Journey

Marketing compliance: PECR and UK GDPR

Learn how to send compliant marketing emails, texts, and make telephone calls. Covers PECR consent rules, the soft opt-in exception, TPS screening, cookie consent, and the increased penalties from 5 February 2026.

Running a Business Updated 15 September 2026

7 milestones references 5 guides

Why marketing compliance matters

Electronic marketing is one of the most heavily regulated areas of business communication. The Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR work together to protect people from unwanted marketing. Get it wrong and the Information Commissioner's Office (ICO) can fine you up to 17.5 million pounds.

This learning path covers the essential rules for email, text, telephone marketing, and website cookies.

Electronic marketing rules (PECR): the complete guide

Understand the full PECR framework before diving into specific channels. Covers consent requirements, soft opt-in, telephone screening, and ICO enforcement powers.

Understand email and text marketing rules
PECR treats email and SMS the same way. For individuals and sole traders, you need consent unless the soft opt-in exception applies. For companies and LLPs, the rules are more relaxed but you must still respect objections.
PECR electronic marketing rules

These are the core rules that apply to all electronic marketing. Note the distinction between individual subscribers (consent required) and corporate subscribers (no consent required).
The Privacy and Electronic Communications Regulations 2003 (PECR) set specific rules for electronic marketing. Non-compliance is a common cause of ICO enforcement action, with fines now aligned with UK GDPR levels following the Data (Use and Access) Act 2025.

Email marketing (B2C)

Consent required unless soft opt-in applies

SMS/text marketing

Same rules as email - consent required unless soft opt-in applies

Email to corporate subscribers

Consent not required for companies, LLPs, or government bodies

Live telephone calls

Must screen against TPS/CTPS; cannot call if person has objected

Automated calls (robocalls)

Prior consent always required - no exceptions

TPS screening frequency

At least every 28 days

Legislation

Privacy and Electronic Communications Regulations 2003

Soft opt-in exception (4 conditions)

You can email existing customers without consent if ALL four conditions are met:

Contact details obtained during a sale or negotiations for a sale

Marketing is for YOUR similar products or services only

Opt-out opportunity given when details were collected

Easy opt-out provided in every subsequent message

Soft opt-in does NOT apply to: third-party marketing lists, details obtained outside sale context, or dissimilar products/services.

Electronic mail definition

Email, SMS, video messages, picture messages, voicemails, in-app messages, and direct messages over social media

Individual subscribers

Includes sole traders and ordinary partnerships (2-20 partners)

Corporate subscribers

Limited companies, LLPs, Scottish partnerships, government bodies

B2B email marketing

Consent rules do not apply to corporate subscribers - but respect objections

Telephone marketing requirements

Live calls: You can make live marketing calls without consent if the number is not on TPS/CTPS and the person has not objected to your calls. You must display caller ID and provide contact details if asked.

TPS/CTPS screening: Before making any marketing calls, screen your call list against both the Telephone Preference Service (TPS) and Corporate TPS (CTPS) registers. Screening must be done at least every 28 days.

Automated calls: Always require prior consent. General marketing consent is not sufficient - you need specific consent for automated calls.

Claims management cold calls

Banned without prior consent (since September 2018)

Pension cold calls

Banned except for FCA-authorised firms with existing relationship (since January 2019)

Fax marketing to individuals

Consent required; must screen against FPS

Fax marketing to businesses

No consent required but must screen against FPS and respect objections

Required information in marketing communications

Sender identity must not be disguised or concealed

Valid contact address for opt-out requests must be provided

Simple and effective unsubscribe mechanism in every message
Email marketing compliance guide

Detailed guidance on compliant email marketing, including consent wording, unsubscribe mechanisms, and record-keeping requirements.
The soft opt-in exception
Soft opt-in lets you email existing customers without explicit consent, but only if you meet four strict conditions. All four must apply - fail any one and you need consent.
- Sale context: You obtained their details during a sale or negotiations
- Similar products: You are marketing your own similar products or services
- Opt-out given: You offered an opt-out when collecting details
- Easy unsubscribe: Every message includes a simple opt-out
Soft opt-in never applies to purchased lists or contacts obtained outside a sale context.
Take note

Common mistake: Assuming newsletter sign-ups qualify for soft opt-in. They do not - soft opt-in only applies to contacts obtained during a sale or sale negotiations.
Telephone marketing and TPS screening

Live marketing calls have different rules to emails. You do not need consent, but you must screen against the Telephone Preference Service (TPS) and Corporate TPS (CTPS) at least every 28 days. Never call anyone who has asked not to be called.

Automated calls (robocalls) are different - you always need specific prior consent.

Guv’s take

Sector-specific bans: Claims management and pension cold calls are banned except in limited circumstances. If your business operates in these areas, you need explicit consent before calling.
Cookies and website tracking
PECR also covers cookies and similar tracking technologies. Most cookies require consent before you set them. Strictly necessary cookies (essential for your site to work) are exempt, but analytics and marketing cookies are not.
Cookie consent requirements

The rules apply to all technologies that store or access information on a user's device - not just cookies but also pixels, local storage, and fingerprinting.
The Privacy and Electronic Communications Regulations 2003 (PECR) require consent before setting non-essential cookies.

Consent requirements:

Clear and comprehensive information about cookies

Genuine choice - no "cookie walls" forcing acceptance

Easy to withdraw consent

No pre-ticked boxes

Exempt cookies:

Strictly necessary for the service (e.g., shopping cart)

Enabling user-requested functionality

Analytics cookies, advertising cookies, and social media cookies require consent.
Cookie consent compliance

How to implement compliant cookie consent, including banner design, consent management platforms, and the strictly necessary exemption.
Privacy notices for marketing

Your privacy notice must explain how you use personal data for marketing. People have the right to object to direct marketing at any time, and you must make it easy for them to do so.

Write a compliant privacy notice

How to write a privacy notice that covers your marketing activities, including what to say about third-party sharing, profiling, and automated decision-making.
Penalties for getting it wrong
PECR penalties were dramatically increased by the Data (Use and Access) Act 2025. From 5 February 2026, fines align with UK GDPR levels. The ICO actively enforces PECR - marketing violations are one of their most common enforcement areas.
PECR enforcement and penalties

The ICO issued over 10 million pounds in PECR fines between 2019 and 2025. With the new penalty regime, fines will be significantly higher.
PECR penalties were significantly increased by the Data (Use and Access) Act 2025, aligning them with UK GDPR levels. The ICO actively enforces PECR, with marketing violations being one of the most common enforcement areas.

Maximum penalty (from 5 February 2026)

17.5 million GBP or 4% of annual worldwide turnover, whichever is higher

Previous maximum (pre-2025)

500,000 GBP

Enforcement regulator

Information Commissioner's Office (ICO)

Director liability

Directors may be personally liable for penalties

ICO enforcement (2019-2025)

119 monetary penalty notices totalling approximately 10.5 million GBP

Average fine (historical)

94,490 GBP

2024 enforcement

15 fines totalling approximately 1.6 million GBP

ICO enforcement powers

Enforcement notices: Orders to stop unlawful processing

Monetary penalty notices: Fines up to the maximum

Stop notices: Immediate cessation orders

Assessment notices: Compulsory audit powers

Information notices: Require provision of information
Take note

Director liability: Directors can be personally liable for PECR fines if the breach is attributable to their consent, connivance, or neglect. This is not just a company risk.
Getting consent right under UK GDPR

When you do need consent, it must meet UK GDPR standards: freely given, specific, informed, and unambiguous. Pre-ticked boxes do not count. Bundled consent (tying marketing to a service) does not count. People must take clear affirmative action.

UK GDPR lawful bases

Consent is just one of the lawful bases. For direct marketing to individuals, it is usually the only option unless soft opt-in applies.

Under UK GDPR Article 6, you must have a valid lawful basis to process personal data. You cannot process personal data without identifying at least one lawful basis that applies to each processing activity.

1. Consent (Article 6(1)(a))

The individual has given clear, specific, informed consent for you to process their personal data for a specific purpose

2. Contract (Article 6(1)(b))

Processing is necessary to fulfil a contract with the individual, or to take steps at their request before entering a contract

3. Legal obligation (Article 6(1)(c))

Processing is necessary to comply with a common law or statutory obligation under UK law

4. Vital interests (Article 6(1)(d))

Processing is necessary to protect someone's life

5. Public task (Article 6(1)(e))

Processing is necessary for performing a task in the public interest or for official functions that have a clear basis in law

6. Legitimate interests (Article 6(1)(f))

Processing is necessary for your legitimate interests or those of a third party, unless overridden by the individual's interests, rights, or freedoms

Consent requirements: Must be freely given, specific, informed, and unambiguous. Must be as easy to withdraw as to give.

Legitimate interests: Requires a documented Legitimate Interest Assessment (LIA) balancing test. Not available to public authorities for their core tasks.

7. Recognised legitimate interests (NEW - from February 2026)

Processing necessary for certain pre-approved purposes without requiring a balancing test (Data (Use and Access) Act 2025)

Recognised purposes include

National/public security, defence, emergencies, crime prevention/detection, safeguarding vulnerable individuals

Effective date

5 February 2026

Note: Direct marketing and intra-group data sharing still require a Legitimate Interest Assessment even under recognised legitimate interests.

ICO guide to lawful basis (opens in a new tab)

Data protection for businesses

Comprehensive guide to UK GDPR compliance, including the consent requirements that apply when soft opt-in is not available.

You have completed this learning path

You now understand the key rules for compliant marketing under PECR and UK GDPR. The essential points:

Email and SMS to individuals require consent unless soft opt-in applies
Email to companies and LLPs does not require consent but respect objections
Screen telephone lists against TPS and CTPS every 28 days
Automated calls always require specific prior consent
Most cookies need consent before being set
Penalties can reach 17.5 million pounds or 4% of turnover

For ongoing compliance, ensure you keep consent records, process opt-out requests promptly, and review your practices when the law changes.

Marketing compliance: PECR and UK GDPR

Why marketing compliance matters

Electronic marketing rules (PECR): the complete guide

Understand email and text marketing rules

Email marketing compliance guide

The soft opt-in exception

Telephone marketing and TPS screening

Cookies and website tracking

Cookie consent compliance

Privacy notices for marketing

Write a compliant privacy notice

Penalties for getting it wrong

Getting consent right under UK GDPR

Data protection for businesses

You have completed this learning path

Related journeys

Meet your data protection obligations

Data protection compliance checklist

Prepare for the Data Use and Access Act 2025 changes

Run a tech business