ASA vs CAP Code vs platform policies: when they conflict

UK aesthetic clinic marketing is subject to three separate regulatory frameworks. They were not designed in coordination with each other, they are enforced by different bodies with different powers, and they do not always require the same thing. Understanding how they relate — and what to do when they conflict — is fundamental to building a marketing operation that is both legally sound and commercially effective.

The three frameworks

The first framework is the Advertising Standards Authority (ASA). The ASA is the adjudication body — the organisation that receives complaints, investigates them, and publishes rulings. The ASA does not write the rules; it enforces them. Its rulings are published publicly, which means a finding against a clinic is a matter of record regardless of whether any further sanction follows.

The second framework is the CAP Code — formally, the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing. This is the rulebook. The CAP Code is what the ASA enforces. Understanding the ASA without understanding the CAP Code is understanding a court without understanding the law. For aesthetic clinics, the most relevant sections are Rule 12 (health and beauty claims), Rule 3 (misleading advertising), and Rule 4 (harm and offence). The CAP Code is produced by the Committee of Advertising Practice (CAP), which is a separate body from the ASA.

The third framework is platform policies — principally Meta (Facebook and Instagram), Google, and to a lesser extent TikTok and YouTube. These are contractual requirements: by using these platforms to advertise, a clinic agrees to comply with their policies. Violations can result in ad rejection, account restriction, or account ban. Platform policies are enforced algorithmically and, at the first level, without human review.

How they relate to each other

The CAP Code and ASA operate within the UK's self-regulatory advertising framework. Compliance with the CAP Code is not a legal obligation in the same direct sense as compliance with, say, the Consumer Rights Act — but ASA rulings are increasingly backed by formal referral mechanisms to statutory bodies, and non-compliance with ASA rulings can lead to sanctions including referral to Trading Standards or Ofcom. In practice, the CAP Code should be treated as a binding standard.

Platform policies are contractual obligations. They exist entirely separately from the CAP Code and ASA framework. A clinic can be in full compliance with the CAP Code and still have its ads rejected by Meta. A clinic can run ads that Meta approves and still be in violation of the CAP Code. The two systems operate in parallel, not in sequence.

Where they broadly agree

The three frameworks converge on a number of core principles. All three prohibit advertising that makes false or unsubstantiated claims about the efficacy of treatments. All three include provisions on vulnerable audiences and the targeting of minors for cosmetic procedure advertising. All three have provisions on body image and the presentation of idealised physical standards in a way that implies the advertised treatment will produce that standard.

These areas of agreement provide the baseline for any compliant aesthetic marketing programme. A clinic that cannot satisfy all three frameworks on these core points has a fundamental compliance problem, not a technical navigation challenge.

Where they conflict: specific examples

The conflicts arise in the detail. The most significant and common conflicts for aesthetic clinics are as follows.

Before-and-after imagery in paid advertising. Meta categorically prohibits before-and-after imagery in paid advertising in the health and beauty category. The CAP Code does not categorically prohibit it — it requires that such imagery not create a misleading impression. A compliant before-and-after image under the CAP Code can nonetheless be rejected by Meta. The resolution is channel-specific: before-and-after content in organic social may be permissible under both frameworks; in paid ads on Meta, it is not.

Prescription treatment advertising. The CAP Code and MHRA regulations prohibit advertising prescription-only medicines to consumers. Meta's policies include the same prohibition. But the practical boundary — what constitutes advertising a prescription-only medicine versus describing an aesthetic outcome that involves one — is drawn somewhat differently by each framework. Meta's automated systems may flag brand names that the ASA would assess on the surrounding context.

TikTok's content restrictions for cosmetic procedures. TikTok's community guidelines include restrictions on cosmetic procedure content that are more conservative than the CAP Code in some respects. Content that would pass an ASA assessment may be restricted or removed under TikTok's own policies. In some areas, TikTok restricts content that promotes cosmetic surgery entirely, regardless of how it is framed.

Google's destination URL review. Google's ad policies extend to the landing page a click leads to, not just the ad itself. The CAP Code's remit covers the content of the advertisement as a whole, including elements that consumers see as part of the advertising experience — which can include landing pages. But the specific triggers for Google's automated systems are different from the ASA's assessment criteria. A page that satisfies the CAP Code's requirements on claim substantiation may trigger Google's automated systems for different reasons.

The "most restrictive rule wins" principle

The practical approach to navigating these conflicts is straightforward: identify the most restrictive applicable standard for each piece of content on each channel, and write to that standard. If Meta's policy on before-and-after imagery is more restrictive than the CAP Code for paid advertising, the Meta standard applies to paid advertising. If TikTok's policy on cosmetic procedure promotion is more restrictive than the CAP Code for organic content, the TikTok standard applies to TikTok.

This principle means that a single piece of content cannot always be used across all channels — the most restrictive standard applicable to the most restrictive channel may produce content that is less effective on channels with more permissive standards. That is a content planning problem, not a compliance problem. Managing it requires channel-specific content strategies, not a single piece of content deployed everywhere.

Building a system that covers all three simultaneously

A checklist is not adequate for navigating three overlapping regulatory frameworks. A checklist can tell you whether you have addressed the items on the list — it cannot tell you whether you have correctly identified which items belong on the list for a specific piece of content on a specific channel. That requires a system.

The system has three components. The first is a channel map: a written record of which regulatory frameworks apply to each channel the clinic uses, and what the specific requirements and restrictions are. This is not a one-time document — it needs to be updated when frameworks change, which they do. The second component is a content review process that applies the channel map to each piece of content before it is published. The third is a documentation standard: a record of what was reviewed, which framework was applied, and why the decision was made that the content complied.

Why documentation matters as much as compliance

The documentation standard matters for two distinct reasons. The first is the practical one: if a complaint is made to the ASA, or if a CMA investigation is initiated under the DMCCA, the existence of a documented governance process is evidence that the clinic takes compliance seriously and that its decisions were made thoughtfully. Its absence is the opposite.

The second reason is systemic: documentation creates institutional memory. When staff change, when agencies change, when platform policies update, the documented governance record is the anchor that prevents the compliance standard from degrading. A compliance framework that exists only in one person's head is not a compliance framework — it is a dependency.

The goal is a system that operates consistently regardless of who is producing the content, which channel it is destined for, and which of the three frameworks is primarily applicable. That consistency is what compliance actually requires — and it is what a checklist alone cannot provide.