# How to Grow an Email List Legally in the UK

Source: https://dijitulmarketing.co.uk/guides/how-to-grow-an-email-list-legally-uk/
Updated: 2026-10-18

> Grow an email list legally in the UK by collecting clear, opt-in consent or using the soft opt-in for customers, recording how each person joined, and never buying lists. dijitul builds compliant sign-up forms, lead magnets and welcome flows, and runs email marketing from £95 a month + VAT on Mailchimp, Klaviyo or Brevo.

## Key facts

- PECR requires consent, or the soft opt-in, before sending marketing emails or texts to individual subscribers
- The soft opt-in covers people who bought or negotiated to buy from you, for similar products, if they were given a chance to opt out
- The Data (Use and Access) Act 2025 added a charitable purpose soft opt-in to PECR regulation 22(3A) (ICO)
- Consent boxes must be unticked by default and separate from accepting terms
- Keep a record of when, where and how each subscriber joined
- dijitul email marketing is from £95 a month + VAT; automation set-up is from £195 + VAT

## The rules in plain English

Two sets of rules apply. The Privacy and Electronic Communications Regulations (PECR) control sending marketing by email and text. UK GDPR controls how you handle the personal data itself.

Under PECR, to email marketing to an **individual** (including sole traders and some partnerships) you need either:

- **Consent**: a clear, specific, positive opt-in, such as ticking an unticked box or typing an email into a sign-up form that says what they will receive; or
- **The soft opt-in**: they bought, or negotiated to buy, from you; you are marketing similar products or services; and they were given a simple way to opt out when you collected their details and in every message.

Every email must say who it is from and include a working unsubscribe. Our PECR guide covers the detail, including business-to-business rules.

## Sign-up points that work

- **Website forms.** In the footer, on blog posts and on a dedicated newsletter page. Say what people get and how often.
- **Pop-ups and flyouts.** Timed or on exit intent, not the instant they land. Keep them easy to close on mobile.
- **Checkout opt-in.** An unticked box at checkout. Customers who do not tick it may still be contactable under the soft opt-in, if you offered an opt-out at the time.
- **In person.** A QR code at the till, on receipts or packaging, leading to a short sign-up form.
- **Events and webinars.** Ask registrants separately if they want ongoing marketing.
- **Social.** A link in your bio and occasional posts promoting the newsletter.

## Give people a reason to join

"Sign up for our newsletter" rarely works. Offer something specific:

- A first-order discount or free delivery, for shops.
- A useful download: a checklist, price guide or buyer's guide.
- Early access to sales, new stock or event tickets.
- A short email course, such as five days of tips.

Be clear that joining means receiving marketing, not just the freebie. If someone downloads a guide without agreeing to marketing, you can send the guide but not your newsletter.

## What not to do

- **Buy or rent lists.** The people on them have not consented to hear from you. You also risk spam traps, complaints and blocked domains.
- **Pre-tick boxes** or bundle consent into terms and conditions.
- **Add business cards or enquiry contacts** to your newsletter without permission. An enquiry is not marketing consent.
- **Scrape emails** from websites or social profiles.
- **Hide the unsubscribe**, or make people log in to leave.

The ICO, which enforces PECR, says the Data (Use and Access) Act 2025 gives it power to fine up to £17.5 million or 4% of global turnover under PECR. Shortcuts are not worth it.

## Keep good records and a healthy list

- **Record consent**: date, source form, the wording shown and IP address where available. Mailchimp, Klaviyo and Brevo store most of this if forms are set up properly.
- **Consider double opt-in.** It is not legally required in the UK, but it confirms the address is real and reduces spam traps.
- **Authenticate your domain** with SPF, DKIM and DMARC. Google's sender guidelines require bulk senders to Gmail to have all three and to support one-click unsubscribe.
- **Send a welcome series** straight away, while interest is high.
- **Clean the list** with a sunset flow for people who stop engaging.

## Charities and how dijitul helps

Charities now have their own route. The ICO says the Data (Use and Access) Act 2025 introduced a soft opt-in for charitable purposes in PECR regulation 22(3A). It lets charities email supporters who gave their details while supporting or showing interest in the charity, provided they were offered an opt-out then and in every message. See marketing for charities.

dijitul runs email marketing from £95 a month + VAT, and builds sign-up forms, pop-ups and welcome flows as part of marketing automation set-up from £195 + VAT one-off.

## FAQs

### Can I email customers who bought from me without asking?

Often yes, under the PECR soft opt-in, if you collected their details during a sale or negotiation, you only market similar products or services, and you gave them a clear chance to opt out at the time and in every email. If any of those is missing, you need consent.

### Can I add people who enquired to my newsletter?

An enquiry is not consent to marketing. If the enquiry was a negotiation towards a sale, the soft opt-in may apply, but only if you offered an opt-out when collecting their details. The safest route is to ask: an unticked newsletter box on your enquiry form.

### Is double opt-in required in the UK?

No. UK law requires valid consent, not a confirmation email. Double opt-in is still good practice: it proves the address is real, filters typos and fake sign-ups, keeps spam traps off your list and gives you a clear record of consent.

### Can I email business contacts without consent?

PECR's consent rules for email apply to individual subscribers, which include sole traders and some partnerships. Emails to employees at limited companies (corporate subscribers) do not need consent under PECR, but you must identify yourself and offer an opt-out, and UK GDPR still applies to their personal data.

### Is it legal to buy an email list in the UK?

Buying data is not illegal in itself, but sending marketing emails to individuals on a bought list almost always breaks PECR, because they did not consent to hear from you specifically. Bought lists also damage deliverability. We do not send to bought lists.

### How fast can I grow my list?

It depends on traffic and the reason you give people to join. A clear incentive, a well-timed pop-up and a checkout opt-in usually make the biggest difference. We do not promise subscriber numbers, but we track sign-up rate by form so you can see what works.

## Prices and contact

Prices (all from, + VAT; ad spend separate): Google Ads management £150 a month; Paid social (Meta, LinkedIn, TikTok) £150 a month; Social media management £125 a month; Email marketing £95 a month; Marketing automation set-up £195; SMS marketing £75 a month; GA4 set-up £95; Conversion tracking £145; Data Studio (Looker Studio) dashboard £145; Conversion rate optimisation £195 a month; Content marketing £195 a month; Consultancy, audits and strategy £45 an hour. All prices are "from" and exclude VAT. Ad spend is separate and paid directly to Google, Microsoft, Meta, LinkedIn or TikTok. Paid media management is from £150 a month or 10 to 15% of ad spend, whichever is higher. You own every ad account, pixel, audience and email list we set up. Contact: https://dijitulmarketing.co.uk/contact/ · 01623 650333 · info@dijitul.uk