01
AI in media buying
AI already makes most of the moment-to-moment decisions in a modern media plan. The question for a team is rarely whether to use it, but which decisions you are handing over and how you will know if they go wrong.
Where it shows up
- Bidding and pacing: automated bid strategies set a price for every auction against a CPA, ROAS or reach goal.
- Audience modelling: lookalikes, predicted value and “broad” targeting let the platform choose who sees the ad.
- Campaign automation: all-in-one campaign types (for example Performance Max or Advantage+) decide placements, audiences and creative mix together.
- Creative generation: headlines, image variations, backgrounds, voice-overs and resizes generated on the fly.
- Measurement: modelled conversions, data-driven attribution and media mix models fill the gaps left by lost signal.
- Agentic buying: emerging tools that can draft plans, set up campaigns and move budget with limited human review.
Questions to ask before you hand a decision over
- What objective is the system optimising, and does it match the business outcome you care about?
- Which of your data does it use, and can the vendor use that data to train models for others?
- What reporting do you lose? Automated campaign types often hide placement or query detail.
- Who reviews outputs (bids, audiences, creative) and how often, and what is the kill switch?
- How will you test it? Hold-outs and incrementality tests beat platform-reported lift.
02
Disclosure norms
No single rule covers every market, but the direction is consistent: tell people when AI has created or materially altered something that looks real, and never use it to fake evidence.
Principles that hold almost everywhere
- Realistic depictions need a label. Synthetic people, voices or events that a viewer could mistake for real should be disclosed, especially in political and social-issue ads.
- No fake proof. AI-generated testimonials, reviews, “customer” photos or before-and-after images presented as genuine are deceptive advertising in most jurisdictions.
- Endorsements stay real. Do not imply that a real person, creator or public figure endorses you through a synthetic likeness or cloned voice without their permission.
- Keep provenance metadata. Content Credentials (C2PA) are increasingly read and displayed by platforms. Stripping them can look worse than keeping them.
Regulatory anchors
- United States: the FTC treats deceptive AI claims and AI-generated fake reviews and testimonials as unfair or deceptive practices. Several states have rules on synthetic media in election ads. Verify against current platform policy
- European Union: the AI Act adds transparency duties, including labelling deepfakes and marking AI-generated content, phased in over several years. Verify against current platform policy
- United Kingdom: the ASA and CAP Code apply in full to AI-generated ads. The test is whether the ad misleads, not how it was made. Verify against current platform policy
03
Generative creative by platform
A summary of how the major ad platforms treat AI-generated or AI-altered creative. Treat each card as a pointer to the source, not as the source.
Google Ads & YouTube
Verify against current platform policy- Election ads must clearly disclose synthetic or digitally altered content that realistically depicts people or events.
- YouTube requires creators to disclose realistic altered or synthetic content; ads remain subject to Google Ads policies.
- Google's own generative asset tools mark some generated images (for example with SynthID). Review every generated asset before it serves.
- Misrepresentation, unreliable-claims and impersonation policies apply to AI creative exactly as to any other creative.
Check: Google Ads Policy Center; YouTube Help (altered or synthetic content)
Meta (Facebook, Instagram)
Verify against current platform policy- Political, electoral and social-issue ads must disclose photorealistic images, video or realistic audio that was digitally created or altered.
- Meta may label content it detects as AI-generated or AI-edited.
- Advantage+ generative features create variations of your creative automatically. Check settings, and review outputs for brand and claim accuracy.
Check: Meta Advertising Standards; Meta Business Help Center
TikTok
Verify against current platform policy- Realistic AI-generated content must be labelled. TikTok also reads Content Credentials (C2PA) to auto-label some AI content.
- Political ads are not allowed on TikTok.
- Using AI likenesses of public figures to imply endorsement is prohibited.
Check: TikTok Advertising Policies; TikTok Community Guidelines
- Shows Content Credentials (C2PA) on images that carry them, so provenance metadata in your files may be visible to viewers.
- Deceptive or misleading content rules apply to AI creative; B2B claims and testimonials need substantiation.
Check: LinkedIn Advertising Policies
Amazon Ads
Verify against current platform policy- Offers generative image and video tools for sponsored ads. Generated scenes must not misrepresent the product, its size, contents or results.
- All creative, generated or not, goes through Amazon's creative acceptance review.
Check: Amazon Ads creative acceptance policies
Microsoft Advertising
Verify against current platform policy- Offers Copilot-generated ad assets; editorial policies apply to all assets you approve.
- Political and election-related ads are not accepted.
Check: Microsoft Advertising Policies
04
Data and consent basics
AI systems are only as compliant as the data you feed them. These are the basics every buyer and seller should be fluent in.
Europe and the UK
- GDPR / UK GDPR: every use of personal data needs a lawful basis. For ad targeting and measurement that is usually consent.
- ePrivacy (cookie) rules: storing or reading identifiers on a device needs prior consent unless strictly necessary.
- IAB Europe TCF: the industry framework for passing consent signals through the programmatic chain. Vendors must respect the signals they receive. Verify against current platform policy
- Google Consent Mode: required for EEA and UK traffic if you want Google's ads measurement and personalisation to keep working. Verify against current platform policy
United States
- State privacy laws: California (CCPA/CPRA) and a growing list of states give people the right to opt out of the “sale” or “sharing” of data for targeted ads. Verify against current platform policy
- Global Privacy Control: a browser opt-out signal that several states require businesses to honour.
- IAB GPP: the Global Privacy Platform carries US state and other privacy signals through the ad chain.
- Sensitive data: health, children's (COPPA, under 13), precise location and similar categories carry stricter rules. Some, such as Washington's My Health My Data Act, reach well beyond traditional healthcare. Verify against current platform policy
Everywhere
- Hashed emails and device IDs are still personal data. Hashing is not anonymisation.
- Clean rooms reduce data exposure but don't replace consent. Check what was consented to before you match.
- Uploading customer lists to train or seed AI audiences is a use of that data; your privacy notice must cover it.
05
Team checklist
- 01Keep a register of every AI tool and automated campaign type in use, with an owner for each.
- 02Write down which data each tool receives and confirm your contracts and privacy notice cover that use.
- 03Require human review of generated creative for claims, likeness and brand safety before launch.
- 04Label realistic synthetic content, and always in political or social-issue ads.
- 05Never publish AI-generated reviews, testimonials or customer imagery as if they were genuine.
- 06Preserve Content Credentials on generated assets.
- 07Test automated buying against a hold-out at least once a quarter.
- 08Re-check platform policies before each major launch. They change faster than this page.
Building creative? Check sizes in the Creative Studio specs library and preview placements in Creative Studio.