

Escalate complaints and incidents through routes designed in advance. Preserve the original content, approval record, audience settings and action taken. Do not delete evidence merely to tidy the public feed. A data breach, regulatory complaint, sector issue or threatened claim needs the appropriate specialist response.

On publication day, recheck the ICO pages carrying review notices, the current CAP Code, contract status, platform settings and any dated evidence.

For 2027, describe planned practices as plans. Do not turn a proposed legal change, a supplier feature or a risk forecast into an observed fact. The safest strategy is a traceable connection between a legitimate commercial purpose, honest evidence, respectful contact and accountable delivery.

Before you act

Common questions

When does a social media direct message count as electronic mail?

The ICO says PECR's definition of electronic mail includes stored direct messages sent through social media. That means the consent rules for electronic mail marketing can apply to a private message, not just to email. The recipient's subscriber type then decides whether consent is needed.

What must a seller do before relying on legitimate interests for prospecting?

Record the purpose, necessity and balancing tests for the processing. The ICO's legitimate-interests guidance was updated on 23 March 2026 for Data (Use and Access) Act amendments. It does not make legitimate interests an automatic permission, so expectations, proportionality and individual rights still form part of the decision.

Who owns copyright in content commissioned from an agency or creator?

The Intellectual Property Office's copyright ownership guidance says a contractor usually retains copyright in commissioned work unless the parties agree otherwise in writing. Commercial terms should therefore state who owns commissioned words and images, and how access is removed at termination.