Privacy and Electronic Communications Regulations

Electronic mail marketing

'Electronic mail' under PECR includes emails, SMS text messages, picture messages, voicemail drops, in-app messages, and direct messages over social media — not just email.

Default rule: You need prior consent before sending marketing electronic mail to individual subscribers. Consent must be freely given, specific, informed, and unambiguous (the UK GDPR standard). Pre-ticked boxes are not valid consent.

The soft opt-in exception: You can send marketing without consent if all four conditions are met:

1. Contact details were obtained during your sale or genuine negotiation for a sale
2. Marketing is for your similar products or services only
3. An opt-out opportunity was given when details were first collected
4. A simple opt-out mechanism is included in every subsequent message

Soft opt-in does not apply to third-party marketing lists, contacts from competitions or free services, or automated calling systems.

Corporate vs individual subscribers

PECR consent requirements only apply to individual subscribers. Corporate subscribers have fewer protections.

Corporate subscribers (less restricted) include limited companies (Ltd), public limited companies (plc), LLPs, Scottish partnerships, and government bodies.

Individual subscribers (consent or soft opt-in required) include sole traders, ordinary partnerships (non-LLP), unincorporated associations, and named individuals at any type of organisation.

Practical test: An email to info@company.com at a limited company is a corporate subscriber. An email to jane.smith@company.com is an individual subscriber regardless of the company type. When in doubt, treat the recipient as an individual.

Even for corporate subscribers, you must identify yourself, provide a valid opt-out mechanism, and comply with UK GDPR if processing personal data.

Telephone marketing

Live marketing calls operate on an opt-out basis (unlike electronic mail which is opt-in). You can make live marketing calls without consent, but you must not call:

• Numbers registered on the TPS (Telephone Preference Service) for 28 days or more — unless the subscriber has given specific consent to your calls
• Numbers registered on the CTPS (Corporate Telephone Preference Service)
• Anyone who has previously asked you not to call them

You must screen your call lists against TPS and CTPS registers at least every 28 days.

Automated calls (robocalls): Prior consent specifically for automated calls is always required. General marketing consent or consent for live calls is not sufficient. Soft opt-in does not apply.

Cold calling bans: Claims management services (since 2018) and pension calls (since 2019) require consent — TPS screening alone is not sufficient.

Cookies and tracking technologies

You need prior consent before setting non-essential cookies or using similar tracking technologies (web beacons, pixels, local storage, device fingerprinting) on user devices.

Strictly necessary cookies are exempt — these include shopping baskets, authentication sessions, security tokens (CSRF), and cookie consent preference cookies themselves.

DUAA 2025 new exemptions (phased from June 2025 to June 2026):

• Statistical/analytics: Permitted without consent if you provide clear information and an easy opt-out
• Functionality/appearance adaptation: Language preferences, dark mode — permitted with information and opt-out
• Emergency assistance: Location identification for emergency services

Advertising, targeting, and cross-site tracking cookies always require consent. Accept and Reject buttons must be equally prominent — no dark patterns. Cookie consent must be obtained before non-essential cookies are set.