Under PECR, you can't send marketing emails or texts to individuals in the UK without their specific consent. The one exception is the soft opt-in for your own existing customers about similar products or services, as long as you offered an opt-out when you collected their details and in every message. You can email companies without consent, but sole traders count as individuals.
PECR is the Privacy and Electronic Communications Regulations, and it sits alongside UK GDPR. GDPR covers how you handle personal data. PECR covers the specific act of sending marketing by email, text, phone and similar channels, and the ICO enforces it.
Here's what the rules mean in practice for a small business building an email list.
What counts as electronic mail
The ICO gives electronic mail a deliberately broad meaning. The same rules apply to:
- emails
- texts and picture or video messages
- voicemails
- direct messages on social media
- any similar message stored electronically until the person collects it
That social media point surprises people. A marketing DM on LinkedIn or Instagram falls under the same rule as a marketing email.
When you can email or text individuals
| Situation | Can you send marketing? |
|---|---|
| They ticked an opt-in box for your emails | Yes, that's specific consent |
| They're an existing customer and you offered an opt-out at sign-up and in every message | Yes, under the soft opt-in, for similar products or services |
| You got their address from a list you bought or were given | No, the soft opt-in doesn't cover new contacts |
| They're a sole trader or in some partnerships | Treat them as an individual, so consent or soft opt-in only |
| They've unsubscribed or asked you to stop | No |
How the soft opt-in works
The ICO describes the soft opt-in as the rule for existing customers. If someone has taken a product or service from you, or talked to you about one, gave you their details and didn't opt out, they're probably happy to hear about similar things from you. Three conditions all have to be true:
- They're your own customer, or were in a real conversation with you about a product or service. Contacts from bought-in lists don't count.
- You're marketing your own similar products or services.
- You gave them a clear, simple way to opt out when you first collected their details, and you give one in every message.
It doesn't cover prospective customers, and it doesn't cover non-commercial promotions such as charity fundraising or political campaigning. If you've been tempted by a ready-made list, read the rules on bought email lists in the UK first.
Emailing businesses (B2B)
You can send marketing emails or texts to corporate bodies, meaning companies, Scottish partnerships, limited liability partnerships and government bodies, without prior consent. The ICO still calls it good practice, and good business sense, to keep a do-not-email list of businesses that object and screen new lists against it.
Two catches. Sole traders and some partnerships are treated as individuals, so the consent rules apply to them. And when you email a named person at a company, such as firstname.lastname at their domain, data protection law still applies to that personal data. Our guide to GDPR for outreach teams covers that side.
Is there an email version of the TPS?
No. The ICO says there's no central opt-out register for emails or texts, because you should only be sending them with consent or after offering an opt-out. So there's nothing to screen against except your own unsubscribe list, and that list has to be kept.
Viral and refer-a-friend campaigns
If you ask people to forward your marketing email, or to give you their friends' details, you're instigating that message, so PECR still applies to you. The ICO advises against collecting friends' details for marketing, because you can't be sure the friends agreed. A customer forwarding your email on their own, without you encouraging it, isn't your responsibility. If you want referrals, ask happy customers to tell people about you in their own words instead.
The newer Act changed how PECR is enforced, and my guide to the Data (Use and Access) Act explains how.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
What PECR doesn't cover
The ICO says PECR doesn't set specific rules for other types of online marketing, such as display or banner ads. There are separate PECR rules on cookies, which are often used to profile people for targeted ads. And whenever you use personal data for marketing, the Data Protection Act and UK GDPR apply as well, so a compliant email still needs a lawful, well-kept list behind it.
Organisations that handle personal data may also have to settle the ICO data protection fee.
Your PECR checklist
- Only send marketing emails or texts with consent, or under the soft opt-in for your own similar products.
- Put an unsubscribe link or reply opt-out in every message and act on it promptly.
- Keep a do-not-contact list and screen every send against it.
- Never hide who you are. Use a real sender name and a valid contact address.
- Don't ask people to forward your emails or hand over friends' details.
- Record when and how each person signed up, so you can show consent if asked.
My take: PECR is a marketing gift in disguise. A list of people who chose to hear from you opens, clicks and replies far more than one you scraped. Build the list the slow, compliant way and it'll outperform a bought one every time.
Whichever platform sends the messages, consent comes first, so our comparison of customer engagement platforms flags the consent rule to settle before you build.
Frequently asked questions
What does PECR say about email marketing?
You need specific consent to send marketing emails or texts to individuals, unless the soft opt-in applies to your own existing customers for similar products or services.
What is the soft opt-in under PECR?
It lets you email your own customers about similar products or services without fresh consent, if you offered an opt-out when you collected their details and in every message.
Can I send B2B marketing emails without consent?
Yes, to companies, LLPs, Scottish partnerships and government bodies. Sole traders and some partnerships count as individuals, so consent rules apply to them.
Does PECR apply to LinkedIn and Instagram DMs?
Yes. The ICO says direct messages on social media fall under the same electronic mail marketing rules.
Is there a do-not-email register in the UK?
No. The ICO says there's no email or text version of the TPS, so you must keep and screen against your own opt-out list.
Can I ask customers to forward my emails to friends?
The ICO advises against it. Encouraging people to forward your marketing means you're instigating the message, so PECR applies to you.
