Fitness influencers: UK whitelisting guide for brands

What to take away

Whitelisting means the brand buys paid media that runs under a creator's handle, so the ad wears the creator's name while the brand pays for reach.
UK data protection applies to any personal data in the chain, which makes a written lawful basis and a recorded permission the starting point rather than an afterthought.
Two rulebooks apply at onceMeta's advertising policies and the ASA's recognition rules. Passing one does not mean passing the other.
The permission needs a scope, a territory, an end date and a way to switch it off, all in the contract rather than in a direct message.

What whitelisting actually does

Whitelisting is the practice of running paid ads from a creator's account or handle, with the brand funding the media spend. The ad looks like the creator's own content, but the brand controls targeting, budget and placement.

Whitelisted ad vs dark post

Whitelisted ad

Runs from: Creator's handle
Appears on grid: Sometimes
Brand controls: Targeting, budget, placement

Dark post

Runs from: Creator's handle
Appears on grid: Never
Brand controls: Targeting, budget, placement

It is sometimes called allowlisting, or described as a dark post. A dark post is simply an ad that never appears on the creator's public grid.

For fitness creators this matters because the audience often follows a named coach rather than a gym brand. A familiar handle can carry a training plan or a supplement trial further than a brand page would.

Whitelisting can run alongside affiliate tracking, but the contract should say whether paid ads use the creator's link or code and how attribution and any commission are handled.

The consent question UK brands cannot skip

The UK GDPR, supplemented by the Data Protection Act 2018, requires a lawful basis for processing personal data. Before processing starts, document the relevant Article 6 basis: consent, contract, legal obligation, vital interests, public task or legitimate interests. The basis must fit the processing; creator access alone does not make consent the right choice.

Who holds the lawful basis?

Where does the audience data sit?

Yes

With Meta -> brand exposure is contractual and disclosure

Brand's own processing -> needs own basis and record

The brand should assess its role in each data-processing activity rather than assume that using Meta's tools transfers all responsibility to Meta. The ICO's UK GDPR guidance explains what records of processing should contain. Use the ICO's data protection fee self-assessment to check whether the organisation must pay the fee and register; this is separate from choosing a lawful basis.

Uploading customer lists for matching, or building a health-related audience segment, is the brand's own processing. Record its basis and provide any required transparency information. If the data is special-category data concerning health, UK GDPR Article 9 requires an additional condition alongside an Article 6 lawful basis. PECR also applies to electronic marketing and to storing or accessing information on users' devices, so check its consent requirements before using tracking technologies.

Disclosure rules arrive from two directions

The ASA's guidance on recognising ads asks whether the audience can tell a post is an advert. The CAP Code covers non-broadcast advertising, including social media, and its recognition rules require marketing communications to be obviously identifiable. The BCAP Code covers broadcast advertising; the CMA's Social media endorsements: being transparent with your followers guidance and the Digital Markets, Competition and Consumers Act 2024 are also relevant to misleading endorsements and consumer protection.

Two disclosure tests

ASA test

Question asked: Can audience tell it's an ad?
Applies to: The creative
Failure result: Missing label

Meta test

Question asked: Does ad meet policies?
Applies to: The creative
Failure result: Ad refused

Meta applies its Advertising Standards separately from UK disclosure rules. For fitness ads, check its Personal Attributes and Health and Wellness policies: claims about body outcomes or targeting based on health characteristics may be restricted, whatever the disclosure says.

Both tests apply to the same piece of creative. A label does not cure a claim, and a compliant claim does not cure a missing label.

Setting whitelisting up: six steps

Agree in writing which handles, platforms and ad formats the brand may use.
Choose the platform permission route and confirm the creator has authorised the relevant account or post before spend begins.
Record the lawful basis for any personal data the brand processes, and who holds the consent record.
Write the permission windowstart date, end date, territories and platforms.
Agree who approves health claims and price claims, and how the ad will be labelled, before it goes live.
Check the creator's existing paid activity in Meta's Ad Library and confirm the brand's ad account can use the authorised post.

Platform permissions in practice

On Instagram, Meta's Branded Content Ads are now presented as Partnership Ads. The creator grants the brand the required permission through Instagram allowlisting; the brand needs the appropriate Meta Business Manager and ad account access, then uses Meta Ads Manager to create or promote the authorised post. Confirm permissions for the specific account and content before committing spend.

On TikTok, Spark Ads let a brand promote an authorised creator post. The creator can authorise the post, commonly with a video code, and the brand sets it up in TikTok Ads Manager. TikTok Creator Marketplace can support creator discovery and collaboration, but it does not replace checking the post's advertising authorisation.

Compare the two routes

The two routes solve different problems. Use the table to decide which one the brief actually needs.

Organic creator post

Who pays for reach: The creator's own audience
Who sets targeting: Platform tools, with the creator
Label needed: Ad label plus paid partnership tag
Cost model: Flat fee per deliverable
End point: When posting stops
Best use: Credibility with a warm audience

Whitelisted paid ad

Who pays for reach: The brand's media budget
Who sets targeting: The brand, inside Meta's tools
Label needed: Ad label on the creative
Cost model: Fee plus media spend
End point: When the permission window closes
Best use: Testing offers at scale

What belongs in the contract

A whitelisting clause is not a licence to use a person's name forever. Set the window in months, name the platforms and territory, specify which content may be used and for what paid activity, and say who can edit or approve it. The contract should also state who funds the media spend and what happens to the creative and access when the permission ends.

State separately whether the creator is paid for content production, the handle licence or any affiliate commission. Do not assume that permission to run an ad includes unlimited use or use outside the agreed platforms, territory or term.

Common questions

How long should a whitelisting permission run?

Most briefs work in three, six or twelve month windows. Tie the end date to the campaign rather than the calendar, and build in a notice period so spend can stop quickly.

Does the creator need to approve every ad?

The brand and creator may both face responsibility for misleading or non-compliant advertising, so approval rights protect both sides. Give the creator a clear review process and a veto over health and price claims in particular.

Can we run a whitelisted ad without a written agreement?

A platform permission may technically let the brand run an ad, but it does not replace a written agreement. Without one, the brand may be exposed if a claim is challenged, the agreed scope is unclear or access is withdrawn mid-campaign.

Do whitelisted ads still need a paid partnership label?

Yes. The duty follows the payment rather than the format, so a whitelisted ad still needs an ad label the audience can see.