Email Marketing Compliance in the UK: PECR, Soft Opt-In and UK GDPR Rules for 2026
Email marketing compliance in the UK is governed by the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, and breaches now carry fines of up to £17.5 million or 4% of global turnover. This guide covers consent for individual subscribers, the soft opt-in, B2B email to corporate subscribers and sole traders, unsubscribe and sender identity rules, and the list management controls UK businesses need before the next campaign is sent.
This guide is general information for marketers, current as at October 2026. It is not legal advice.
Cost of Non-Compliant Email Marketing
Since 5 February 2026, maximum PECR penalties have matched UK GDPR at £17.5 million or 4% of global annual turnover, following the commencement of the Data (Use and Access) Act 2025 reported by Clifford Chance. The previous ceiling of £500,000 limited the downside for careless senders, and that limit no longer applies to email, SMS or cookie breaches.
Regulatory risk is only part of the cost. Mailbox providers including Gmail and Outlook filter senders whose lists generate complaints and bounces, so a list built on weak consent loses inbox placement long before any regulator becomes involved, and every campaign sent to that list costs more per engaged reader.
Most UK email programmes inherit their compliance problems from list history. Contacts imported from event badge scans, old CRM exports, purchased data and partner swaps sit in the same audience as genuine subscribers, with no record of how each address was obtained or what the person agreed to receive. A clean consent record per contact resolves both the legal exposure and the deliverability decline.
PECR Email Marketing Rules
PECR sets the rules for sending marketing by electronic mail, which covers email, SMS, MMS and app-based messages. UK GDPR then governs how the personal data behind each email address is collected, stored and used.
Consent for Individual Subscribers
Marketing emails to individuals require consent that the person has specifically given for electronic mail from the sender, according to the ICO guidance on electronic mail marketing. Consent must be freely given, specific and informed, and an unticked opt-in box with clear wording remains the standard collection method.
- Unticked opt-in boxes that name the sender and the type of messages to be sent
- Separate consent for each channel where email and SMS are both used
- Timestamped consent records showing source, wording and date for every contact
- No reliance on consent bundled across lists of third-party “partners”
Soft Opt-In for Existing Customers
The soft opt-in allows marketing emails to existing customers without fresh consent, provided the contact details were obtained during a sale or negotiation of a sale, the messages promote similar products or services, and the person was given a clear chance to opt out when their details were collected and in every message afterwards. Prospects, bought-in lists and non-commercial promotions such as charity fundraising fall outside the soft opt-in under the current ICO guidance, which the ICO has flagged as under review following the Data (Use and Access) Act.
- Opt-out offered at the point of sale or quote, before the first marketing email
- Marketing restricted to products and services similar to the original purchase or enquiry
- Unsubscribe link and sender details in every message
- Soft opt-in status recorded separately from full consent in the CRM
B2B Email: Corporate Subscribers and Sole Traders
PECR permits marketing emails to corporate subscribers, such as limited companies, LLPs, public bodies and schools, without prior consent, as long as the sender is identified and an opt-out is provided. Sole traders and some partnerships count as individual subscribers, so B2B lists that mix limited companies with self-employed contacts need the consent rules applied record by record. UK GDPR still applies to named business addresses such as firstname@company.co.uk, so a legitimate interests assessment and a privacy notice are required.
- Company-type field in the CRM separating corporate subscribers from sole traders and partnerships
- Legitimate interests assessment documented for B2B prospecting to named contacts
- A suppression list of businesses that have objected, screened before every send
- Privacy notice information provided within one month of first contact for data not collected directly
Sender Identity, Unsubscribe and Complaints
Every marketing email must identify the sender and provide a valid address for opting out, and opt-out requests must be actioned promptly. Since 19 June 2026, UK organisations must also provide a way for people to complain directly about the handling of their personal data, acknowledge complaints within 30 days and keep the complainant informed of progress.
- A one-click unsubscribe link that works without a login
- Opt-outs synchronised across every sending platform and the CRM
- Recognisable sender name, physical business address and contact route in the footer
- An electronic complaint form and a logged 30-day acknowledgement process
| Recipient type | Example | PECR rule for marketing email | UK GDPR position |
|---|---|---|---|
| Individual (new prospect) | Website newsletter sign-up | Specific opt-in consent required | Consent is the lawful basis |
| Individual (existing customer) | Previous purchaser or quote request | Soft opt-in if all conditions are met | Legitimate interests, with opt-out |
| Sole trader or partnership | Self-employed electrician | Treated as an individual: consent or soft opt-in | Personal data in full |
| Corporate subscriber, generic address | info@company.co.uk | No prior consent needed; identify sender and offer opt-out | Usually not personal data |
| Corporate subscriber, named employee | jane.smith@company.co.uk | No prior consent needed; identify sender and offer opt-out | Personal data: legitimate interests assessment and privacy notice |
Data: In January 2026 the ICO fined ZMLUK Limited £105,000 for sending 67,772,285 marketing emails between January and July 2023 using third-party data, where recipients had been shown 361 “partner” companies with no way to choose which could contact them.
Email List Compliance Audit
A UK email compliance audit runs in five phases, and the governing principle is that every address on the list must carry a recorded basis for each message type it receives.
- List source mapping (week 1). Identify every source feeding the email platform, including web forms, checkout, events, imports and integrations.
- Contact classification (week 1). Tag each record as consented individual, soft opt-in customer, sole trader, corporate subscriber or unknown basis.
- Remediation (week 2). Suppress unknown-basis contacts, run a permission campaign where appropriate and delete purchased data that lacks valid consent.
- Form and footer rebuild (week 2 to 3). Rewrite opt-in wording, add opt-outs at checkout and quote stages, and standardise unsubscribe and sender details.
- Ongoing controls (week 3 onward). Automate suppression syncing, log complaints against the 30-day rule and review the list basis every quarter.
Organisations with several sending platforms, multiple brands or historic purchased data should plan for six to eight weeks, because remediation decisions often need sign-off from legal and sales leadership.
A business sending from a single platform with forms that already capture consent can usually complete the audit in one week and move straight to ongoing controls.
The wider regulatory picture, including cookies, advertising standards and fake review rules, is covered in the guide to UK digital marketing regulations.
Request a Free Marketing Audit
A review of list sources, consent records and email platform setup identifies compliance gaps and deliverability losses in the same exercise.
Request a free marketing audit
Written review returned within 48 hours. No obligation, no contract, and all findings and data remain yours.
Consent-led campaign planning and automation are covered on the email marketing services page, and enquiry tracking on the conversion rate optimisation page.
Further guidance is published in Blog & Insights.
Frequently Asked Questions
Is it legal to send marketing emails without consent in the UK?
It is legal in two situations: sending to corporate subscribers such as limited companies, and sending to existing customers under the soft opt-in. Marketing emails to individual subscribers, including sole traders, otherwise need specific consent. Every message must still identify the sender and include a working opt-out. UK GDPR applies alongside PECR whenever the address belongs to an identifiable person.
Can I buy an email list for marketing in the UK?
Purchased lists of individual subscribers are high risk, because the consent must name the sender, and generic consent to hear from unnamed “partners” is not valid under ICO guidance. B2B lists of generic corporate addresses carry less PECR risk, but named employee data still triggers UK GDPR transparency duties. Any purchased data should be screened against the sender’s suppression list before use.
What must be included in a UK marketing email footer?
A UK marketing email should include the sender’s identity, a valid contact address and a simple unsubscribe link that works without logging in. Company emails also need the registered company name and number to meet Companies Act disclosure rules. A footer link to the privacy notice satisfies part of the UK GDPR transparency requirement.
How long can I keep email marketing data under UK GDPR?
UK GDPR sets no fixed period, but personal data must not be kept longer than necessary for the purpose it was collected for. Most organisations define a retention rule based on inactivity, such as removing or re-permissioning contacts who have not opened or clicked within a set period. The retention period should be stated in the privacy notice and applied automatically.