Rules and ethics
Part of Lead network compliance from the correct geographic layer to bought lists
A lead network disclosure policy built around each moment of hand-off
Build a lead generation network disclosure policy around the real journey, named recipients, direct marketing, timing, objections and change control.
A lead generation networks disclosure policy should tell a person what will happen at the point they need to decide. It is not a generic privacy-page template. Build the wording from the actual form, recipients, contact route and later uses, then test the live presentation.
This workflow is for an England-facing service under UK data and marketing rules. It is operational guidance, not legal advice or a promise that the resulting notice is sufficient.
What to take away
- Build disclosure wording from the actual form, recipients, contact route and later uses rather than a generic privacy template.
- A missing recipient or purpose is a design defect that polished wording cannot hide.
- Consent cannot be inferred because organisations have similar aims, and it must be presented separately.
- Dense legal text cannot correct a misleading headline or button in the consumer journey.
- Version every notice and consent control, and recheck the journey whenever a buyer, category, field, purpose, channel or complaint route changes.
Inventory each moment of disclosure
Start with the advert, landing page, form field, submit button, confirmation, buyer introduction and later marketing. For each screen, record the operator, trader, controller, intended recipient, purpose, required data, optional data, expected contact and complaint route.
Disclosure moments in the journey
- Advert
- Landing page
- Form field
- Submit button
- Confirmation
- Buyer introduction
- Later marketing
Do not begin with polished prose. A missing recipient or purpose is a design defect that wording cannot hide.
Put information at the right time
When personal information is collected directly, the person should receive the required privacy information at collection. Where information comes from another source, different timing applies. The ICO's privacy-information timing guidance explains the Article 13 and 14 positions, including the one-month outer limit and earlier triggers for first communication or disclosure.
The full record should cover identity, contact details, purpose, lawful basis, recipients, retention, rights and the information required by the real circumstances. The ICO's right-to-be-informed overview calls for concise, transparent, intelligible, accessible and plain language. A website link alone is not enough if people are not actively directed to it.
Describe the hand-off precisely
Say whether the network sends a request to one named provider, several named providers or a defined category. Explain what each recipient may do next. Do not use "trusted partners" as a substitute for the identification required by the approved legal analysis.
The ICO's planning guidance for direct-marketing sharing says people must be told when information will be shared for others' direct marketing. It also says consent cannot be inferred because organisations have similar aims.
If consent is used, present the request separately from privacy information and specify the purpose, organisation and channel required. If another lawful basis is proposed, the privacy notice still does not create that basis; the reviewer must document it independently.
Separate the requested response from later promotion
An enquirer may ask for a particular quotation or call. State which provider will answer and what the answer concerns. Any later cross-sell, newsletter or unrelated provider contact needs a separate classification and, where applicable, a PECR decision.
The ICO's lead-collection guidance addresses information gathered for direct marketing and due diligence on supplied data. Do not interpret form completion as unlimited future use.
Join disclosure to consumer presentation
Keep the main proposition, commercial intent, payment or commitment, limits and complaint route consistent with the privacy layer. The CMA's unfair-practices guidance considers the overall UK consumer journey, including misleading omissions. Dense legal text cannot correct a misleading headline or button.
Make the policy operable
Version every notice and consent control. Store the text shown, date, journey, recipient set and approver with the lead record. Give operations a stop rule for an unknown buyer, expired disclosure, changed purpose, failed objection route or mismatch between screen and data transfer.
Test the pages with users for comprehension and accessibility without treating research participation as marketing permission. Record failures and revisions rather than declaring the wording clear.
Named privacy and PECR counsel, an England and Wales consumer solicitor, and advertising and commercial reviewers must approve the implemented journey. Recheck it whenever a buyer, category, field, purpose, channel or complaint route changes, and again on publication day.
Before you act
- Inventory each moment of disclosure from advert to later marketing.
- Give required privacy information at the point of collection.
- Name each recipient or defined category precisely, not trusted partners.
- Separate the requested response from later promotion.
- Keep the consumer presentation consistent with the privacy layer.
- Version every notice and consent control with the lead record.
Common questions
When should a person receive privacy information if their data is collected directly?
The article says that when personal information is collected directly, the person should receive the required privacy information at collection. Where information comes from another source, different timing applies, and the ICO guidance covers the Article 13 and 14 positions.
Can a website link to a privacy notice be enough on its own?
No. The article states that a website link alone is not enough if people are not actively directed to it. The ICO right-to-be-informed overview calls for concise, transparent, intelligible, accessible and plain language in the information provided.
What should happen if consent is the lawful basis for sharing?
The article says the consent request must be presented separately from privacy information, specifying the purpose, organisation and channel required. Consent cannot be inferred because organisations have similar aims, and any other lawful basis must be documented independently by the reviewer.
