Electronic marketing rules (PECR)

The Privacy and Electronic Communications Regulations 2003 (PECR) set the rules for electronic marketing in the UK. They work alongside UK GDPR and the Data Protection Act 2018.

PECR covers:

• Marketing emails and text messages
• Live and automated marketing calls
• Fax marketing
• Cookies and similar technologies

The Information Commission (formerly the ICO) enforces these rules. From 5 February 2026, under the Data (Use and Access) Act 2025, fines for marketing breaches can reach £17.5 million or 4% of annual worldwide turnover, whichever is higher.

Email and text message marketing

PECR Regulation 22 covers all 'electronic mail' - this includes:

• Emails
• Text messages (SMS)
• Picture and video messages (MMS)
• Voicemails left by automated systems
• In-app messages
• Direct messages on social media platforms

The basic rule is simple: you need consent before sending marketing messages to individuals. There is one key exception - the 'soft opt-in' for existing customers.

Who counts as an individual

PECR's consent rules apply to messages sent to individual subscribers:

• Individuals at their personal email address or phone number
• Sole traders
• Partnerships that are not limited liability partnerships or Scottish partnerships
• Other unincorporated bodies of individuals

The rules apply to generic or role-based addresses too, such as an info@ or sales@ address at a sole trader's business.

Marketing to companies

Corporate subscribers are organisations with their own legal personality, such as limited companies, LLPs, Scottish partnerships and some government bodies. An employee's work email address or phone number at one of these counts as a corporate subscriber's, because the subscriber is the employer.

You can send marketing emails and texts to corporate subscribers without consent or a soft opt-in. Every message must still name you honestly and give a valid address where the recipient can ask you to stop.

Keep a do-not-email list of any business that opts out, and screen new business lists against it. If you hold a named contact's details, UK GDPR also applies: you need a lawful basis, you must tell them how you use their details, and you must stop marketing to them if they object.

Getting valid consent

Consent for marketing must meet the UK GDPR standard. The person must have a genuine choice, so do not bundle marketing consent with other terms or make it a condition of service. Be specific about what you are asking for, because general consent to 'contact you' is not enough. Tell people who will send the messages and what kind of marketing to expect. They must give consent by a clear positive action, so pre-ticked boxes do not count.

Your UK GDPR lawful basis

PECR decides whether you may send the message. UK GDPR decides how you may use the personal data behind it, so you need to meet both.

If you have consent that meets PECR, consent is also your lawful basis under UK GDPR. If you rely on a soft opt-in, your lawful basis is likely to be legitimate interests. Carry out and record a legitimate interests assessment that sets out your purpose, why using the data is necessary and how you balanced your interest against the person's.

People have an absolute right to object to direct marketing. If someone objects, you must stop using their personal data for marketing. Tell people about this right clearly and separately from other information, at the latest in your first message to them.

The soft opt-in exception

You can send marketing messages to existing customers without fresh consent if you meet all four conditions of the 'soft opt-in' (Regulation 22(3)).

1. You collected their contact details during a sale, or negotiations for a sale, of your products or services.
2. You market only your own similar products or services, which the person would reasonably expect from you.
3. You gave them a simple, free way to opt out when you first collected their details.
4. Every later marketing message gives them an easy way to opt out.

All four conditions must be met. If any is missing, you need proper consent.

When soft opt-in does not apply

• You cannot use soft opt-in for contacts you bought or obtained from another business. It must be your sale.
• Signing up for a free newsletter is not a sale or negotiation unless it leads to an actual sale discussion.
• Entering a competition is not a sale context.
• You cannot use it to market unrelated products. For example, an insurance company cannot use it to market completely different financial products.
• You cannot use soft opt-in to market other companies' products.

Charity soft opt-in (from 2026)

The Data (Use and Access) Act 2025 extends soft opt-in to charities. From 5 February 2026 (SI 2026/82), charities can use soft opt-in for marketing about their charitable purposes to people who have previously shown interest or support.

You can only use it for contact details you collected yourself on or after 5 February 2026, and every message must offer a simple, free way to opt out.

What every marketing message must include

PECR Regulations 23 and 24 require every marketing message to name you honestly, so the recipient can tell who sent it, and to give a valid address where they can contact you. Every message must also include a simple, free way to opt out, and you must honour opt-outs promptly.

Live telephone marketing

PECR Regulation 21 allows live marketing calls without consent, but with important restrictions. You must screen your call lists against preference services and respect individual objections.

• Do not call numbers registered with the Telephone Preference Service (TPS) unless the person has specifically agreed to calls from you.
• For business numbers, also screen against the Corporate Telephone Preference Service (CTPS).
• Screen your call lists at least every 28 days. TPS registrations take effect 28 days after registration.
• Display your telephone number or another contact number. Withholding your number is a breach.
• If asked, give your name, address and telephone number.

Automated calling systems

PECR Regulation 19 imposes strict rules on automated calls (robocalls) - recorded messages or systems that play pre-recorded content.

You need consent specifically for automated calls. General marketing consent, or consent to live calls, is not enough. Every automated call must identify the caller, give a Freephone number or valid contact address, and display your telephone number.

Cold calling bans

Some types of cold calling are banned unless you have specific consent:

• Since September 2018, cold calls about compensation claims, such as PPI, personal injury or financial mis-selling, are banned without prior consent that meets GDPR.
• Since January 2019, cold calls about pensions are banned unless you are an FCA-authorised firm or a pension trustee with an existing relationship and consent.

Fax marketing

Fax marketing is rare, but the rules still apply. You need consent before you fax individuals and sole traders. You do not need consent to fax companies, unless they have told you not to. Do not fax numbers registered with the Fax Preference Service unless the subscriber has agreed, and include your name and a contact address or Freephone number.

Enforcement powers

The Commission actively enforces PECR, as the Information Commissioner's Office did before 30 September 2026. Between 2019 and September 2025, the ICO issued 119 monetary penalty notices for PECR breaches, totalling approximately £10.5 million.

The regulator can also issue enforcement notices ordering you to stop unlawful marketing immediately, and assessment notices for compulsory audits of your marketing practices. Directors may be personally liable for penalties in serious cases.

The regulator regularly publishes enforcement action on its website. Common triggers for investigation include:

• High volumes of complaints about nuisance calls or texts
• Marketing without valid consent or soft opt-in
• Failing to screen against TPS/CTPS
• No or broken unsubscribe mechanisms
• Using third-party marketing lists without proper consent