UK PECR rules: get consent, or use soft opt-in only when every part fits — contact details obtained in a sale or negotiation of a sale, similar products or services, opt-out offered at collection and in every message. Purchased lists are not soft opt-in. Charities have a narrow extra route; do not copy it for commerce.

In forceLegalIn force 11 Dec 2003

In the UK, marketing email to individuals needs consent or a complete soft opt-in

Q: When does PECR soft opt-in allow emailing UK consumers without prior consent?

PECR regulation 22 requires prior consent for unsolicited direct-marketing email to individual subscribers unless every soft-opt-in condition holds: you obtained details during a sale or negotiations for a sale of your own products/services; you market your own similar products/services; and a simple free opt-out was offered at collection and in every message. Bought lists cannot inherit soft opt-in. From 5 February 2026 a separate charity soft-opt-in exists under DUAA amendments. Corporate subscribers are treated differently from individuals and sole traders.

Q: What happens if you do not?

ICO has issued monetary penalties for PECR email failings (see public notices such as HelloFresh and others). Consent quality and suppression failures are the usual story.

When does PECR soft opt-in allow emailing UK consumers without prior consent?

United Kingdom

In one sentence

UK marketing email needs or a complete (sale, similar products, at capture and in every mail) — bought lists fail on arrival.

Plain English

UK rules: get , or use only when every part fits — contact details obtained in a sale or negotiation of a sale, similar products or services, offered at collection and in every message. Purchased lists are not soft . Charities have a narrow extra route; do not copy it for commerce.

Why it matters. UK is not “almost like the US.” is a four-part lock, not a vibe.

Dotted words open definitions. Full glossary.

What to do

Your move — not a lecture

Part platform, part you

The platform covers the mechanical bit. The judgement is still yours.

and preference centres cover the mechanical opt-out.

Your part: Whether conditions were ever true, and charity-route eligibility.

What to do first

Pick your highest-volume UK welcome flow. Write which route it uses ( vs vs corporate). If you cannot, that is the gap.

You can skip this if: You never email individual subscribers in the UK.

Who this applies to

Anyone emailing UK individual subscribers (including many sole traders).

Checklist

01Do not buy UK consumer lists and call it .
02Keep collection-time evidence for .
03Treat sole traders carefully—they may be individual subscribers.
04If you are a charity, read the 5 February 2026 route before relying on it.

That’s enough to act. Sources and exact wording are below for counsel, bosses, or AI tools that need a citation. Not legal advice.

Proof

Exact position, enforcement, sources

For records and people who will check you. Skip if Monday’s move is already clear.

The exact position

regulation 22 requires prior for unsolicited direct-marketing email to individual subscribers unless every condition holds: you obtained details during a sale or negotiations for a sale of your own products/services; you market your own similar products/services; and a simple free was offered at collection and in every message. Bought lists cannot inherit soft . From 5 February 2026 a separate charity soft-opt-in exists under DUAA amendments. Corporate subscribers are treated differently from individuals and sole traders.

What happens if you do not

ICO has issued monetary penalties for email failings (see public notices such as HelloFresh and others). quality and suppression failures are the usual story.

Sources

Privacy and Electronic Communications Regulations 2003, regulation 22
Published 11 Dec 2003Read primary source
ICO, Direct marketing guidance
No publisher dateRead primary source

History of this page

2 Aug 2026Added including charity soft opt-in commencing 5 Feb 2026.

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.