Email marketing in the UK: consent, PECR and the soft opt-in

If you send marketing emails to people in the UK, two sets of rules apply at once. The Privacy and Electronic Communications Regulations (PECR) decide whether you may send the email at all. UK GDPR covers the personal data behind it and sets the standard that consent must meet. This guide walks through both, using guidance from the Information Commissioner’s Office (ICO), the UK regulator.

This is general information, not legal advice. Several ICO pages carry a note that, “due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change”, so check the current pages before relying on any detail.

The basic rule for emails to individuals

PECR reaches beyond email. The ICO applies the same rules to texts, picture and video messages, voicemails and direct messages on social media.

For individuals, the ICO states the starting point plainly: “you must not send marketing emails or texts to individuals without specific consent.” The one exception is the soft opt-in, covered below. Whichever route you use, two further rules apply to every marketing email:

• You must not disguise or conceal your identity.
• You must give a valid contact address so people can opt out or unsubscribe.

Sole traders and some partnerships count as individuals under these rules, even though you may think of them as businesses.

What counts as consent

PECR takes its consent standard from UK GDPR. Consent must be a “freely given, specific, informed and unambiguous indication” of the person’s wishes, given “by a statement or by a clear affirmative action”. The ICO’s guidance turns that into practical tests:

• It needs a positive action. Pre-ticked boxes, silence and inactivity do not count.
• It must cover the channel. A general yes to “marketing” is not enough, so ask separately for email and for text.
• It must be given to you. The request has to name your organisation. On bought-in lists, the ICO says: “If the consent doesn’t name you or does not cover the method you intend to use, then it is not valid.”
• It must be freely given. Making marketing a condition of buying something is unlikely to produce valid consent.
• It should be unbundled from your terms and conditions.
• It must be easy to withdraw at any time, and people should be told how.

Consent is tied to the address the person gave you and does not carry over to other addresses they use. Contact details that happen to be public do not imply consent either.

The soft opt-in for existing customers

The soft opt-in lets you email individuals without consent, but only when every condition is met. The ICO’s conditions are:

1. You collected the contact details directly from the person. In the ICO’s words, “There is no such thing as a third-party marketing list that is compliant with the soft opt-in.”
2. You collected them during a sale or negotiations for a sale. Someone who asked for a quote or signed up for a free trial can qualify. Someone who only browsed your site cannot.
3. You market only your own similar products or services.
4. You gave a simple chance to opt out when you collected the details. An opt-out hidden in a privacy policy, or added later in a confirmation email, does not meet this condition.
5. You offer an opt-out in every message after that.

The soft opt-in does not cover new prospects, bought-in lists or “refer a friend” schemes. Any organisation can use it for products and services, but charities cannot use it for fundraising or campaigning. For that, the ICO’s guidance describes a separate charitable purposes soft opt-in which, it says, “commenced on 5 February 2026” and only applies to details collected on or after that date. The ICO’s page on this change explains that section 114 of the Data (Use and Access) Act 2025 adds it to PECR.

Emailing businesses

For business-to-business email, the rules depend on who receives it. The ICO splits recipients into two groups.

Three caveats stop this from being a free-for-all:

• You must still identify yourself and give a valid address for opting out.
• If a corporate subscriber asks you to stop, the ICO’s view is that you should, even though PECR does not expressly require it. Keep a “do not email” list of businesses that object and screen new lists against it.
• An email to a named person, such as firstname.lastname@company.co.uk, involves personal data. The ICO says “the UK GDPR still applies to B2B marketing if you are processing personal data”, and that person has an absolute right to stop their data being used for direct marketing. Once they object, you must stop.

If you cannot tell whether a recipient is a corporate or an individual subscriber, the ICO advises treating them as an individual.

What an unsubscribe must do

The ICO’s guidance sets out what an opt-out has to achieve:

• It must be simple, such as a clear unsubscribe link or a reply option. People should not have to create an account or log in to unsubscribe.
• It must be free, apart from the normal cost of sending the message.
• You must act on it promptly and add the person to a suppression list that you check before every send.
• It must appear in every marketing message, whether you rely on consent or the soft opt-in.

An opt-out usually applies to the channel it came through, unless your wording makes clear it covers all marketing. Do not simply delete people who unsubscribe. The ICO advises keeping records of objections so you can screen them out of future lists.

Keeping records

You need to be able to show that consent exists. The ICO says you should keep a record of who consented, when and how. It also helps to store the wording of the form they saw and the channels they agreed to.

For soft opt-in contacts, note the sale or negotiation the details came from. Keep your suppression list up to date. And remember that using an email platform does not hand over responsibility: PECR applies to whoever sends or instigates the marketing.

A practical checklist

1. Sort your list into consent, soft opt-in, corporate subscriber and unknown.
2. Treat anyone unknown as an individual until you know otherwise.
3. Check every sign-up form: no pre-ticked boxes, channels asked about separately, your organisation named.
4. Add an opt-out at checkout and on quote forms for soft opt-in contacts.
5. Show who you are and include a working unsubscribe link in every email.
6. Process unsubscribes promptly and screen every send against the suppression list.
7. Stop using bought-in lists unless the consent names you and covers email.
8. Store who consented, when and how.

The rules are being updated, so read the ICO’s current guidance before a major campaign and take legal advice if you are unsure.