Most Pakistani websites and apps run analytics, an advertising pixel, a chat widget and an attribution SDK — installed by a developer, never reviewed, and collectively sending more data to more parties than anyone in the business realises.
The exposure is real, and it comes from three directions: the law of the markets your users are in, your own published privacy policy, and platform rules.
Know what you are actually running
Before anything else, audit. For your website and app, list:
- Every script, pixel, SDK and tag — analytics, ad platforms, attribution, heat maps, chat, crash reporting, embedded video and fonts
- What each collects, including IP address, device identifiers, and behaviour
- Who receives it, and where they are
- Whether it fires before any consent is given
Most businesses cannot answer these questions, and that is the finding an auditor or a client makes first. Tag managers make it worse — marketing adds tags without telling anyone.
Consent: whose law applies
Pakistan's general data protection framework has been in development, and sectoral rules apply to regulated businesses. But the binding constraint for most Pakistani businesses is elsewhere:
If you have EU or UK users, their rules on cookies and tracking apply to that processing, and they require prior consent for non-essential cookies and similar technologies — freely given, specific, informed, and as easy to refuse as to accept.
That means, in practice:
- No non-essential tags fire before consent. A banner that loads analytics anyway is worse than no banner, because it documents that you knew
- Reject must be as prominent as Accept. "Accept all" beside a buried settings link is precisely the pattern regulators have penalised
- Granular categories — analytics, advertising, functional — with genuine choice
- A record of consent, and an easy way to withdraw it
US markets bring their own state-level requirements, including opt-out of sale or sharing of personal information and honouring browser opt-out signals.
If your audience is entirely Pakistani, these do not apply directly — but your privacy policy is still a binding promise, and saying you do not share data with third parties while running four advertising pixels is a misrepresentation.
See data protection and privacy for Pakistani businesses and cloud contracts and data localisation.
Your privacy policy should describe reality
The commonest failure we see is a template policy that bears no relation to the site.
It should state, accurately: what is collected, why, the third parties who receive it, how long it is kept, whether data leaves the country, how a user can object or request deletion, and who to contact. Update it when the tags change.
For apps, the store's privacy declarations must match the same reality. See publishing a mobile app.
Advertising claims
Separate from privacy, and enforced through consumer and competition law.
Substantiate every claim. Performance, ingredients, "number one", "clinically proven", origin, certification, discounts and "was" prices. If you cannot evidence it, do not publish it.
Discount and price claims must be genuine — a permanently inflated "original price" is a deceptive practice.
Comparative advertising is permissible in principle but attracts both competition law and trade mark issues, and must be accurate.
Deceptive marketing practices fall within the Competition Commission's remit, and complaints are made by competitors as often as by consumers. See competition law and the CCP and consumer protection claims in Sindh.
Sector-specific rules apply to health, pharmaceutical, food, financial and educational advertising, and these are the categories most likely to attract regulatory attention. See food and pharma licensing.
Influencer and affiliate marketing
Paid promotion should be disclosed clearly — the disclosure obligation sits with both the brand and the creator, and undisclosed paid endorsement is a deceptive practice.
Contract for it: deliverables, approval of claims, a requirement to disclose, who is liable if a claim is wrong, exclusivity, usage rights in the content, and takedown on termination.
Do not permit an influencer to make a claim about your product that you could not make yourself, and never fabricate testimonials or synthetic "customers". See media, entertainment and influencer contracts and who owns AI-generated content.
Email, SMS and WhatsApp marketing
Bulk marketing in Pakistan operates under PTA regulation of unsolicited communication, including short code and bulk SMS requirements and do-not-call arrangements.
Practically:
- Send only to people who gave you their number for that purpose — a customer database is not a marketing list unless they agreed
- Provide an opt-out, and honour it promptly
- Do not buy lists. Acquired databases are the origin of most complaints, and processing personal data obtained that way is indefensible
- WhatsApp Business has its own template and opt-in rules; breaching them results in number bans, which for many businesses is worse than a regulatory letter
Where marketing crosses into impersonation or fraud, PECA applies. See online blackmail, fake accounts and takedowns.
Using other people's material
Ad creative built from stock images without a licence, music used without rights, or a competitor's photographs reused, is infringement — and the takedown usually arrives mid-campaign. Keep the licences for every asset, and note the restrictions (many stock licences exclude use in logos, on merchandise, or in political and sensitive contexts).
See copyright for creators and content businesses and trade mark registration.
Contracts with agencies and ad platforms
With agencies: who owns the creative and the ad accounts (insist on owning your own ad accounts, pixel and data), who is responsible for claim substantiation and disclosure, what happens to audiences and creative on termination, and reporting and audit of spend.
Agencies holding a client's ad account hostage after a fee dispute is a recurring problem, and it is solved by ownership being clear at the start.
With platforms: standard terms, minimal negotiation, and broad rights to suspend accounts. Keep your own records of campaigns and spend, and do not build a business on a single channel.
See the contracts every business should have and domain names and account ownership.
A short compliance checklist
- Audit every tag, pixel and SDK
- Block non-essential tags until consent, where consent is required
- Make reject as easy as accept, and record consent
- Align the privacy policy and store declarations with what actually happens
- Substantiate every advertising claim, and keep the evidence
- Contract with influencers and agencies, including disclosure obligations
- Clean the marketing list, honour opt-outs, and stop buying data
- Licence every creative asset
- Review whenever marketing adds something new
How the firm can help
We audit sites and apps against the commitments they have made and the rules of the markets they serve, draft privacy policies, cookie notices and consent flows that work, review agency, influencer and adtech contracts, advise on claim substantiation before a campaign runs, and act in complaints brought by regulators, competitors or consumers.