Draft, pending solicitor review Not legal advice. Not a statement of what the law permits.

Read this before you rely on it. Everything below is the standard AceLeads applies to the leads we buy. It is written as our requirement rather than as an interpretation of UK GDPR or PECR, and it is a draft: the wording is with our solicitor and may change. What binds an affiliate is the signed affiliate agreement, not this summary. If your own position is unclear, take your own advice before you send us anything.

Compliance

What has to be true
about every lead you send.

Yes, provided the person consented to their details being passed on. UK GDPR and PECR treat consent as specific and informed only when the person was told, at the point of capture, who would contact them: AceLeads by name, or a category of recipient described clearly enough to be predictable. AceLeads buys a lead only when that consent exists and the evidence of it travels with the record.

One standard, applied the same way to every affiliate on every brief. It is short on purpose: name who is going to make contact, capture the proof at the moment the person agrees, and send the proof with the lead. Almost everything we turn down on consent grounds fails one of those three, and almost all of it is fixable at the form.

Apply to send us leads Lead quality standards

Specific consent, recipient named
Evidence attached to every lead
TPS and CTPS screened
Capture pages open to audit

Required on every record

The four evidence fields

Timestamp: The date and time the person submitted the form, to the second, in UTC or with the offset stated. A date on its own cannot place a submission against a version of the page.
IP address: The address the submission came from. It is the quickest way to tell a real person completing a form from a record that was generated, and it is where an audit starts.
Form URL: The full URL of the page completed, query string included, so the capture page can be found and read as that person saw it rather than as it looks today.
Consent wording: The exact text shown next to the tick, copied verbatim. Not a summary, not a paraphrase, not a link to your current policy: wording changes, and the record has to survive the change.

A lead missing any of the four is rejected on the consent standard, whatever else is right about it. Exactly how each field should travel, whether that is a form post, a scheduled CSV, a webhook or the API, is confirmed with you once your application is approved.

Consent

Specific, informed, and about somebody the person can picture.

The most common reason a well-generated lead fails our verification is consent that never named anyone. The enquiry is genuine, the person is real, the details are right, and the wording under the tick refers to partners who might be in touch. AceLeads treats that as consent we cannot pass on, so here are the four tests we actually apply.

Specific about who receives it

The wording names AceLeads, or describes the category of recipient clearly enough that the person could predict who would contact them: UK tree surgery firms, window and door installers, FCA authorised brokers. Trusted partners names nobody, and a lead carrying it is rejected.

Informed about what happens next

It says the details will be passed on so somebody can make contact about this enquiry, and it says how. If a buyer is going to telephone, the wording has to cover a telephone call, because agreeing to an email is not agreeing to a call.

Freely given and unbundled

Consent to be contacted is its own action, separate from accepting terms, separate from entering anything, and never pre-ticked. If ticking it is the price of a prize, a download or a discount, it is not consent we will accept.

Retrievable for a named person

You can produce the record for one specific individual, on request, quickly. We treat consent you cannot evidence as consent you do not have, and so does everybody else who ever asks about it.

What names a recipient

AceLeads by name. Or a category tight enough to be predictable: UK tree surgery firms, window and door installers covering your postcode, commercial solar installers, FCA authorised brokers. The test we use is simple. Could the person who ticked it have guessed, from the wording alone, roughly who was going to ring them?

What does not

Our trusted partners. Selected third parties. Carefully chosen companies. Relevant suppliers. Each of them describes a set with no edges, which is the reason they are popular and the reason we reject them. Changing that one line is usually the whole fix, and it costs nothing.

Consent is one part of the standard rather than all of it. What else makes a lead acceptable, and the closed list of reasons a lead can be turned down, is on the lead quality standards page, and each brief adds the fields its own vertical needs.

Evidence

Capture it at the tick, not afterwards.

Consent that exists but cannot be produced is worth nothing to you, to us or to the buyer. The four fields on the card above are not paperwork collected for form: they are what turns a claim into a record, and they can only be captured at the moment of submission.

Apply to join

The field that gets missed is the wording itself. Most stacks store a boolean: consent, true. That tells anybody reading it later that a box was ticked, and nothing whatever about what the box said. Store the sentence, verbatim, on the record. When you change the wording on the form, leads captured before the change keep the old sentence and leads after it keep the new one, which is exactly what you want when somebody asks about a submission from four months ago.

Keep the record for as long as the lead can reasonably be worked and questioned about, and be able to find it by name, email or telephone number rather than only by date. A record you hold but cannot search is close to a record you do not hold. Where you use a third party form builder, check what it actually retains before you rely on it: several of the popular ones store the submission and nothing about the page around it.

If capturing all four is awkward on your current stack, say so when you apply. It is a solved problem on every route we support, and it is far better sorted before your first batch than discovered in a run of rejections you have already paid traffic costs for.

Never, on any brief

Five sources we do not accept, at any volume.

This list is not a quality preference and it is not scored. A lead from any of these sources is refused whatever it looks like, and sending them is a breach of the affiliate agreement rather than a rejection to appeal. We would rather lose the volume than pass on a lead a buyer cannot lawfully work.

Purchased or rented lists

Data you bought, rented, swapped or inherited, from anyone, at any price. Consent given to one organisation does not travel to another, and this is precisely the practice the ICO has been fining.

Co-registration and shared pools

Entries harvested from somebody else’s form, from a network’s shared pool, or from any journey where the person did not arrive on your page intending to make this enquiry.

Incentivised traffic

Prize draws, competitions, gift cards, spin to win, cashback, free trials and every variation of them. The intent belongs to the reward rather than to the job, and the buyer discovers that on the first call.

Cold calling

Enquiries generated by ringing people who did not ask to be rung, however the number was obtained and whatever the script says on the recording.

Unevidenced SMS or email broadcasts

Any send to a list whose consent you cannot evidence, including your own older lists where the record no longer exists. An old list with a missing record is a bought list as far as verification is concerned.

And an indemnity behind it

The affiliate agreement asks you to warrant that no lead you send comes from any of these sources, and to indemnify AceLeads against claims, penalties and costs arising if one does. That clause is drafted and with our solicitor, so treat this as a summary of the commercial position rather than the final wording.

The list is closed and it does not grow quietly. If we ever add to it, affiliates on the programme are told before it applies, in the same way the briefs are versioned.

Screening and audit

Two checks that run whether or not you ask for them.

Both exist for the same reason. An affiliate doing this properly clears quickly and stays cleared, and an affiliate who is not gets found early rather than after a buyer has made a complaint. Neither is a comment on you personally: they run on everybody, from the first lead.

TPS and CTPS screening on phone leads

Every consumer telephone number is screened against the Telephone Preference Service, and every business number against the Corporate Telephone Preference Service, before the lead is released to a buyer. Where a number comes back registered, AceLeads holds the lead and asks to see the consent record for that person before it goes anywhere.

Screen at source as well. Treating our check as your only check means you learn about a problem after the traffic budget is spent, and a source producing registered numbers in volume usually has something wrong upstream that is worth knowing on day one rather than in week three.

We audit capture pages

We ask to see the page behind any brief you take, usually before volume steps up, and we may ask again at any point afterwards. What we want is the live URL and a screenshot of the form as the person sees it, with the consent tick and the wording beside it visible. It takes a few minutes and it is almost always the end of the conversation.

Tell us when a page changes. A new form, a reworded consent line, a fresh landing page for the same brief: a short message beforehand costs you nothing, and it is the difference between a smooth run and a batch of rejections nobody wanted. Refusing an audit, or sending leads from a page you will not show us, ends the arrangement.

Regulated categories

Claims work is not open to everyone.

Some of what we buy sits inside a regulated activity, and claims is the clearest example. Those briefs run to a tighter standard than the rest of the programme, and they open to selected affiliates rather than to the whole list.

Leads in a regulated category are released only to firms appropriately authorised to handle them, which is checked before anything is passed on rather than taken on trust. That constraint sits on our side of the arrangement, and it is why a regulated brief can be paused while a perfectly good source is producing volume: if there is nobody authorised to place the work with, we do not buy it.

On your side, a regulated brief adds requirements rather than replacing them. The consent has to name the type of firm that will make contact, the evidence requirements are enforced strictly rather than pragmatically, and where any part of the enquiry is taken verbally we expect a recording to exist. Every regulated brief is reviewed before it opens and can close again at short notice, which is said plainly here rather than buried, because a source built around a brief that disappears is an expensive surprise.

If you generate in a regulated category, tell us when you apply rather than sending a first batch to see what happens. We will say yes, not yet, or no, and we will say which. The published briefs mark the regulated ones, so you can see where the line falls before you build anything.

Why we are strict

This is being enforced now, not in principle.

Affiliates sometimes read a consent standard as a buyer being difficult. It is worth setting out what has changed, because it explains why we would rather turn a lead down than take it and hope. The three points below are matters of public record and each is attributed to its source.

The ceiling moved

The Data (Use and Access) Act 2025 raised the maximum penalty for breaching the principal PECR duties from £500,000 to £17.5 million or 4 per cent of global turnover, bringing PECR into line with UK GDPR. Source: the Act.

Fines against this exact model

In January 2026 the ICO fined ZMLUK Limited £105,000 and Allay Claims Ltd £120,000 over unlawful marketing. Source: the ICO. The ZMLUK case turned on marketing to data acquired from a third party, which is the first item on our prohibited list.

Exposure runs both ways

Where a lead is captured under vague consent and somebody downstream then calls or emails, the party who generated it, the party who passed it on and the party who used it can all be facing the same question. That is why our standard sits at the point of capture, where it can still be fixed.

Still a draft. The three points above are matters of public record and nothing more. They are not a prediction about any particular case, they are not advice, and this page remains subject to solicitor review. Where your own capture needs a view on the law, get one from somebody qualified to give it.

Non-negotiable

Two things every lead has to clear.

These apply to every brief on this page and every brief we run. They are not preferences, and a lead that misses either is rejected whatever else is right about it.

Your capture pages meet the standard

Every page you generate from has to be built to UK GDPR and PECR standards, not close to them. That means a real privacy notice, consent that is specific, informed and freely given, no pre-ticked boxes or bundled permissions, and AceLeads or a clearly described category of recipient named at the point of capture.

Consent evidence travels with the lead: the timestamp, the IP, the page URL and the exact wording the person was shown. Consent you cannot produce is consent you do not have.

What we require, in full

Every lead is verified before it counts

Leads are verified on the way in, by you before you send and by us on receipt. Contact details are checked, duplicates are caught across every affiliate rather than just your own, and known junk patterns are filtered automatically.

This protects your earnings as much as our buyers. A verified stream gets a higher acceptance rate, and a clean sender gets the briefs with the best rates first.

How a lead is judged

We audit capture pages, and we will ask to see one before your first lead is accepted. This is not box-ticking: under the Data (Use and Access) Act 2025 the maximum PECR penalty is a matter of public record, and a lead sourced from a bought list puts both of us in front of it.

FAQ

Consent, answered plainly.

The questions affiliates ask before a first batch. Every answer describes what AceLeads requires rather than what the law permits, and none of it substitutes for your own advice. New to the programme? Read how it works, or see how payment is structured.

Is it legal to sell leads in the UK?

Passing an enquiry to another business is lawful when the person consented to that happening and the consent covers the way they will be contacted. What makes a lead unlawful is almost never the sale itself, it is consent that was vague, bundled, incentivised or simply never obtained. This page sets out the standard AceLeads applies before it buys anything. It is our purchasing standard rather than legal advice, and it is a draft pending solicitor review.

What does UK GDPR require when I pass a lead on?

In practice, that the person knew what would happen to their details and agreed to it, that you can show they agreed, and that you can produce the record for a named individual on request. AceLeads requires the consent to identify us by name or to describe the category of recipient clearly enough that the person could predict who would make contact, and requires the evidence to arrive attached to the lead rather than on request. Take your own advice on how the law applies to your own capture.

What does PECR add on top of UK GDPR?

PECR governs the channel rather than the data: the call, the text and the email. Consent to be contacted by telephone is not the same as consent to be emailed, and a person who is told a firm will call is not thereby agreeing to a marketing broadcast. AceLeads requires the consent wording to cover the method the buyer will actually use, which on most of our briefs is a telephone call within working hours.

Does consent naming our trusted partners count?

Not with us. Wording of that kind names nobody, so the person cannot predict who is going to contact them, and a lead carrying it is rejected on the consent standard. Name AceLeads, or describe the recipients tightly enough to be meaningful: UK tree surgery firms, or FCA authorised brokers, rather than partners, third parties or selected companies.

What consent evidence do I have to send with a lead?

Four things, on every single record: the timestamp of submission, the IP address it came from, the full URL of the form, and the exact consent wording shown to that person, copied verbatim. A link to your current privacy policy is not evidence, because policies change and the record has to survive the change. The integrations page sets out how each field travels on a form post, a CSV, a webhook or the API.

Can I send leads from a prize draw or a competition?

No. Incentivised traffic is prohibited on every brief, including prize draws, gift cards, spin to win, cashback and free trials. The problem is not only the consent, it is the intent: the person wanted the reward rather than the job, and the buyer who rings them finds that out. That is why the prohibition is absolute rather than a quality score.

Do you screen phone numbers against TPS and CTPS?

Yes. Every consumer number is screened against the Telephone Preference Service and every business number against the Corporate Telephone Preference Service before the lead is released to a buyer. Where a number comes back registered, we ask to see the consent record before releasing it, and we expect you to screen at source as well rather than relying on us as the only check.

Will you look at the pages my leads come from?

Yes. We ask to see the capture page behind any brief you take, usually before volume increases, and we may ask again at any time. Send the live URL and a screenshot of the form as the person sees it, including the consent tick and the wording beside it. If the page changes after we have seen it, tell us: that is a two minute message rather than a batch of rejections later.

Can any affiliate send claims leads?

No. Regulated categories such as claims are released only to appropriately authorised firms, and those briefs are opened to selected affiliates rather than to everyone on the programme. They carry additional evidence requirements and each one is reviewed before it opens. If you generate in a regulated category, say so when you apply and we will tell you honestly whether the brief is open.

Get it right at the form

Show us the page before you spend on traffic.

Apply, take a brief, and send us the capture page you intend to use. We will tell you what would fail on consent before a single lead goes through it, which is a five minute conversation now instead of a run of rejections later.