Digital Marketing Regulations in Wales: A Compliance Guide
Table of Contents
Digital marketing regulations in Wales combine two things that do not always sit neatly together: law that applies across the whole of Great Britain, and policy the Senedd sets for Wales alone. That mix is what trips up small firms most often.
The rules have moved fast. The Data (Use and Access) Act 2025 and the Digital Markets, Competition and Consumers Act 2024 are now in force, PECR fines have risen sharply, and Wales has brought in its own restrictions on how less healthy food is promoted. The Welsh language sits on top of all of it.
This guide sets out what applies to your website, your email, and your paid campaigns. It walks through the 2025 to 2026 legal shifts, the three pillars of UK compliance, the points where Wales genuinely differs, and a checklist you can work through in an afternoon.
At a Glance: UK-Wide Rules vs the Welsh Difference
Most of what governs digital marketing regulations in Wales is reserved for Westminster and applies identically in Cardiff, Belfast, and Manchester. A short list of areas is set by Wales itself. This table shows which is which.
| Area | Main authority | Applies to private SMEs in Wales? | Wales-specific difference |
|---|---|---|---|
| UK GDPR and the DUAA 2025 | ICO | Yes | None. Reserved for Westminster, uniform across the UK. |
| PECR (email, SMS, cookies) | ICO | Yes | None, but fines now match UK GDPR levels. |
| Consumer protection (DMCCA 2024) | CMA | Yes | None. CMA can fine directly, up to 10% of turnover. |
| HFSS advertising (watershed and online ban) | ASA and Ofcom | Yes, if you sell HFSS products | None. A single UK-wide rule since January 2026. |
| HFSS promotion and placement | Local authorities | Yes, if 50 or more employees | Divergent. Welsh regulations apply from March 2026. |
| Welsh Language Standards | Welsh Language Commissioner | Only if delivering public services or bound by a public-sector contract | Divergent. No equivalent elsewhere in the UK. |
The 2026 Regulatory Picture for Welsh Marketers
Two big pieces of UK law changed the ground under every marketer in 2025 and 2026. Both apply in Wales exactly as they do in England. Getting the reserved rules right is the foundation before any Welsh layer is added.
UK Data Law After the DUAA
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amends the existing regime rather than replacing it. It sits alongside UK GDPR, the Data Protection Act 2018, and PECR, with provisions phased in between June 2025 and June 2026.
For marketers, two changes stand out. Direct marketing is now explicitly recognised as capable of being a legitimate interest, and a new “recognised legitimate interests” basis has been added. The rules on solely automated decision-making have also been loosened. The starting point for any campaign is still a lawful basis and a clear privacy notice, and our guide to data protection covers how to set that up.
Why Reserved Law Still Governs Wales
Data protection is not devolved. The ICO enforces UK GDPR and PECR across the whole of the UK, and there is no separate Welsh data protection regime. A business in Cardiff faces the same consent rules, the same data-subject rights, and the same one-month deadline for access requests as one in Leeds.
This matters because a common misreading of digital marketing regulations in Wales assumes Wales has its own version of GDPR. It does not. The Welsh layer, where it exists, sits on top of the reserved rules, not instead of them.
Trading Across the Irish Sea
Plenty of Welsh firms trade with the Republic of Ireland and Northern Ireland, and that is where a genuine second regime appears. Sell to customers in the Republic,c and you are processing data under EU GDPR as well as the UK rules, so consent language and transfer safeguards need to satisfy both.
The practical effect on campaigns is close to the way Brexit reshaped cross-border data flows, a subject covered in our piece on Brexit and marketing. If your audience spans the water, treat the two regimes as parallel rather than interchangeable. Firms marketing tourism across the region, from Welsh coastlines to the top cities in Northern Ireland, feel this dual footing most.The Three Pillars of UK Digital Compliance
Before the Welsh specifics, the reserved rules break into three areas: data protection, electronic communications, and consumer protection. Get these right, and most of your compliance work is done. Each pillar carries its own regulator and its own penalties.
Data Protection and Lawful Basis
Every piece of marketing data you process needs a lawful basis, usually consent or legitimate interests. Consent must be freely given, specific, informed, and unambiguous, which rules out pre-ticked boxes and bundled permissions. Where you rely on legitimate interests, write and keep a legitimate interest assessment on file.
Your privacy notice has to be accurate, plain, and visible at the point you collect data. Form fields on your site are a frequent weak spot, and our walkthrough on GDPR web forms shows how to collect cleanly. Serious UK GDPR breaches carry fines of up to GBP 17.5 million or 4% of global annual turnover.
PECR: Email, SMS, and Cookies
PECR governs the mechanics of electronic marketing, and it decides whether you can legally email your list at all. Business-to-consumer email and SMS need prior consent. Business-to-business messages to companies can rely on a soft opt-in with a clear unsubscribe, though sole traders are treated as individuals.
The DUAA raised the PECR fine ceiling from GBP 500,000 to match UK GDPR, and it widened the definitions so that attempted messages count too. Dead and bouncing addresses are now a compliance risk, not just a deliverability one, which puts email marketing compliance and list hygiene at the centre of the job. Cookie banners must let people refuse non-essential cookies as easily as they accept them.
Consumer Protection and the DMCCA
The Digital Markets, Competition and Consumers Act 2024 brought its consumer provisions into force on 6 April 2025. The change that matters most is enforcement: the Competition and Markets Authority can now fine businesses directly, without going to court, up to 10% of global annual turnover.
Three practices are squarely in scope. Drip pricing means mandatory charges must appear in the headline price rather than at checkout. Fake reviews are banned outright, with a positive duty to detect and remove them. Rules on subscription traps follow from April 2026. Our overview of UK digital compliance for online stores sets out what to check first.
The CMA is already acting on it. It opened a consumer-protection drive in November 2025, launching investigations into eight firms and sending advisory letters to a hundred more, with an early focus on pressure selling, misleading omissions, and charges buried behind extra clicks.
The design lesson for marketers is simple: information about price and terms has to be timely, prominent, and clear. Transparent checkout flows and plain terms are becoming a selling point rather than a chore, a theme we explore in our article on the ethics and legalities of the trade.
The Three Pillars of UK Digital Compliance
Before the Welsh specifics, the reserved rules break into three areas: data protection, electronic communications, and consumer protection. Get these right, and most of your compliance work is done. Each pillar carries its own regulator and its own penalties.
Data Protection and Lawful Basis
Every piece of marketing data you process needs a lawful basis, usually consent or legitimate interests. Consent must be freely given, specific, informed, and unambiguous, which rules out pre-ticked boxes and bundled permissions. Where you rely on legitimate interests, write and keep a legitimate interest assessment on file.
Your privacy notice has to be accurate, plain, and visible at the point you collect data. Form fields on your site are a frequent weak spot, and our walkthrough on GDPR web forms shows how to collect cleanly. Serious UK GDPR breaches carry fines of up to GBP 17.5 million or 4% of global annual turnover.
PECR: Email, SMS, and Cookies
PECR governs the mechanics of electronic marketing, and it decides whether you can legally email your list at all. Business-to-consumer email and SMS need prior consent. Business-to-business messages to companies can rely on a soft opt-in with a clear unsubscribe, though sole traders are treated as individuals.
The DUAA raised the PECR fine ceiling from GBP 500,000 to match UK GDPR, and it widened the definitions so that attempted messages count too. Dead and bouncing addresses are now a compliance risk, not just a deliverability one, which puts email marketing compliance and list hygiene at the centre of the job. Cookie banners must let people refuse non-essential cookies as easily as they accept them.
Consumer Protection and the DMCCA
The Digital Markets, Competition and Consumers Act 2024 brought its consumer provisions into force on 6 April 2025. The change that matters most is enforcement: the Competition and Markets Authority can now fine businesses directly, without going to court, up to 10% of global annual turnover.
Three practices are squarely in scope. Drip pricing means mandatory charges must appear in the headline price rather than at checkout. Fake reviews are banned outright, with a positive duty to detect and remove them. Rules on subscription traps follow from April 2026. Our overview of UK digital compliance for online stores sets out what to check first.
The CMA is already acting on it. It opened a consumer-protection drive in November 2025, launching investigations into eight firms and sending advisory letters to a hundred more, with an early focus on pressure selling, misleading omissions, and charges buried behind extra clicks.
The design lesson for marketers is simple: information about price and terms has to be timely, prominent, and clear. Transparent checkout flows and plain terms are becoming a selling point rather than a chore, a theme we explore in our article on the ethics and legalities of the trade.
Where Wales Sets Its Own Rules: Language
Here is where digital marketing regulations in Wales part company with the rest of the UK. The Welsh language is the clearest divergence, and it is also the one most often misunderstood. The rules are conditional, so knowing whether they apply to you comes first.
The Welsh Language Measure 2011
The Welsh Language (Wales) Measure 2011 made Welsh an official language and created the Welsh Language Commissioner, who oversees a set of Welsh Language Standards. Those Standards apply mainly to public-sector bodies and organisations carrying out statutory functions, not to most private firms.
The commercial case is a separate matter. The Welsh Government’s Annual Population Survey estimated about 828,500 Welsh speakers in the year ending September 2025, roughly 27% of people aged three and over, while the 2021 Census recorded a lower 538,300. Either way, it is a sizeable audience that responds well to being addressed in its own language.
When Private Firms Are Bound
Three situations change the picture. First, tendering for Welsh public-sector work: many procurement frameworks require suppliers to show Welsh-language capacity in their communications, so the obligation reaches private firms through the contract. Second, publicly funded or regulated services can carry Welsh-language conditions attached to their funding.
Third, and most common, is choice. A bilingual presence is a competitive edge in a market where relatively few businesses have done the work properly. The obligation is conditional; the opportunity is open to anyone.
Building a Bilingual Site That Ranks
A bilingual site done badly hurts your search performance. Duplicating English pages in Welsh without the right technical setup creates duplicate-content problems that stop the Welsh pages from ranking. The fix is proper hreflang markup, with hreflang=”cy” for Welsh pages and hreflang=”en-GB” for English, each referencing the other.
URL structure should keep the versions distinct, usually a subdirectory such as /cy/ rather than a query parameter, which is where a capable website development team earns its keep. A visible language switcher on every page rounds it off, and getting the structure right is often the difference our SEO services team sees between Welsh pages ranking and being ignored.
Where Wales Sets Its Own Rules: Food Promotion and Sector Marketing
The second Welsh divergence is easy to get wrong because it is often described inaccurately. Advertising and promotion are two different things in law, and Wales diverges on one but not the other. This section separates them and covers a couple of sector points that catch marketers out.
HFSS Advertising Is UK-Wide
There is a persistent myth that Wales runs a stricter regime for online junk-food adverts. It does not. The restrictions on advertising food and drink high in fat, salt, or sugar, a 9 pm television watershed, plus a total ban on paid online adverts, are a single UK-wide rule.
They came into force on 5 January 2026 under the Communications Act 2003 as amended by the Health and Care Act 2022, and they apply in England, Wales, Scotland, and Northern Ireland alike. The ban targets products, not brands, so an HFSS product cannot feature in a paid online advert anywhere in the UK.
HFSS Promotion Rules Diverge in Wales
The real Welsh difference is in promotion and placement, which is devolved. The Food (Promotion and Presentation) (Wales) Regulations 2025 take effect on 26 March 2026 and restrict volume price promotions, such as multi-buy and buy-one-get-one-free, on specified HFSS products.
They also restrict where those products can be placed, both in-store and in the equivalent online locations: homepages, pop-ups, basket and checkout pages, and search results for other products. The rules apply to businesses with 50 or more employees and largely mirror England’s, with some differences worth checking. For any Welsh retailer selling food online, this is the clause to read closely.
Geotargeting and Local Campaigns
Because these Welsh promotion rules apply to online placement for Welsh audiences, geographic targeting becomes a compliance tool as well as a marketing one. Serving Wales-compliant placement to Welsh visitors, and standard placement elsewhere, keeps each audience under the right rules.
Treat it as a way to apply the correct rule cleanly, not as a loophole to dodge one. Local targeting done well also lifts visibility, as our guide to AI local SEO explains, so the same setup serves two purposes.
Tourism and Sponsored Content
Two more sector points recur. Tourism marketing sits under UK-wide consumer law plus Visit Wales guidance, and accommodation or experience providers should check whether a local authority or National Park adds its own advertising conditions.
Sponsored and influencer content is governed by the ASA across every platform, from short videos to blog posts. The label, “Ad” or “Paid Partnership”, has to be upfront and clear before the user engages. This applies to social media for business in Wal, just as it does anywhere else in the UK.
Turning Rules Into a Working Compliance Process
Reading the rules is one thing; running them across live channels is another. A short, repeatable process keeps most SMEs on the right side of digital marketing regulations in Wales without turning compliance into a full-time job. Start with the systems, then the people, then the risk.
Audit Your Tech Stack and Consent
Begin with the parts that touch data. Check that your cookie tool actually blocks non-essential cookies until a visitor accepts, since most platforms ship with a default that does not meet PECR. Confirm you have a written process for handling data-subject requests within the one-month deadline.
Accessibility belongs in the same review. Public-sector sites must meet WCAG 2.1 AA by law, and private sites carry Equality Act exposure if they exclude disabled users, a point our note on accessibility compliance unpacks. A basic digital strategy review can pull these threads together.
Train the Team and Document Decisions
Most breaches are not deliberate; they come from someone acting without the full picture. A short session on consent, PECR, and advertising claims prevents the common errors, and our GDPR training topics map to exactly these gaps.
Documentation is the other half. Keep your legitimate interest assessments, log the evidence behind any advertising claim, and record consent at the point of collection. Structured digital training makes those habits stick across the team rather than living in one person’s head.
AI Tools and New Questions
AI marketing tools raise fresh questions. Any tool that processes personal data is a data processor like any other, so you need a data processing agreement with the provider and a line in your privacy notice telling users their data may be handled by AI systems. Fully automated decisions with legal or similar effects sit under tighter rules.
As Ciaran Connolly, founder of ProfileTree, puts it: “The businesses that get tripped up by AI and data compliance are usually not the ones doing anything underhanded. They are the ones who moved fast on a new tool without checking the data agreements. Slowing down for that check costs an hour. Fixing the fallout costs much more.”
Reviewing the data implications of a tool before rollout is what our AI training work builds in.
Penalties and Proportionate Risk
Risk should be sized, not feared. For a first minor data slip, the ICO is more likely to issue a reprimand than a fine, though reprimands are published and can dent client trust. The ASA’s main sanction is a public ruling that surfaces against your business name and stays there.
The table below sets out the headline maximums so you can weigh effort against exposure.
| Regime | Regulator | Headline maximum penalty |
|---|---|---|
| UK GDPR | ICO | GBP 17.5m or 4% of global turnover |
| PECR (post-DUAA) | ICO | GBP 17.5m or 4% of global turnover |
| Consumer law (DMCCA) | CMA | Up to 10% of global turnover; directors up to GBP 300,000 |
| Misleading advertising | ASA and Trading Standards | Published ruling; prosecution in serious cases |
The 10-Point Welsh Compliance Checklist
Work through this against your current site and campaigns.
- Your cookie banner offers a genuine reject option before non-essential cookies are set.
- Your privacy notice is accurate, plain, and linked from every page.
- Your email list holds only contacts with documented consent, or a verified B2B soft opt-in.
- Every marketing email identifies your business and carries a working unsubscribe link.
- Sponsored and paid social content is clearly labelled before the user engages.
- Prices show all mandatory charges up front, with no fees added at checkout.
- You have a policy to prevent, detect, and remove fake reviews.
- If you tender for Welsh public-sector work, your materials meet the contract’s Welsh-language terms.
- Any bilingual site uses hreflang correctly, with distinct Welsh-language URLs.
- If you sell HFSS products online in Wales, your placement and promotions meet the 2025 Welsh regulations from March 2026.
Conclusion
Most of the digital marketing regulations in Wales are UK-wide laws you share with the rest of the country, tightened over 2025 and 2026 by the DUAA and the DMCCA. The Welsh-only pieces are narrow: language obligations tied to public-sector work, and food-promotion rules for larger retailers. Get the reserved basics right, then check the two Welsh layers apply to you before spending a penny on them.
If you would like a second pair of eyes on where your site and campaigns stand, ProfileTree’s digital strategy team works with SMEs across Wales, Northern Ireland, and the rest of the UK. Get in touch for a compliance-focused review.
FAQs
Do I legally need a Welsh-language version of my website?
For most private SMEs, no. The Welsh Language Standards under the 2011 Measure apply mainly to public-sector bodies and organisations delivering statutory services. The obligation reaches private firms in specific cases, most often when a Welsh public-sector contract requires Welsh-language capacity, or when funding carries language conditions. Outside those cases, it is a commercial choice rather than a legal one, and for a market of well over half a million Welsh speakers, it is often a good one.
Does GDPR change if I target customers in Wales rather than England?
No. UK GDPR and the DUAA apply uniformly across England, Wales, Scotland, and Northern Ireland, and the ICO enforces them everywhere. There is no separate Welsh data protection regime. The same consent rules, data-subject rights, and breach-notification duties apply whether your audience is in Cardiff or Coventry. The only true second regime appears if you also process the data of people in the Republic of Ireland, where EU GDPR applies alongside the UK rules.
Can I be fined for dark patterns in my checkout?
Yes. Under the DMCCA 2024, in force since April 2025, the CMA can fine businesses directly for consumer-law breaches, up to 10% of global annual turnover, and individual directors up to GBP 300,000. Hidden mandatory charges added late in the journey, misleading urgency, and buried terms all fall in scope. Show the full price up front and keep terms clear and prominent.
How do the junk-food ad rules affect my social campaigns in Wales?
The advertising rules are UK-wide, not Welsh-specific. Since January 2026, paid online adverts for HFSS products have been banned across the UK, with a 9 pm watershed on television. If your products are classified as HFSS, that applies to your paid social in Wales exactly as it does in England. Separately, from March 2026, Wales will restrict how larger retailers promote and place HFSS products online, including on homepages and checkout pages, which is where the genuine Welsh divergence sits.
Did the DUAA make it easier to send marketing emails?
It clarified rather than relaxed. The DUAA confirms that direct marketing can rely on legitimate interests and recognises a new legitimate-interests basis, which strengthens your position if you keep a written assessment on file. It did not remove the PECR consent rules for consumer email, and it raised the fine ceiling to UK GDPR levels while making attempted messages count. Clean lists and documented consent matter more now, not less.