B2B demand generation rules and ethics without the guesswork

What to take away

Which rules actually apply to B2B demand generation in England?

B2B demand generation is treated more leniently than consumer marketing in some areas and almost identically in others. The split matters. Email marketing to corporate subscribers falls outside the PECR consent rule, as the ICO email marketing guidance explains, while the soft opt-in for individual subscribers depends on how the address was obtained and what was said at the time.

Consumer protection law is the opposite. The Digital Markets, Competition and Consumers Act 2024 reshaped the CMA's powers over unfair commercial practices. Its misleading actions and aggressive selling provisions can capture business-to-business conduct where a smaller business is treated as a consumer in practice.

The competition and consumer rules affecting B2B conduct are worth reading in the original, because the scope is wider than most sales teams assume.

Advertising is the third strand. The CAP Code applies to non-broadcast marketing communications, and the ASA's AdviceOnline library with detailed guidance on marketing rules is the fastest way to check whether a claim, a testimonial or a pricing statement needs qualifying. Business audiences are assumed to be more sceptical, but they are not outside the code.

A useful starting point for any agency or in-house team is to map each campaign to these three strands before launch. Our overview of B2B demand generation UK regulations in England sets out how the strands interact when a single campaign uses paid search, email and event follow-up together.

What does the Data (Use and Access) Act 2025 change for lead generation?

The Data (Use and Access) Act 2025 amends the UK's data protection framework rather than replacing it. For demand generation, the practical changes sit around how organisations document lawful basis, handle subject access requests and approach automated decision-making in lead scoring. The ICO's overview of the Data (Use and Access) Act 2025 explains the scope and the commencement position.

The Act did not remove the need for a lawful basis. Legitimate interests remains the most common basis for B2B prospecting. In UK GDPR terms, that is Article 6(1)(f), and it requires a balancing test that is written down and revisited. A one-line entry in a spreadsheet is not a balancing test.

Consent still governs most cookie-based tracking and any email sent to an individual subscriber rather than a corporate one. Where a form collects a work email address, the wording next to the submit button determines what can be done with it later. Ambiguous wording shifts risk onto the sender.

Lead scoring models also need attention. A model that makes a decision with a legal or similarly significant effect gives the individual rights over it.

Most B2B scoring stays below that line, but one that automatically excludes applicants from a partner programme may not. Our guide to B2B demand generation data protection in England covers the balancing test and retention in more detail.

Are cold email and cold calling still allowed in B2B?

Yes, within limits, and those limits cause most complaints. Corporate subscribers can get unsolicited email without PECR consent, but UK GDPR still covers named contacts, so keep a legitimate interests assessment that survives scrutiny. The soft opt-in is for individual subscribers. The ICO's Direct Marketing Guidance sets out how the soft opt-in works and what the assessment needs to cover.

The soft opt-in, which applies to individual subscribers, requires the address to have been obtained during a sale or negotiations, the message to concern similar products, and an opt-out to have been offered at collection and in every message.

Cold calling follows a similar pattern. The Telephone Preference Service (TPS) covers individual subscribers. The Corporate Telephone Preference Service (CTPS) covers corporate subscribers. Sole traders and some partnerships are treated as individual subscribers, so they fall under the TPS. A list bought without checking subscriber type is a compliance risk, not a shortcut.

LinkedIn outreach is not email or telephone, so it sits outside PECR. It still falls under UK GDPR and the platform's own terms.

Scraping contact data or automating connection requests in ways the platform prohibits can breach both. The legislation and regulation overview for B2B compliance context is a helpful index for checking which regime covers a channel.

In practice, the safest cold outreach programmes share four features. They document a lawful basis, check a suppression list before every send, honour opt-outs within days and delete unresponsive records on a set retention rule. None of these are expensive. All of them are auditable.

How should a demand gen agency handle disclosure and transparency?

Disclosure has two audiences: the person receiving the marketing and the client paying for it. The first is governed by data protection and consumer law. The second is governed by contract, and increasingly by procurement questionnaires that ask how leads were sourced. Where an agency processes personal data on behalf of a client, UK GDPR Article 28 requires a written processor contract that sets out the agency's instructions and obligations.

For the recipient, disclosure means being clear about who is contacting them and why. A message that hides the sender's identity, uses a misleading subject line or disguises an advertorial as editorial is likely to breach both the CAP Code and unfair commercial practices rules. Paid partnerships and sponsored content need an identifiable advertising label.

For the client, disclosure answers one question: where did this contact come from? An agency that cannot trace a record to its source, date and permission statement leaves that client exposed if a complaint is made.

A written B2B demand generation disclosure policy in England makes that traceability routine, not reactive.

The DMA's responsible marketing pillar, including compliance and ethics, is a useful cross-check because it translates the legal duties into operational commitments that agencies can adopt and clients can audit.

What does an ethical demand generation programme look like?

Ethics in demand generation is mostly about restraint. The techniques that generate the most pipeline in the short term are often the ones that erode trust: fake urgency, invented scarcity, misleading lead magnets, or gated content that never arrives.

A workable ethical standard has four tests. Would the recipient recognise how their data was obtained? Would they accept the claim if they saw the evidence? Would a regulator reading the file conclude the firm acted fairly? Would the client be comfortable if the campaign appeared in a trade press write-up?

None of these require a formal ethics committee. They require someone senior enough to say no. In agencies, that usually means a named compliance owner who reviews list purchases and claim wording before launch.

Incentives matter too. If a demand gen team is paid purely on meetings booked, pressure builds to loosen qualification. A scorecard that weights meeting quality and opt-out rate alongside volume changes behaviour without adding headcount. Our piece on B2B demand generation trends and outlook looks at how buyers are responding to louder tactics.

What do the advertising rules require for B2B claims?

The CAP Code requires marketing communications to be legal, decent, honest and truthful. That applies to B2B messages, including LinkedIn ads, sponsored webinars and sales decks that are circulated as marketing material. Comparisons must be verifiable under CAP Code rule 3.33, and testimonials must be genuine and relevant.

Pricing claims are a common tripwire. Under CAP Code rule 3.17, a headline rate that excludes mandatory setup fees, or a discount available only on annual commitment, needs the qualification as prominent as the claim.

The ASA publishes detailed guidance. Our summary of B2B demand generation advertising rules in England covers the claim types that attract most complaints.

Substantiation is the practical burden. CAP Code rule 3.7 requires documentary evidence for objective claims.

For a 40 per cent processing-time claim, the file needs the evidence behind the figure, the date produced and the conditions it applied to. If a vendor bases a 40 per cent saving on an internal test of six users, it should describe the sample, not present it as a general result.

Sector rules can add layers. Financial promotions, health claims and recruitment advertising all have additional requirements, sometimes enforced by a different regulator. A general guide cannot cover every sector, and individual cases need a qualified adviser before a campaign goes live.

How do you audit a demand gen campaign before launch?

The audit does not need to be long. It needs to be repeatable. The rubric below scores six areas from 0 to 3 and flags anything below 2 for review.

Area	What to check	Score 0-3

The six areas and what to check are:

A campaign scoring 18 or above on these six areas is in reasonable shape. Anything between 12 and 17 should be fixed before launch. Below 12, the campaign should not run until the gaps are closed, regardless of how much pipeline it promises.

Run the rubric at kick-off, not the week before launch. Data sources take time to verify, and claim evidence often sits with product or finance rather than marketing. Building the checks into the campaign brief is cheaper than rebuilding the file after a complaint.

Common questions

These are the questions we hear most often from B2B demand generation teams.

Do B2B emails need consent in England?

Not always. PECR's email consent rule does not apply to corporate subscribers, though UK GDPR still applies to named contacts and a legitimate interests assessment should be documented. Individual subscribers need consent or the soft opt-in (address obtained during a sale or negotiations, similar products, opt-out offered at collection and in every message). Sole traders and some partnerships are treated as individual subscribers, so check the subscriber type before sending.

Who regulates B2B marketing in the UK?

The Information Commissioner's Office enforces data protection and electronic marketing rules. The Competition and Markets Authority enforces consumer protection law, including the unfair commercial practices regime updated by the Digital Markets, Competition and Consumers Act 2024. The Advertising Standards Authority applies the CAP Code to non-broadcast marketing, including business-to-business campaigns.

Can an agency be liable for a client's unlawful campaign?

Possibly. Under UK GDPR and PECR, an agency that designs, sends or profits from a campaign can be treated as a sender or instigator in its own right. Contracts that push all liability to the client do not remove regulatory exposure. Documenting instructions and refusing campaigns that fail a basic compliance check is the practical protection.

How long should we keep demand generation records?

There is no single retention period that fits every campaign. UK GDPR Article 5(1)(e) sets the storage limitation principle, and the ICO's guidance on retention explains how to apply it. Keep the lawful basis assessment and consent evidence for as long as you rely on it, plus the limitation period for claims. Suppression records should be kept indefinitely so you do not contact someone who has opted out. Set a review date and delete what you no longer need.

This guide is general information about the rules in England, not legal advice. Individual campaigns and contracts need a qualified adviser who can look at the specific facts.