CMA technical SEO audits: claims and evidence

What to take away

What the CMA remit covers for online competition and consumer protection

The Competition and Markets Authority is the UK's independent competition and consumer protection authority. Its remit covers how businesses compete online and how they treat consumers, including misleading commercial practices. Agencies writing audit reports sell services, so they sit inside that remit.

The CMA's work on online competition and consumer protection issues is set out on its own pages, which is the starting point for anyone mapping obligations to agency work.

The CMA does not police search engine algorithms. It polices the claims businesses make when they sell. If your audit report says a client is losing 40 per cent of organic revenue to a technical fault, that is a commercial claim.

Agencies across the UK sell into the same national framework. The CMA operates UK-wide, and the ICO handles data protection separately when your audit touches personal data from analytics or CRM exports.

Practical upshot: treat the audit report as advertising. Anything a prospective client could rely on when deciding to buy is a claim, and claims need a basis you can produce on request.

How ASA and CAP rules affect claims in audit reports

Comparative and outcome claims bite hardest. Phrases like faster, safer, more compliant or top rankings are outcome claims. The same applies to implied claims, such as a report that lists fixes in priority order and implies rankings will follow.

Quantified claims are the easiest to defend if you keep the working. A crawl export, a Search Console screenshot with a date, a log file sample: all of that is evidence. The problem is when the number in the report came from a tool's modelled estimate and the report presents it as measured fact.

Comparative claims are harder. Saying a competitor's site is slower is a factual claim about a third party. You need a consistent method, the same test conditions and a date. If your method changes between audits, the comparison is not defensible.

This is where a documented technical SEO disclosure policy earns its keep: it tells the client how numbers were produced before they challenge them.

Urgency claims are the riskiest. A report that says a site will be penalised next month is making a prediction about a third party's behaviour. Google does not publish penalty schedules. Frame these as risks with stated assumptions, not forecasts with dates.

ASA codes and CAP rules that constrain technical SEO marketing claims

The Advertising Standards Authority enforces the advertising codes in the UK, and the advertising codes framework is where that remit starts. The codes cover online marketing, including agency websites, landing pages, case studies and paid search copy.

The CAP non-broadcast code rule 3.7 requires claims to be substantiated before they are published. The rule means you must hold documentary evidence before the claim goes out, not gather it after a complaint.

For example, an audit that says 'Our crawl on 1 March 2025 found duplicate title tags and the export is in the appendix' is compliant. An audit that says 'We will get you to page one in 90 days' is not, unless the agency holds data that proves the outcome.

The code also requires that comparisons are fair, that testimonials are genuine and that prices and qualifications are stated accurately.

For technical SEO specifically, the code catches a few recurring habits. Claiming a certification you do not hold. Claiming a partnership with Google when you are simply a Search Console user. Showing a case study graph without saying what the vertical axis measures. Publishing a before-and-after traffic chart where the after period includes a paid campaign.

ASA rulings are published and searchable. A ruling against your agency appears when a prospect searches your name. That is the practical cost, well before any regulatory escalation.

The codes apply across the UK, so agencies in different regions face the same standard. Regional market differences in competition do not change the code. If you want the wider statutory backdrop for these claims, our guide to technical SEO advertising rules covers how the rules apply to agency marketing in England.

Evidence standards: what an audit report must be able to prove

Evidence standards are where most audit reports fail quietly. The report reads well, the recommendations are sensible, but nothing in the file shows how a figure was produced. If a complaint arrives six months later, the agency cannot reconstruct the basis.

A defensible audit file has four components. The raw data, the tool and version, the date and time of collection, and the method or query used. If a number came from a third-party estimate rather than a measurement, say so in the report. Modelling is allowed; presenting a model as a measurement is not.

Benchmarks deserve particular care. Quoting an industry average click-through rate or a typical Core Web Vitals pass rate means quoting someone else's research. Check the sample size, the geography and the date before you put it in a client report. Our piece on technical SEO benchmark research explains how to interrogate a benchmark before you repeat it.

Numbered steps keep the file consistent:

If your agency reviews its own work, apply the same test you would apply to a third party. Our guide to technical SEO reviews and comparison sets out how to check a method before trusting its output.

Digital Markets, Competition and Consumers Act 2024 and unfair trading rules

The Digital Markets, Competition and Consumers Act 2024 is the main recent change to the UK consumer protection framework. It gives the CMA stronger powers to act on unfair commercial practices, including the ability to decide cases directly rather than going to court for every breach.

For agencies, that means the enforcement route is shorter than it used to be.

The Act sits alongside the Consumer Protection from Unfair Trading Regulations 2008, which remain the core prohibition on misleading actions and omissions. The 2008 Regulations introduced the concept of the average consumer and the misleading omission: leaving out information a consumer needs to make an informed decision.

An audit report that shows a traffic drop but omits that a migration caused it has an omission problem.

For digital marketing, the practical effect is that drip pricing, fake urgency and misleading reviews are all squarely in scope. Audit reports rarely involve pricing, but they often involve urgency and implied outcomes. A countdown to a penalty that never arrives is the kind of claim the framework is designed to catch.

There is also a competition dimension. If an audit report makes a claim about a competitor's technical performance that is inaccurate, that can be a misleading action against the competitor's interests as well as the client's. Keep competitor references factual, dated and method-linked.

The Act's consumer provisions apply across the UK, though enforcement priorities may vary by CMA caseload.

Sanctions, rulings and non-compliant advertiser risk

ASA sanctions escalate in stages. The first is usually an upheld ruling published on the ASA website, with the advertiser named. The ASA then requires the advertiser to change or withdraw the ad. Persistent non-compliance leads to further sanctions.

Those further sanctions include referral to Trading Standards, which can act under consumer protection law, and in some cases paid search restrictions. The ASA also publishes non-compliant online advertisers, which means your agency name can appear on a public list.

The CMA's remit and published casework sit on a separate enforcement track. The CMA can investigate unfair commercial practices, accept undertakings or impose penalties under the newer regime. A CMA case against an agency for misleading claims is rare but not impossible, particularly where claims are systematic rather than a one-off error.

Its board and panel arrangements determine who signs off those decisions.

Reputational risk arrives first. A prospect who searches your agency name and finds a ruling has a reason to hesitate. The cost of a rewritten case study is trivial next to that.

For agencies with staff across the UK, the risk is concentrated in whoever writes the marketing copy and the case studies, not in the technical team. Give those writers the same evidence file the auditors use. Our guide to technical SEO rules and ethics covers how to build that into a standard process.

A claims and evidence checklist for technical SEO audit reports

Run this checklist before any audit report leaves the building. It is written for the person signing off, not the person writing.

Two habits keep the checklist honest. First, have someone who did not write the report check it against the file. Second, keep the file even when the pitch is lost, because a claim made in a pitch is still a claim.

If your agency publishes case studies or comparison pages, extend the same checklist to those. The rules do not distinguish between a report sent to one prospect and a page published to everyone.

Common questions