The pre-launch compliance sweep every campaign must pass

Campaigns rarely fail compliance because nobody knew the rule. They fail because the rule sat with someone outside the approval chain: the CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → manager who inherited a list, the agency producer who shipped version five after legal signed version three, the creator who published from their own handle on a Sunday afternoon. This sweep exists to close those gaps, and its first requirement is a name against every line.

Run it as a stage-gate: the campaign does not move from "creative approved" to "live" until every item carries a signature from one named person, not a team inbox. Worked through here on a composite European chain we'll call Aurelia Hotels, launching a three-country summer promotion (Germany, Spain, UK) across paid social on TikTok, email to the guest base, and one creator partnership.

Two dates come before the gates. The claim freeze: no new price, inclusion or product claim after this point. The asset freeze: no new cut, caption or crop. Ten working days between freeze and launch is workable for a three-market campaign. Below five, sign-off becomes a rubber stamp and the gates below turn into a formality someone signs at 22:00.

Gate 1: GDPRGDPREU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.View full definition → consent on guest data

The rule. GDPR, enforced by national authorities across the EU/EEA and by the UK's Information Commissioner's Office (ICO) under UK GDPR, governs how hotels collect, store and use guest personal data for marketing. Marketing email also engages the ePrivacy rules (PECR in the UK), a separate route to enforcement: the ICO can fine up to £500,000 under PECR without building a GDPR case at all, and it does so mostly for unsolicited email and SMS.

What trips up hotel campaigns specifically. Guest data arrives from the booking engine, the property management system, loyalty sign-ups, Wi-Fi captive portals, spa reservations. Each source captured consent under different wording, on a different date, or not at all.

Aurelia's retargetingretargetingShowing ads to users who have previously visited your site or interacted with your brand, to bring them back and drive conversion.View full definition → list mixed loyalty members who opted in with guests who booked once through an OTA and never gave Aurelia anything. Booking.com (which sells the accommodation you are marketing) passes you a reservation, not a marketing permission. That second group cannot receive the promotional email, and appending them because "they stayed with us" produces complaints from people who have no memory of the brand.

Owner. CRM lead signs the list build. The DPO or privacy counsel signs the lawful basis per segment.

Gate checklist:

• Consent basis documented per source, evidenced by the wording shown at capture, not the wording on the form today
• OTA-sourced guest records excluded from direct marketing unless consent was captured separately by you
• Retention limits applied (many groups set 24 to 36 months for inactive guest records, an internal policy choice rather than a fixed legal number)
• Unsubscribe and objection routes live and tested on the actual send template, not the master template
• Consent records timestamped and retrievable in hours, not weeks

One failure mode worth naming: a segment exported to an agency's own sending tool months ago sits outside your suppression file. You stop; it keeps sending. Ask for the export log, not a reassurance.

A useful primer on lawful bases: ICO's guide to lawful basis for processing.

Gate 2: Accessibility of booking pages

The rule. In the EU, the European Accessibility Act applies from June 2025 to digital services including travel and hospitality booking. In the US, courts have read the Americans with Disabilities Act onto websites, and hotels carry an extra obligation: reservation systems must describe accessible features in enough detail for a disabled guest to judge whether the room works for them. Several thousand website accessibility suits are filed in US federal court each year, and hotel booking flows are a recurring target. The shared technical benchmark is WCAG, currently 2.2.

What trips up hotel campaigns specifically. Promotional landing pages get built fast, outside the core booking engine, and skip accessibility QA because "the real booking page is already compliant."

Aurelia's promo page had a flashing countdown timer with no pause control and a room-selector carousel with no keyboard navigation. The cookie banner also trapped keyboard focus, which means a screen-reader user could not reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → the booking button at all. Every one of those is a WCAG 2.2 failure, and the last one makes the promotion unusable rather than merely awkward.

Owner. The campaign producer who commissioned the page signs. A QA analyst signs the test log, dated, against the live URL.

Gate checklist:

• Landing pageLanding pageA standalone web page built for a single campaign goal, designed to maximise conversions by removing distractions and focusing visitors on one action.View full definition → tested for keyboard-only navigation, including the consent banner
• Colour contrast meets WCAG AA minimum (4.5:1 for normal text)
• Descriptive alt text on every image, not "hotel photo 3"
• Nothing flashes more than three times per second
• Screen reader walkthrough on the actual promo page
• Booking form fields properly labelled for assistive technology

Free testing resource: WebAIM's WAVE tool lets you scan any live URL for accessibility violations in seconds.

Gate 3: Creator and platform assets

The rule. Where an influencer is compensated, including with a free stay, the disclosure must be clear and upfront. The ASA and the Competition and Markets Authority hold the brand responsible alongside the creator, and the ASA's sanction is publication: a ruling with your brand name in it stays indexed and searchable for years. Repeat or serious consumer-law breaches route to the CMA, which under the Digital Markets, Competition and Consumers Act 2024 can act directly and fine up to 10% of global turnover.

What trips up hotel campaigns specifically. Hotels host creators for free and assume "gifted, not paid" is exempt. It is not. A comped stay, an upgrade, a discount or a commission-bearing booking link all create a commercial relationship that must be disclosed.

The sharper edge case is boosting. The moment Aurelia puts paid spend behind a creator's organic post (TikTok's branded content toggle and paid amplification, on inventory TikTok sells you), the brand becomes the advertiser and the whole asset falls inside the CAP Code. Everything the imagery and claims lesson covers then applies to a video the brand did not script: the sea view in shot has to be a view guests can book, and "quietest beach in Spain" needs evidence in your file, not the creator's.

Owner. Brand or social lead signs the contract clause. The person who presses "boost" signs that the disclosure survived the boost, because the label is often lost in the re-upload.

Gate checklist:

• Contract requires the label before the "more" fold, not stacked into hashtags at the end
• Disclosure applies to cash, free stay, upgrade, or commission-based link
• Brand holds a right of review before publication, plus an agreed edit or take-down window afterwards
• Platform-native disclosure tools used in addition to text disclosure
• Substantiation for any factual claim in the creator's script held by the brand before boosting
• Contract templates re-checked annually against platform and regulator guidance

The ASA's influencer guidance is a solid reference: ASA/CAP guidance on influencer ad disclosure.

🎬 [VIDEO: "FTC Endorsement Guides Explained" - youtube.com/results?search_query=FTC+endorsement+guides+influencer+disclosure - search for current FTC or consumer-protection explainer videos on influencer marketing disclosure rules, useful for grounding the US comparison]

Gate 4: Terms-and-conditions sign-off

The rule. The total-price and reference-price obligations the pricing lesson sets out apply equally to the ad, the email subject line and the creator's caption. This gate checks something narrower: that the number in each asset is the one legal approved, and the one the booking engine can actually sell on the morning of launch. Likewise, the refund and cancellation duties the package travel lesson maps are assumed here; the gate asks only whether the same window appears everywhere.

What trips up hotel campaigns specifically. Rates move. An approved "from €89" can go stale within hours of launch because revenue management repriced the shoulder dates, and nobody owns the check. In Germany there is a second clock: competitors and trade associations can send a cease-and-desist with cost recovery under unfair competition law and seek an injunction in weeks, so a German-market claim faces commercial challenge long before any regulator opens a file.

Owner. Revenue management signs that the headline rate is bookable. Legal signs the exact ad copy, not only the T&Cs page. One named person holds the kill switch.

Gate checklist:

• Rate-availability check run on launch morning against the live booking engine, with a documented pause trigger if the headline rate disappears
• Blackout dates, room-category exclusions and minimum stays stated in the asset, not in a linked PDF
• Cancellation window identical across booking engine, email, landing page and OTA listing
• Legal sign-off recorded against a version number for every asset that carries a price
• Post-launch re-check on day three, when creative rotation usually introduces the unapproved cut

A simple worked example: the cross-channel consistency check

Take one claim, "from €89 a night", and walk it across every surface it lands on: the TikTok ad, the email subject line, the landing page hero, the creator's caption and their pinned comment, the booking engine confirmation, the Booking.com listing, and the front-desk script. Seven surfaces, seven owners, one version number.

Aurelia's failure was the timing, not the number. Legal caught the stale rate at 09:40 and the landing page was corrected by 11:00. The email had already sent to 240,000 addresses, and the creator's caption stayed live for six days because the contract gave no edit right and the creator was on a flight. Two of seven surfaces stayed wrong after the "fix" was declared complete.

The same arithmetic applies to cancellation terms quoted three different ways in three channels. You will be arguing about the version the customer saw, not the version on your terms page. Write the sweep so that every surface has a named owner and a confirmed-corrected timestamp, and treat the campaign as non-compliant until the last one reports in.

Key Takeaways

• Gates are hard stops with signatures from named people, placed after a claim freeze and an asset freeze, ideally ten working days before launch.
• Consent has to be tracked per source, and an OTA reservation is not a marketing permission; the ICO can reach unsolicited email through PECR alone, up to £500,000.
• Accessibility defects hide in standalone promo pages and consent banners rather than the main booking engine; test the live URL with WAVE and keep the dated log.
• Gifted stays require disclosure, and boosting a creator's post makes the brand the advertiser, which means you need substantiation for claims you did not write.
• Fixing one surface is not fixing the campaign: count your surfaces, assign each an owner, and hold the launch open until every one reports corrected.