Technical SEO rules and ethics explained for UK audits

What to take away

Technical SEO rules and ethics is the practice of making a site crawlable, fast and accurate while staying inside the law that applies to the data, claims and content it publishes.

Law, platform policy and professional standards

Technical SEO is the work of helping search engines find, render and trust a site, and a technical SEO strategy framework sets how to prioritise it. Rules and ethics are the limits on how you do it. The two overlap more than most teams expect.

A crawl budget decision is technical. A decision to block a regulator's page from indexing is ethical and possibly legal. An audit checks both.

For a working definition, technical SEO rules and ethics means the set of legal duties, platform policies and professional standards that constrain how a site is crawled, indexed, measured and described to users.

Three kinds of constraint sit under that definition. Law is enforceable and slow to change. Platform policies are set by the search engine, apply to its services and can change quickly; for Google Search, the named references include Google Search Essentials and Google's spam policies. Professional standards are neither, and they still shape what a careful auditor will sign off. Examples are the Chartered Institute of Marketing's Code of Professional Standards and the code of ethics published by the search trade body SEMPO. Both ask for honest claims, no deception and respect for client confidentiality. Cite the code you follow in the report.

The duty also sits with several parties. The site owner answers for what the site publishes. The agency answers for the advice it gives. A tool vendor answers for claims it makes about its crawler.

The article on public context for technical SEO audit planning shows where the underlying regulatory sources live, which is a practical starting point before any audit begins.

The four duties that shape a UK technical audit

The four areas are data protection and tracking; consumer protection and content claims; public-sector accessibility; and advertising, disclosure and substantiation.

Data protection and tracking

The UK GDPR and Data Protection Act 2018 (DPA 2018) govern the processing of personal data. That includes analytics, heatmaps, chat widgets and server logs. The ICO's guidance on accountability and governance explains that organisations must be able to demonstrate how they comply, not simply intend to. Cookies and similar technologies also engage the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR); the ICO's Guidance on the use of storage and access technologies explains the consent requirements and exceptions.

In an audit, check what fires before consent, what information is written to the browser, and whether retention is documented. Under PECR, check whether non-essential cookies or similar technologies are set before consent; a tag that loads on first paint can be a technical finding with a legal consequence.

Server logs deserve their own line. IP addresses and user agent strings are personal data when they can identify a person. If your audit recommends keeping logs for a year, ask who approved that period and where it is written down.

Consent also has a rendering dimension. A banner injected by JavaScript after tags have fired can look compliant in a screenshot and fail in a HAR file.

Third-party tags add another layer. A pixel owned by another company still processes personal data on your site, so the audit trail should name the vendor, the purpose and the transfer route. If a tag sends data outside the UK, that transfer needs a documented basis.

Our article on data protection in England walks through the consent and logging checks auditors run, and it is the natural next read if tracking is your main risk.

Fair trading and content claims

Across the UK, the Digital Markets, Competition and Consumers Act 2024 (DMCC Act) replaced the Consumer Protection from Unfair Trading Regulations 2008 from 6 April 2025. These rules cover misleading actions and omissions, which can include claims in meta descriptions, schema and comparison tables.

For an auditor, the check is simple: does the page's structured data match what a buyer sees? Rich results that promise a price, rating or stock level the page does not honour are both a search risk and a trading risk.

Two claim types come up most often. The first is scarcity, such as a countdown timer that resets on refresh. The second is price, where a struck-through figure has no history behind it.

Both are content problems that surface in markup. The visible page says one thing and the schema says another.

Reviews and testimonials sit in the same category. A rating widget fed by an unmoderated feed can display content the business would never publish itself. Once shown on the page, the claim belongs to the site.

Accessibility for public sector sites

Public sector bodies in the UK have specific accessibility duties under the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018. GOV.UK's guidance on accessibility requirements for public sector websites and apps explains the obligations, including publishing an accessibility statement. The Government Digital Service (GDS) runs the monitoring programme that tests public sector sites against those duties.

The W3C's WCAG 2 overview and WCAG 2.2 give technical criteria such as text alternatives, keyboard access and contrast, all of which affect how content is parsed and used. For a statutory public-sector audit, the Regulations were written around the European standard EN 301 549, whose version 2.1.2 incorporates WCAG 2.1 level AA. That makes 2.1 AA the baseline written into the Regulations, while GOV.UK guidance for public bodies now names WCAG 2.2 AA. WCAG 2.2 adds criteria such as Focus Not Obscured (Minimum) and Target Size (Minimum), so test against it and confirm which version the client is held to.

In the report, name the version tested and cite each failed criterion by number, for example 1.1.1 Non-text Content, 1.4.3 Contrast (Minimum), 2.1.1 Keyboard or 3.3.1 Error Identification.

An accessibility statement is a page a crawler can read, which makes it testable. Record the URL and the date it was last reviewed, then check that the contact route it names still works.

Advertising and disclosure

Advertising rules shape what a site may publish and how it labels paid placement. In the UK the Advertising Standards Authority (ASA) enforces the CAP Code for non-broadcast marketing and the BCAP Code for broadcast advertising. A brand's own website is in scope, not just paid media.

Substantiation is the recurring theme: a claim needs evidence behind it before publication, not after a complaint. The ASA publishes its rulings, so an unsubstantiated claim on a product page can become a public finding.

Disclosure is the ethical layer. If an audit, review or ranking is influenced by a commercial relationship, the reader should be able to see that. Our disclosure policy guidance for England covers how to state affiliate and sponsorship arrangements on site.

Where technical findings become legal risk

Most audit tickets are harmless. A missing canonical is not a court matter. The risk appears when a technical choice changes what a person is told or what data is taken from them.

Hidden text is the classic example. Text styled to be invisible to users but visible to crawlers is a search spam issue: Google's spam policies address hidden text and cloaking. If that text contains a claim, it can also be a misleading omission under consumer law.

Review markup is another. Publishing aggregate ratings without a genuine, verifiable review process can mislead users and breach Google's structured data policies; Google's Search Essentials and spam policies also set the rules for appearing in Google Search. The markup format is not the problem. The claim is.

Tracking is the third. A consent banner that appears after tags have already fired is a common audit finding. The fix is technical, but the duty is legal.

Enforcement is not theoretical. In October 2020 the ICO fined British Airways £20 million and Marriott International £18.4 million. The British Airways case followed a script injected into its website that diverted customers to a fraudulent page and exposed payment details.

Accessibility is the fourth. A form that cannot be completed by keyboard is a barrier for disabled users and a crawl problem if the submit action is script-only. One change can address both.

Indexing controls sit in the same bracket. Robots.txt rules, noindex tags and canonicals decide which pages a search engine keeps. They can also hide information that a regulator or a customer expects to find.

Doorway pages and cloaked content raise the stakes again. Serving a different page to a crawler than to a visitor is addressed by Google's spam policies and can violate its Search Essentials. Where the difference involves price, availability or safety information, it can mislead a buyer as well.

Structured data about people carries its own duty of accuracy. If markup names someone as the author of content they did not write, that is a statement about a real person, not a formatting preference.

Cross-border campaigns add jurisdiction questions. A site selling into the United States, the EU and the UK carries three sets of expectations about claims and data. Hreflang decides which version a user sees, but it does not decide which rule applies to them.

Our guide to advertising rules in England looks at how these overlaps play out for content-led sites.

A comparison table for audit decisions

The table below maps common technical findings to the duty they touch and the evidence an auditor should record. It is a planning aid, not a legal test.

Two practical notes. Consumer law enforcement is not identical across the UK, so confirm the position for the nation you operate in. Platform policies also change more often than statutes, so date every check you run.

How to run an audit that stands up to scrutiny

Start with scope. Write down which domains, templates and markets are in scope, and which are out. An audit that quietly excludes a locale is not an audit.

Every report uses the same six headings, so nothing is lost between audits:

Then collect evidence in a repeatable order: crawl the site, render key templates, capture headers, and export the tag sequence. Our guide to log file analysis covers the server-side evidence. A crawler such as Screaming Frog SEO Spider can help capture crawl evidence, while Google Search Console provides Google Search indexing information; neither tool proves legal compliance. Keep raw files, not just summaries.

Raw files matter because a screenshot proves little on its own. A dated HAR file, a rendered DOM and a header list together form a record that survives a challenge six months later.

Sampling has a place, but say where you sampled. If you checked 20 product templates out of 4,000, write that down. A finding presented as site-wide when it came from a sample is a reporting error.

Next, separate findings by type: technical fault, policy breach, legal risk, and judgement call. Only the first two are usually safe for a junior to fix without review.

Then set severity by consequence rather than effort. An unreachable checkout outranks a long meta description, even though the meta fix is quicker.

Sign-off matters too. Decide in advance who reviews legal-risk findings before they leave the building. In most teams that is not the SEO lead, and the report template should make the handover explicit.

Document decisions. The ICO accountability principle rewards a written record of what you did and why. An audit log with dates does that job.

Finally, set a recheck date. Rules, platform policies and site code all move. A finding that was clean in January may not be clean in July.

For teams comparing tools on this basis, our methods for reviewing and comparing SEO audit tools in 2027 explains how to test whether a tool actually surfaces these risks.

England, Scotland, Wales and Northern Ireland

Data protection applies across the UK, so the ICO guidance cited above is the reference for all four nations. That is why the data protection section of an audit does not change at the border.

Public-sector accessibility duties apply across the UK. The Government Digital Service is the monitoring body for the Regulations and runs the monitoring programme for public-sector websites and apps. The Equality and Human Rights Commission (EHRC) is the enforcement body in Great Britain; in Northern Ireland that role sits with the Equality Commission for Northern Ireland (ECNI).

Consumer protection is the area where auditors most often over-generalise. The DMCC Act 2024 regime applies in all four nations and replaced the 2008 Regulations from 6 April 2025. Enforcement is shared: in Northern Ireland the Department for the Economy enforces the prohibition on unfair commercial practices, while the CMA can also act directly. A claim that is compliant in England should still be checked against the audience you are targeting.

Scotland has its own legal system and court structure, so enforcement routes and procedure can differ; record the jurisdiction rather than assuming the practical route is identical.

Accessibility standards are not law in themselves, but they are the benchmark regulators and claimants use. Record the standard version tested and the failed criteria by number, as set out in the accessibility section above. WCAG 2.2 is a useful technical benchmark, but do not describe it alone as the statutory requirement.

Where a rule is devolved, say so in the report. A client with one domain and four audiences needs the difference written down rather than implied.

Ethics beyond the statute book

Compliance is the floor, not the ceiling. Several ethical questions in technical SEO have no statutory answer.

Should you noindex a page that a regulator publishes because it competes with your client's? The law may not stop you. Professional judgement should.

Should you keep a slow, inaccessible page because it ranks? If the page serves the public, the answer is usually no, whatever the traffic figures say.

Should you use an AI-generated summary that misstates a source? Only if you can verify it. The disclosure duty applies to your own content as much as to a client's.

Measurement belongs on the same list. If reporting counts a click as a conversion when nothing was bought, the number becomes a claim about performance. Inflated reporting misleads a client in the way a false product claim misleads a buyer.

These calls are why an audit report should separate facts from recommendations. The facts are defensible. The recommendations are opinions, and they should read like opinions.

Common questions

These answers give the UK-wide baseline; check the relevant nation's rules and get legal advice for a specific case.

Does technical SEO have legal rules in the UK?

Not a single body of law called technical SEO. Instead, several duties apply to what a site does: data protection, consumer protection, accessibility for public sector bodies, and advertising standards enforced by the ASA. An audit checks the technical surface where those duties bite.

Do accessibility rules apply to private companies in the UK?

Public sector bodies have explicit web accessibility duties under the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018. Private companies in Great Britain have duties under the Equality Act 2010; in Northern Ireland, the relevant legislation includes the Disability Discrimination Act 1995. WCAG is a useful benchmark, but do not assume that it is a universal statutory standard for every private website.

Can an SEO audit tool prove compliance?

No. A tool can detect a tracking script, a missing accessibility statement or a schema mismatch. It cannot decide whether a claim is misleading or whether consent is valid. Use tools for evidence gathering and a qualified adviser for judgement.

Is this guide legal advice?

No. It is general guidance for audit planning. Individual cases depend on facts, contracts and jurisdiction, so take advice from a qualified legal adviser before acting on a specific risk.