Influencer campaign compliance audit: what to log for every post

An influencer campaign compliance audit, run as a checklist, checks that every post has six records: a signed contract, an approved draft, a disclosure check, a rights licence, the published URL and a payment record. Each record answers one question an auditor, a client or a regulator will ask. Together they prove the post was agreed, checked, labelled, licensed and paid as agreed.

Picture an agency in Madrid running a spring launch for a cosmetics client: 12 creators, 30 pieces of content, three weeks. Two months later the client's legal team asks a simple question about one Reel: who approved it, and did it say "Publicidad"? The answer sits in a WhatsApp thread, a shared drive and the account manager's memory. That is the gap this checklist closes.

This post is written for agencies that run creator campaigns for brands in Spain, the EU and Latin America. It covers why the agency carries risk, the six records and what each must contain, how to link them into one audit chain, how long to keep them, and a worked audit of a 30-post campaign. It is not legal advice: for a specific campaign, ask your lawyer.

Why does the agency carry compliance risk for its clients?

The agency carries risk because Spanish self-regulation names agencies directly and because the agency usually holds the evidence. Norm 1 of the AUTOCONTROL influencer code (2025 version) lists who commits to it: members of the aea, AUTOCONTROL and IAB Spain, plus influencers, influencer agencies, advertising agencies and any other company that adheres.

Norm 12 then says liability for a breach "can reach all parties involved in the commercial communication". A party can escape only if it proves the breach came from a one-off, clear failure to follow the instructions given to the influencer. Our explainer on what the AUTOCONTROL code asks of brands walks through the norms in full.

The law sits behind the code. Article 26 of Ley 3/1991, de Competencia Desleal treats paid content presented as information, without making clear it is advertising, as a misleading practice. That duty binds every business, adherent or not. For the full legal map, read the legal checklist for influencer marketing in Spain.

In practice, three things put the agency in the line of fire:

• The agency writes the instructions. The brief, the label rule and the draft comments usually come from the agency. If the instructions were unclear, the defence in norm 12 fails, and it fails for the party that wrote them.
• The agency holds the evidence. Contracts, drafts and payment confirmations often live in the agency's inbox and drive, not the client's. When the client is asked to prove compliance, it asks the agency.
• The client contract shifts the risk. Many agency agreements include a warranty that campaigns comply with advertising law and an indemnity if they do not. Read yours. If it has that clause, the audit trail is your own insurance.

The six records to keep for every post

Each record proves a different fact, and none of them substitutes for another. A signed contract does not prove the label was in the caption. A screenshot of the live post does not prove anyone checked it before it went out.

1. The signed contract

The contract is the root of the chain. It fixes the consideration (money, product, commission, trip), which is what makes a post advertising under the code. It also carries the duty to label: norm 3 of the AUTOCONTROL code asks that agreements with influencers include the duty to comply with the code. Our clause-by-clause influencer contract template shows where that clause sits.

Two details matter for an audit. First, the version: you need the terms as signed, not the current template, so a later edit cannot change what the creator agreed to. Second, the date: a contract signed after the post went live is evidence of a payment, not of instructions given beforehand.

2. The approved draft

The approved draft proves the instructions were applied before publication. Keep the draft itself (caption text and the video or images), the reviewer, the date, every comment and the final approval. If you asked for changes, keep each round. The trail of "add Publicidad at the start" followed by an approved draft that has it is exactly the evidence norm 12 needs.

3. The disclosure check

The disclosure check records that the label was present and placed correctly. Under norm 6 of the code, the label goes at the start of the message, in the language of the post, not mixed with other hashtags and not behind "more". "Publicidad" or "Publi" are the safe choices for a Spanish post; the code says English labels such as "Ad" do not count in a Spanish-language post, and a brand hashtag alone is not enough. On Stories the label goes at the start of each Story. Creators who are users of special relevance under Real Decreto 444/2024 must also follow the audiovisual commercial-communication rules (norm 6f), so check those separately.

Check twice: on the draft and on the live post. Creators edit captions after approval, and a label that was first in the draft can end up last in the published caption.

4. The rights licence

The rights licence records what the client may do with the content after it is posted. Organic posting on the creator's own account is one use. Reposting on the brand's site, using it in email or boosting it as an ad are separate uses, and paid amplification is the one most often assumed and least often agreed. Our post on UGC rights in the EU covers copyright, image rights and GDPR consent in detail.

A licence record states the post, channels, markets, term and status (active, expired or revoked). Status matters: a client that keeps running a post after the licence expired has a rights problem even if everything else in the chain is clean.

5. The published URL and live capture

The published URL ties the paperwork to something real. Keep the link, the publish date and the caption as it went live. For formats that disappear, such as Instagram Stories, take a capture of every frame on the day, because there is nothing to check once the Story expires. Note the paid-partnership tool, if used, in the same record.

6. The payment record

The payment record closes the chain: it shows the creator was paid what the contract said, for the deliverable that went live. Keep the amount, the date, the method, the invoice or payout statement and any withholding. For creators in Spain, our influencer invoice checklist lists what a valid invoice must contain. The audit question is simple: can you match each payment line to a post?

How do you link the records into one audit chain?

Use the post as the key. Every record gets the post's identifier, and every record can be reached from the post in one step. Auditors, clients and regulators start from what they can see, which is the live post, and work backwards.

The chain answers four questions in order:

1. Was it checked? From the live post to the approved draft and its disclosure check. Compare the live caption with the approved caption.
2. Was it agreed? From the draft to the contract. Confirm the contract was signed before the draft was approved and includes the label duty.
3. Was it paid as agreed? From the contract to the payment record. Confirm the amount and the deliverable match.
4. May we reuse it? From the post to the rights licence. Confirm the scope covers every place the client uses the content, and that the licence is still active.

If your records live in four tools, the chain still works as long as each record carries the post link. A spreadsheet with one row per post and a column per record, each cell holding a link, is the minimum viable audit log.

How long should you keep the records?

Keep them for at least six years from the end of the campaign, unless your lawyer tells you otherwise. Article 30 of the Spanish Commercial Code (Código de Comercio) requires businesses to keep the books, correspondence, documentation and supporting documents of their business for six years. The Spanish tax authority's right to assess tax prescribes after four years under article 66 of the Ley General Tributaria, so invoices and payment records need at least that.

GDPR pulls the other way. Under article 5 of the GDPR, personal data should be kept no longer than necessary, and under article 7 you must be able to show that consent was given. The practical answer is to keep the compliance record (contract, approvals, licence, payment) for the legal period and delete working material you do not need, such as raw footage that never ran.

Agree two points with each client in writing:

• Who keeps what. The agency often acts on the client's behalf. Decide whether the records belong to the client, the agency or both, and which data-protection role each party has.
• Handover at the end. When the client moves to another agency, the audit trail should go with the campaigns, as an export, not as a folder of screenshots.

Worked example: auditing a 30-post campaign

The agency from the introduction audits its spring campaign for the cosmetics client. All figures are illustrative.

The campaign had 12 creators and 30 posts: 18 Reels, 6 TikToks and 6 Story sets. Six records per post gives 180 evidence items. The client plans to boost 4 of the posts as paid ads.

Result: 165 of 180 evidence items complete, or 91.7%. That sounds good, but the audit is a chain, not an average. Five posts (the three unchecked Story sets and the two late-label Reels) cannot pass the disclosure question, and three planned ads would run without a licence. Those eight gaps are where the risk sits, and every one was cheaper to prevent at draft stage than to fix now.

The compliance checklist by campaign stage

Use this as the working checklist. Each line produces one of the six records.

Before the campaign

1. Put the label rule in the brief: "Publicidad" or "Publi" at the start, in the language of the post, plus the brand handle and required hashtags.
2. Send the contract before any product or money moves, with the label duty, the rights scope and paid ads as a separate yes or no.
3. Confirm the contract is signed before you accept the first draft.

During the campaign

4. Require a draft for every deliverable, Stories included.
5. Check each draft for label text, label position, handle and hashtags. Log the result and your comments.
6. Record the live URL on the publish day, capture Stories frame by frame, and compare the live caption with the approved one.
7. If a live post fails, send the correction request in writing the same day and keep the reply.

After the campaign

8. Match each payment to its deliverable and attach the invoice or payout statement.
9. Check the licence scope against every place the client plans to reuse the content.
10. Export the full log per campaign and store it for the agreed retention period.

How cyrqle helps

cyrqle does not decide whether a post is legal, but it keeps most of the six records in one place, per creator, as the campaign runs. In Campaigns, each creator's brief, offer, contract, drafts and live posts sit in the same thread.

• Signed contract with a frozen terms snapshot. Each creator signs the Creator Collaboration Agreement by two-sided e-signature. When you generate the signing link, the agreed terms and T&Cs are frozen, so the creator signs exactly what you locked, and a later template edit does not change past contracts. Signer IP, device and timestamp are recorded. You can link your client's brand terms, which is where the code-compliance clause belongs.
• Draft approval with hashtag and handle checks. With draft sign-off on, you approve or request changes on each draft, and cyrqle checks the caption for the required hashtags and handles from the brief. Add your exact label, such as #publi, to the required hashtags so a missing label is flagged by name. The check confirms the text is present; it does not judge position or language, so a reviewer still confirms the label comes first.
• Live posts on Instagram and TikTok. Published posts are tracked with views and engagement, which gives you the URL and the date. Stories are not tracked automatically, so capture them by hand.
• Agreements page with status. Contracts and content-rights licences appear on the Agreements page with their status (Active, Expired, Revoked), their origin and a PDF. Campaign contracts grant content-wall and campaign use, and paid-ads use only if you ticked it on the offer.
• Payout records. In Compensation and contracts, a payout is scheduled when the creator delivers and a person triggers settlement. Each payout shows the split (creator net, platform commission, agency fee, tax withheld) with a statement or invoice. Creators in Europe and the US are paid through Stripe Connect in EUR; elsewhere the brand pays by bank transfer and records it.

For agencies, the agency console lets you run each client's campaigns inside that client's workspace with Act As, with per-member access per client. Changes made through Act As are recorded under your agency's account in the audit log. Reports exports the Campaign report as a white-label PDF or CSV for the client file, with creator fees hidden if you choose. To see the chain on a real campaign, book a 30-minute demo.

FAQ

What should an influencer campaign compliance checklist include?

At minimum, six records per post: the signed contract, the approved draft, the disclosure check on draft and live post, the rights licence, the published URL with a capture, and the payment record. Add the brief with the label rule and any correction requests, because those are the instructions the AUTOCONTROL code's liability defence relies on.

Is the agency liable if a creator forgets the "Publicidad" label?

It can be. Norm 12 of the AUTOCONTROL code says liability can reach everyone involved in the commercial communication, and norm 1 names influencer and advertising agencies among the parties it binds. The defence is proof that the creator broke clear instructions in a one-off way, so keep the brief, the draft comments and the written correction request.

Do Instagram Stories need the same records?

Yes, and they are the most common gap. A Story set is advertising on the same terms as a Reel, but it disappears after 24 hours. Ask for a draft, check every frame for the label, and capture each frame on the publish day.

Can the client keep the audit trail instead of the agency?

Yes, if you agree it in writing. Many agencies keep the working records during the campaign and hand a full export to the client at the end. Decide who keeps what, the retention period and each party's data-protection role in the agency contract.

How often should an agency audit its campaigns?

Check each post as it goes live, and run a full audit at campaign close, before the final report goes to the client. A sample audit across clients every quarter catches process drift, such as a team that stopped asking for Story drafts.

Sources

• AUTOCONTROL, aea and IAB Spain, Código de Conducta de Publicidad a través de Influencers, version in force from 1 October 2025, norms 1, 3, 6 and 12.
• Ley 3/1991, de 10 de enero, de Competencia Desleal, article 26.
• Real Decreto de 22 de agosto de 1885, Código de Comercio, article 30.
• Ley 58/2003, de 17 de diciembre, General Tributaria, article 66.
• Regulation (EU) 2016/679 (GDPR), articles 5 and 7.