# PECR and Email Marketing: The UK Rules Explained

Source: https://dijitulmarketing.co.uk/guides/pecr-and-email-marketing-rules/
Updated: 2026-10-18

> PECR is the UK law that controls marketing emails and texts. You need consent or the soft opt-in to market to individuals, must identify yourself and offer an unsubscribe in every message. dijitul runs compliant email marketing on Mailchimp, Klaviyo and Brevo from £95 a month + VAT, with consent records and opt-outs built in.

## Key facts

- PECR (the Privacy and Electronic Communications Regulations 2003) covers marketing by email, text, phone and fax, plus cookies
- Marketing emails and texts to individual subscribers need consent or the soft opt-in
- Individual subscribers include sole traders and some partnerships; corporate subscribers include limited companies
- The Data (Use and Access) Act 2025 added a charitable purpose soft opt-in in PECR regulation 22(3A) (ICO)
- The ICO can fine up to £17.5 million or 4% of global turnover under PECR (ICO, February 2026)
- dijitul email marketing is from £95 a month + VAT

## Two laws, two jobs

Email marketing in the UK sits under two pieces of law:

- **PECR** decides whether you can send electronic marketing at all, and on what basis.
- **UK GDPR** governs how you collect, store and use the personal data, including your lawful basis, privacy notice, retention and security.

You need to comply with both. The Information Commissioner's Office (ICO) enforces them. This guide is a practical summary, not legal advice: check the ICO's guidance on direct marketing using electronic mail for the detail.

One point catches many businesses out: PECR applies to the message, not the list. Even if you collected an address lawfully for one purpose, such as answering a support question, that does not by itself give you the right to send it marketing. Each marketing message needs a basis of its own.

## Who you are emailing matters

PECR treats recipients differently:

| Recipient | Examples | Rule for marketing emails and texts |

| Individual subscribers | Consumers, sole traders, some partnerships | Consent, or the soft opt-in |
| Corporate subscribers | Limited companies, LLPs, government bodies | No PECR consent needed, but you must identify yourself and give an opt-out |

Business-to-business emails to a named person at a company still involve personal data, so UK GDPR applies. Usually that means relying on legitimate interests, telling them how you got their details and honouring opt-outs immediately.

## Consent and the soft opt-in

**Consent** must be freely given, specific, informed and a clear positive action. Unticked boxes, separate from terms, saying what you will send. Keep records of who consented, when, where and to what wording.

**The soft opt-in** lets you email or text existing customers without consent if all of these apply:

- You got their details during a sale, or negotiations for a sale.
- You are marketing your own similar products or services.
- You gave them a simple chance to refuse when you collected the details.
- You give them a simple way to opt out in every message.

**Charities** now have their own version. The ICO says the Data (Use and Access) Act 2025 introduced a charitable purpose soft opt-in in PECR regulation 22(3A), for supporters who gave their details while supporting or showing interest in the charity and were offered an opt-out.

## What every marketing email needs

- **Who it is from.** Do not hide or disguise the sender.
- **A valid contact address** for opt-out requests.
- **An easy unsubscribe** that works without logging in, and is acted on promptly.
- **A suppression list**, so people who opt out are never re-added from another import.

Separately from the law, Google's sender guidelines require anyone sending more than 5,000 messages a day to Gmail addresses to authenticate with SPF, DKIM and DMARC and support one-click unsubscribe, and ask all senders to keep spam rates reported in Postmaster Tools below 0.3%. Missing these can send compliant mail to spam. See email deliverability.

## Texts, tracking and fines

**SMS** follows the same rules as email for individuals: consent or the soft opt-in, sender identified, and a way to opt out such as a STOP reply.

**Cookies and similar technology** also fall under PECR. Non-essential cookies on your website, such as advertising pixels, generally need consent. That is why sign-up forms and email tracking should be set up alongside a proper consent banner. See Consent Mode v2.

**Penalties** have risen. In February 2026 the ICO said the Data (Use and Access) Act gives it power to issue fines of up to £17.5 million or 4% of global turnover under PECR. Most of the Act's remaining data protection provisions came into force on 5 February 2026, according to the ICO.

## How dijitul keeps campaigns compliant

Our email marketing service, from £95 a month + VAT, includes consent-based sign-up forms, separate SMS consent, suppression lists, unsubscribe checks and domain authentication. We never send to bought lists. SMS marketing is from £75 a month + VAT. For growing a list properly, read how to grow an email list legally.

## FAQs

### Does PECR apply to B2B emails?

PECR's consent rule for marketing emails applies to individual subscribers, including sole traders and some partnerships. Emails to people at limited companies and other corporate bodies do not need PECR consent, but you must identify yourself and offer an opt-out. UK GDPR still applies to their personal data.

### What is the soft opt-in?

An exception that lets you email or text existing customers without explicit consent if you got their details during a sale or negotiation, you market similar products or services, and you gave them a chance to opt out at collection and in every message. Since the Data (Use and Access) Act 2025, charities have their own version.

### What are the fines for breaking PECR?

In February 2026 the ICO said the Data (Use and Access) Act gives it power to fine up to £17.5 million or 4% of global turnover under PECR, bringing PECR penalties into line with UK GDPR. The ICO also publishes enforcement action against companies that send unlawful marketing.

### Do I need consent to send a newsletter?

If it promotes your products, services or aims, it counts as marketing. To individuals you need consent or the soft opt-in. Purely service messages, such as order confirmations or changes to terms, are not marketing, but do not slip promotions into them.

### How long does consent last?

PECR does not set a fixed expiry, but the ICO expects consent to be reviewed and refreshed where appropriate. If someone has not heard from you for a long time, their consent may no longer reflect their wishes. A re-permission or sunset campaign keeps your list current.

### Is PECR changing?

It already has. The Data (Use and Access) Act 2025 amended PECR, including higher fines, a charitable purpose soft opt-in and changes to cookie rules. Check the ICO's guidance pages, which are being updated as the changes take effect.

## Prices and contact

Prices (all from, + VAT; ad spend separate): Google Ads management £150 a month; Paid social (Meta, LinkedIn, TikTok) £150 a month; Social media management £125 a month; Email marketing £95 a month; Marketing automation set-up £195; SMS marketing £75 a month; GA4 set-up £95; Conversion tracking £145; Data Studio (Looker Studio) dashboard £145; Conversion rate optimisation £195 a month; Content marketing £195 a month; Consultancy, audits and strategy £45 an hour. All prices are "from" and exclude VAT. Ad spend is separate and paid directly to Google, Microsoft, Meta, LinkedIn or TikTok. Paid media management is from £150 a month or 10 to 15% of ad spend, whichever is higher. You own every ad account, pixel, audience and email list we set up. Contact: https://dijitulmarketing.co.uk/contact/ · 01623 650333 · info@dijitul.uk