Advertising is where this sector has the highest volume of breaches and the lowest perceived risk, and the gap between those two things is worth understanding rather than exploiting.
The three regimes
Medicines. Advertising a prescription only medicine to the general public is prohibited. The prohibition is broad and covers a clinic's own website, its social content and material published on its behalf, not only paid advertising. Because botulinum toxin products are prescription only medicines, marketing built around a toxin brand engages it.
The CAP Code. Administered by the Advertising Standards Authority. It requires objective claims to be substantiated, requires marketing communications to be obviously identifiable as such, and contains rules specific to cosmetic interventions covering how results are presented and how an audience's insecurities may be addressed.
Financial promotions. Where a clinic offers or arranges credit, financial promotion requirements apply on top of everything else, including requirements about balance and representative examples. Credit broking is itself a regulated activity requiring authorisation or an applicable exemption.
Where responsibility sits
With the advertiser. That is the clinic. It is not the agency that produced the work, it is not the platform that carried it, and it is not the influencer who posted it, although the influencer may have their own obligations alongside.
Where a registered clinician is involved, there is a second, separate exposure: their own regulator's standards on promotion apply to them personally, and that exposure attaches to their registration rather than to the business.
Two consequences follow that are worth internalising. Hiring an agency does not transfer the risk, so procurement should test the agency's familiarity with these rules rather than assume it. And an influencer posting about your clinic under a commercial arrangement is your marketing communication, which means you can be named in a ruling about a post you did not write.
The breaches that actually happen
Naming a toxin brand in consumer facing content. The most common breach in the sector. Abbreviations, deliberate misspellings, hashtags and emoji substitution do not change the analysis, because the question is whether the material promotes the medicine to the public.
Undisclosed commercial arrangements. Treatment provided in exchange for content is a commercial arrangement requiring clear and prominent disclosure, and the clinic is a party to it.
Unsubstantiated superlatives. Best, safest, leading and most advanced are objective claims requiring evidence.
Results imagery that misleads. Non comparable lighting, angle, expression or timing, atypical results presented as typical, or images that imply an outcome the treatment does not reliably produce.
Pressure tactics. Countdown timers, limited availability framing and same day discounts attached to an irreversible procedure engage the rules on responsible marketing of cosmetic interventions.
Financial promotions without required information. A monthly payment figure without a representative example where one is required, or interest free framing that obscures a credit arrangement.
ObservedThe ASA publishes its rulings openly and they are searchable by sector and advertiser. Read as a body, they are a more accurate specification of enforcement risk than any guidance document.AnalysisThe perceived low risk in this category is a function of enforcement capacity rather than of the rules being soft. A rule enforced rarely is still a rule, and the record of a ruling is permanent.SpeculationAutomated detection of prescription only medicine promotion on social platforms is a tractable problem and is becoming more tractable. Detection capability, rather than rule change, is the variable most likely to move enforcement volume here.The durable cost is the record, not the sanction
The ASA's principal sanction is publication of the ruling alongside measures such as withdrawal of the advertisement. For most operators the financial consequence is limited. The durable consequence is that the ruling is published, indexed, searchable and quotable indefinitely, with the clinic named.
That cost has lengthened rather than shortened, because material of this kind is increasingly retrievable by systems that summarise the public record. An adverse ruling is now an entry in a corpus, not merely a page on a regulator's website.
The regulators nobody in this sector is watching
Three bodies beyond the ASA have jurisdiction over parts of this territory and are substantially less familiar to operators than they should be.
The Medicines and Healthcare products Regulatory Agency holds the statutory role on medicines advertising. Its involvement is less frequent than the ASA's and its powers are considerably greater.
The Financial Conduct Authority regulates consumer credit and financial promotions. Credit broking is a regulated activity, and a clinic introducing patients to a finance provider without authorisation or an applicable exemption is a straightforward thing to identify from a website, without an inspection. Of all the compliance exposures in this sector, this is the one with the largest gap between risk and awareness.
Local trading standards and the Competition and Markets Authority enforce consumer protection law, including rules on misleading actions and omissions and on aggressive commercial practices. Pressure selling of an irreversible procedure sits squarely inside that territory.
The influencer problem, specifically
Influencer arrangements in this sector combine every available exposure in a single post.
The post may name a prescription only medicine, engaging the medicines prohibition. It may fail to disclose the commercial arrangement, engaging the requirement that marketing be obviously identifiable as such. It may present an individual result as typical, engaging the substantiation and exaggeration rules. And it may show an identifiable person's treatment, engaging data protection obligations that the clinic, not the influencer, holds.
The clinic is responsible for the marketing communication and, separately, is the data controller for any clinical images involved. An arrangement briefed casually over direct message can therefore generate four distinct exposures, none of which the influencer carries in full.
A practical compliance routine
Audit the back catalogue, because old posts are still published and still capable of being complained about. Establish a named person responsible for approving marketing copy. Maintain a substantiation file for every objective claim currently in use. Separate clinical photography consent from publication consent, and make publication consent specific and withdrawable. Settle the finance position in writing. And read rulings in this sector regularly, because they are free and they describe behaviour rather than intent.
The Committee of Advertising Practice also offers a free advice service to advertisers, which is used by a vanishingly small proportion of this sector.