Rhinehart Studio

The Weekly Brief · Issue #0 · 25 October 2026

Fake countdowns cost £6m, "we tested" ads, and Password1

Sources checked: ICO news and enforcement, ASA rulings, CMA, HMRC, Companies House, DBT and DSIT news on GOV.UK (11–25 October 2026)

Welcome to issue #0 of the UK Small Business Compliance & AI-Ads Brief. Each week we read the regulators so you don't have to, and pick the items that matter to small UK businesses selling online. Every item has a one-line TLDR, a link to the original source, and one thing to do on your site this week. This is general information, not legal advice. If something affects you, read the source.

1. CMA fines three firms £6m for fake deadlines, pre-ticked extras and hidden fees

TLDR: The CMA fined Wayfair, Appliances Direct and Gold's Gym a total of £6 million under its new consumer-law powers. The reasons: "Flash Deals" and countdown timers whose prices carried on after the deadline, customers automatically opted in to paid extras, and a gym joining fee left out of the headline price.

Do this week: Look at every "today only", "ends tonight" or countdown timer on your site. If the price doesn't actually change when the timer runs out, remove the timer. Make paid add-ons opt-in (no pre-ticked boxes), and show the total price, including any compulsory fee, up front.

Source: CMA, "CMA fines firms £6 million for misleading sales tactics", 14 October 2026

2. ASA: a "we tested the top 5" page was really an ad

TLDR: The ASA upheld a complaint against Home + Health. Its Facebook ad led to a "5 Best Non-Toxic Dishwasher Tablets" review page, written in the style of an independent test, that ranked one product first. The ad also claimed, without enough evidence, that standard tablets were harmful. The ASA told the company to make its ads obviously identifiable as marketing and to stop making the claims without substantiation.

Do this week: If you run "best of" or "we tested" pages, comparison pages or advertorials that point to your own product (or earn affiliate commission), label them clearly as advertising. Keep the evidence for any health or "safer than" claim on file before the ad goes live.

Source: ASA ruling on Cara Capsules Ltd t/a Home + Health, 21 October 2026

3. ASA: a story-style ad relied on racial stereotypes

TLDR: The ASA banned a YouTube ad for the RiseGuide self-improvement app. The ad was a short drama about a South Asian woman's first week at work, and the ASA found it featured harmful negative racial stereotypes and was likely to cause serious offence.

Do this week: Scripted "mini-drama" and UGC-style ads are cheap to make with AI tools, which also makes them easy to get wrong. Before publishing, have someone who didn't write the script read it, and ask them: does the hook rely on a stereotype about race, sex, age or disability to work?

Source: ASA ruling on Celeb Innovations Ltd t/a RiseGuide, 21 October 2026

4. ICO: "Password1" on a 12-year-old test account led to a ransomware attack

TLDR: The ICO reprimanded Ogi Networks and Data Cymru after attackers used an old "Test2" account protected by the password "Password1". The attack exposed the personal information of 3,300 people, mostly children. The ICO also found there was no proper data processing contract between the organisation and its IT supplier.

Do this week: Open the user list for your website, shop, email and accounting tools. Delete old test, staff and freelancer logins, switch on multi-factor authentication, and check you have a written data processing agreement with anyone who manages your systems or customer data for you.

Source: ICO, "'Password1' is not an appropriate password", 20 October 2026

5. ICO: AI developers made data protection changes, and the ICO is now asking about AI agents

TLDR: The ICO says ten large AI model developers have made, or committed to make, changes after its scrutiny, including clearer transparency information and better ways for people to exercise their rights. It has also opened a call for evidence on the data protection risks of "agentic" AI, meaning tools that take actions on your behalf.

Do this week: List the AI tools you paste customer data into, such as chat assistants, transcription tools and ad generators. For each one, check whether your inputs can be used for training and switch that off where you can. Make sure your privacy notice mentions these tools if they process customers' personal data.

Source: ICO, "ICO secures changes from leading AI developers as scrutiny extends to AI agents", 8 October 2026

6. ICO: complaints about automated nuisance calls are at a five-year high

TLDR: Complaints to the ICO about automated (including AI-voiced) marketing calls rose from 1,374 in July to 3,684 in September 2026, the highest level since 2021. The ICO says it is actively investigating.

Do this week: If you use any calling or "AI receptionist" tool for outbound marketing, remember that under PECR, automated marketing calls need the person's specific prior consent. For live marketing calls, screen numbers against the Telephone Preference Service unless the person has told you they're happy to be called.

Source: ICO, "Complaints about automated nuisance calls hit five-year high", 9 October 2026

7. Sole traders over £30,000: Making Tax Digital starts on 6 April 2027

TLDR: HMRC says Making Tax Digital for Income Tax will apply to sole traders and landlords with qualifying income over £30,000 from 6 April 2027. Those affected must keep digital records and send quarterly updates using compatible software. The threshold is due to fall to £20,000 from April 2028. Separately, HMRC is reminding people that the online Self Assessment deadline is 31 January 2027.

Do this week: Add up your gross self-employment and property income for 2025–26. This is turnover before expenses, not profit. If it's over £30,000, choose MTD-compatible software now and consider signing up early on GOV.UK.

Sources: HMRC, "Sole traders and landlords earning more than £30,000 urged to act now", 5 October 2026 · HMRC, "Self Assessment deadline incoming – 100 days to go", 23 October 2026

8. Companies House pauses profit and loss filing for small companies, but software-only filing from April 2028 goes ahead

TLDR: The plan to make small and micro companies file their profit and loss account at Companies House is paused, and small companies can still file abridged or "filleted" accounts. The government says it is still committed to requiring all companies to file accounts in iXBRL format using commercial software from April 2028.

Do this week: If you run a limited company and file your accounts through the Companies House web form, ask your accountant (or check your software) whether it can file in iXBRL format before April 2028.

Source: Companies House, "Companies House update to accounts filing from April 2028", 23 October 2026

From Rhinehart Studio (our own services)

This is a house ad for our own services. We don't take paid sponsors yet, and if we ever do, they will always be labelled "Sponsored".

General information, not legal advice. Corrections: [email protected].