PECR and Email Marketing: The UK Rules Explained

Two laws, two jobs

Email marketing in the UK sits under two pieces of law:

• PECR decides whether you can send electronic marketing at all, and on what basis.
• UK GDPR governs how you collect, store and use the personal data, including your lawful basis, privacy notice, retention and security.

You need to comply with both. The Information Commissioner's Office (ICO) enforces them. This guide is a practical summary, not legal advice: check the ICO's guidance on direct marketing using electronic mail for the detail.

One point catches many businesses out: PECR applies to the message, not the list. Even if you collected an address lawfully for one purpose, such as answering a support question, that does not by itself give you the right to send it marketing. Each marketing message needs a basis of its own.

Who you are emailing matters

PECR treats recipients differently:

Business-to-business emails to a named person at a company still involve personal data, so UK GDPR applies. Usually that means relying on legitimate interests, telling them how you got their details and honouring opt-outs immediately.

Consent and the soft opt-in

Consent must be freely given, specific, informed and a clear positive action. Unticked boxes, separate from terms, saying what you will send. Keep records of who consented, when, where and to what wording.

The soft opt-in lets you email or text existing customers without consent if all of these apply:

1. You got their details during a sale, or negotiations for a sale.
2. You are marketing your own similar products or services.
3. You gave them a simple chance to refuse when you collected the details.
4. You give them a simple way to opt out in every message.

Charities now have their own version. The ICO says the Data (Use and Access) Act 2025 introduced a charitable purpose soft opt-in in PECR regulation 22(3A), for supporters who gave their details while supporting or showing interest in the charity and were offered an opt-out.

What every marketing email needs

• Who it is from. Do not hide or disguise the sender.
• A valid contact address for opt-out requests.
• An easy unsubscribe that works without logging in, and is acted on promptly.
• A suppression list, so people who opt out are never re-added from another import.

Separately from the law, Google's sender guidelines require anyone sending more than 5,000 messages a day to Gmail addresses to authenticate with SPF, DKIM and DMARC and support one-click unsubscribe, and ask all senders to keep spam rates reported in Postmaster Tools below 0.3%. Missing these can send compliant mail to spam. See email deliverability.

Texts, tracking and fines

SMS follows the same rules as email for individuals: consent or the soft opt-in, sender identified, and a way to opt out such as a STOP reply.

Cookies and similar technology also fall under PECR. Non-essential cookies on your website, such as advertising pixels, generally need consent. That is why sign-up forms and email tracking should be set up alongside a proper consent banner. See Consent Mode v2.

Penalties have risen. In February 2026 the ICO said the Data (Use and Access) Act gives it power to issue fines of up to £17.5 million or 4% of global turnover under PECR. Most of the Act's remaining data protection provisions came into force on 5 February 2026, according to the ICO.

How dijitul keeps campaigns compliant

Our email marketing service, from £95 a month + VAT, includes consent-based sign-up forms, separate SMS consent, suppression lists, unsubscribe checks and domain authentication. We never send to bought lists. SMS marketing is from £75 a month + VAT. For growing a list properly, read how to grow an email list legally.

Related