PECR Explained: UK Email and SMS Marketing Rules
If you send marketing emails or texts to people in the UK, the Privacy and Electronic Communications Regulations (PECR) decide who you can contact and how. The rules are shorter than most owners expect, but they are strict, and the fines for breaking them have recently grown. This explainer walks through what PECR covers, when you need consent, and how to build a list you can actually use.
Key takeaways
- PECR covers marketing by email, text, phone calls and cookies, and it sits alongside UK GDPR rather than replacing it.
- Marketing emails and texts to individuals, including sole traders and some partnerships, need prior consent unless the soft opt-in applies.
- Companies, LLPs and government bodies (corporate subscribers) can be emailed without consent, but you must identify yourself and offer an opt-out.
- Every marketing message needs a simple, free way to unsubscribe.
- The Data (Use and Access) Act 2025 raises maximum PECR fines to UK GDPR levels, so the stakes are now much higher.
Many small businesses treat email marketing rules as a box to tick once and forget. That works until a customer complains to the Information Commissioner's Office (ICO), or until you buy a list that should never have been emailed. PECR is the specific UK law for electronic marketing, and understanding it saves you from complaints and wasted effort.
This article is general information, not legal advice. Rules change and some new provisions are still being brought into force, so check the ICO guidance on what currently applies, or speak to a qualified adviser before making big decisions about your marketing.
What PECR is and how it fits with UK GDPR
PECR stands for the Privacy and Electronic Communications Regulations. They implement older European ePrivacy rules and remained part of UK law after Brexit. In plain terms, PECR sets the rules for sending marketing through electronic channels and for using cookies and similar tracking technologies.
UK GDPR is the broader data protection law. It governs how you collect, store, use and share any personal data. PECR adds specific rules on top for electronic marketing. You need to comply with both. A useful way to think about it:
- PECR answers: may I send this marketing email, text or call to this person at all, and what must the message contain?
- UK GDPR answers: am I handling this person's data lawfully, fairly and securely, and have I told them what I do with it?
A message can pass one test and fail the other. For example, you might have a valid reason under UK GDPR to keep a customer's email address for order updates, but PECR still decides whether you can send that customer a promotional newsletter.
What counts as "marketing"
Marketing is broader than sales emails. Any message that promotes your products, services, aims or ideals counts. Newsletters with offers, "we miss you" emails, event invitations that promote your business and texts announcing a sale are all marketing. Genuinely service-only messages, such as an order confirmation, a delivery update or a password reset, are not marketing, provided you do not slip promotional content into them.
Common mistake
Adding a "You might also like" product block to order confirmation emails sent to people who never agreed to marketing. Once a service message carries promotional content, it can be treated as marketing, and PECR rules apply to it.
The channels PECR covers
PECR is not only about email. It applies different rules to each electronic channel, which is why a single "marketing consent" checkbox can leave gaps.
| Channel | Individuals (including sole traders) | Corporate subscribers |
|---|---|---|
| Prior consent, unless the soft opt-in applies | No consent needed, but identify yourself and offer an opt-out | |
| Text message (SMS) | Prior consent, unless the soft opt-in applies | No consent needed, but identify yourself and offer an opt-out |
| Phone calls | Separate rules, including screening against preference services | Separate rules apply |
| Cookies and tracking | Consent for non-essential cookies, with some new exceptions for low-risk uses | Same rules apply to website visitors |
This article focuses on email and SMS. For marketing calls and cookies, see the ICO's channel-specific guidance.
Individuals vs corporate subscribers: the key split
The single most important question under PECR is who you are contacting. The law separates "individual subscribers" from "corporate subscribers".
Individual subscribers
These are private individuals, and also sole traders and some partnerships. That second part surprises many B2B marketers. A freelance designer trading under their own name, or a plumber running a one-person business, is treated like a private individual for PECR purposes. You need their prior consent to send marketing emails or texts, unless the soft opt-in applies.
Corporate subscribers
These are companies, limited liability partnerships (LLPs), Scottish partnerships and government bodies. You can send marketing emails to a corporate subscriber without prior consent, as long as you identify yourself clearly and give a valid address or way to opt out.
There is an important catch. If the address is a named person at a company, such as [email protected], that address is still personal data, so UK GDPR still applies. You need a lawful basis (often legitimate interests), you must tell people how you use their data, and you must stop when they object. Generic addresses like info@ or sales@ carry less data protection risk, but the PECR rules on identification and opt-out still apply.
Example
Imagine a bookkeeping firm, Ledgerline, wants to promote a new payroll service. It has two contacts from a networking event: the finance manager at Brightside Ltd, a limited company, and Sam, who runs a sole-trader cleaning business. Under PECR, Ledgerline can email the Brightside finance manager without consent if it identifies itself and offers an opt-out, while still meeting UK GDPR. To email Sam about the service, Ledgerline needs Sam's consent, or must meet all the soft opt-in conditions, which it does not, because Sam has never bought from or negotiated with the firm.
When you need consent, and what valid consent looks like
For individual subscribers, consent is the default route. PECR uses the UK GDPR standard of consent, which is demanding. Consent must be:
- Freely given: people should have a real choice, and signing up to marketing should not be a condition of buying something unless it is genuinely necessary.
- Specific: cover the channels you will use. Consent to email is not consent to texts.
- Informed: tell people who you are, what you will send and how they can stop it, with a link to your privacy notice.
- Unambiguous: a clear positive action, such as ticking an empty box or typing an email address into a form clearly labeled for a newsletter. Pre-ticked boxes do not count.
Keep consent separate from your terms and conditions, and keep records: who consented, when, how, and what they were told at the time. If the ICO ever asks, those records are your evidence.
Pro tip
Name your business and any partner brands precisely in the consent wording. Consent to hear from "selected third parties" is generally not specific enough to rely on. If you plan to share a list, name each organization at the point of sign-up.
Bought and rented lists
Buying a list of consumer email addresses is one of the riskiest things you can do under PECR. For the consent to cover your messages, the people on the list must have consented specifically to hear from you, by name. Generic third-party consent rarely meets that bar. If a broker cannot show you exactly what each person agreed to, assume you cannot email them.
The soft opt-in in brief
The soft opt-in is the main exception to the consent rule for individuals. It lets you send marketing emails and texts to existing customers without explicit consent, as long as every condition is met:
- You got the contact details in the course of a sale or negotiations for a sale. For example, at checkout or when the person asked for a quote.
- You are marketing your own similar products or services. Not someone else's, and not something unrelated.
- You gave a simple opt-out when you collected the details, and you give one again in every message.
The Data (Use and Access) Act 2025 extends the soft opt-in to charities, but this change is being brought in over time, so check the ICO guidance on whether it is in force before relying on it. For a deeper look at the conditions and the edge cases, see our separate explainer on the soft opt-in.
What every marketing message must include
Whether you rely on consent, the soft opt-in or the corporate subscriber rule, some requirements apply to every marketing email and text:
- Identify yourself. Do not hide or disguise who the message is from. Use a recognizable sender name and a real business identity.
- Give a valid contact address. People must be able to reach you to ask you to stop.
- Offer a simple, free opt-out. An unsubscribe link in emails, or a "reply STOP" style option in texts. It should cost nothing beyond normal network charges and should not require logging in.
- Act on opt-outs promptly. Add people to a suppression list so they are not re-added by a later import.
Few small businesses will face anything near that maximum, but the alignment signals that PECR breaches are now treated as seriously as wider data protection failures. Recipient complaints often trigger ICO attention, so a clean, well-consented list is your best defense.
How PECR changes under the Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and its provisions are being commenced in stages. For marketers, the main points are:
- Higher fines: PECR penalties are aligned with UK GDPR levels, as shown above.
- Cookie rules: some low-risk cookies, such as certain analytics, may no longer need consent, although you still need to tell people and let them object. Check the detail before removing your cookie banner.
- Charities and the soft opt-in: charities can use a version of the soft opt-in for supporters.
- Complaints: organizations must have a process for handling data protection complaints.
Because commencement is phased, phrase your internal policies cautiously and review them as each part comes into force. The ICO publishes updated guidance as changes take effect.
A practical PECR setup for a small business
You do not need a compliance department to get this right. A small set of habits covers most of the risk.
- Audit your lists. Tag each contact by source: website sign-up, checkout, quote request, event, business card. Note whether each is an individual or a corporate subscriber.
- Separate by lawful route. Keep consented subscribers, soft opt-in customers and corporate contacts in distinct segments, so you only send each group what you are allowed to.
- Fix your forms. Use unticked boxes, name each channel separately and link to your privacy notice. Double opt-in is good practice, though not legally required.
- Add opt-outs everywhere. Check every template, including automated flows and SMS, for a working, free unsubscribe.
- Maintain a suppression list. Store everyone who has opted out, and screen every import against it.
- Keep consent records. Most email platforms log sign-up time, form and IP address. Export and keep these records.
Your PECR checklist
- Every contact is tagged as individual or corporate subscriber
- Consent forms use unticked boxes and name each channel
- Consent records show who, when, how and what they were told
- Soft opt-in is used only for your own similar products, with an opt-out at collection
- Every email and text identifies your business and has a free unsubscribe
- Opt-outs go straight to a suppression list that blocks re-imports
- No bought consumer lists without specific, named consent
- Policies reviewed as Data (Use and Access) Act provisions come into force
Frequently asked questions
Does PECR apply if I only email a few hundred people?
Yes. PECR has no minimum size threshold. It applies to every organization sending electronic marketing to people in the UK, from a one-person shop to a large retailer.
Can I email a sole trader I found on a business directory?
Not for marketing, unless you have their consent or meet the soft opt-in conditions. Sole traders are treated as individual subscribers under PECR, even though they are running a business.
Is a newsletter with no offers still marketing?
Usually yes. If the newsletter promotes your business, its products or its aims, it is marketing. Purely transactional or service messages are the main exception.
Do I need consent to text my own customers?
For individual customers, either consent or the soft opt-in is required. If you collected their number during a sale, you market similar products, and you offered an opt-out at the time and in every text, the soft opt-in can apply.
Related reading
The bottom line
PECR comes down to three questions: who are you contacting, what route lets you contact them, and does every message identify you and offer a free way out. Get those right, keep records, and treat sole traders like consumers. Your list will be smaller than a bought one, but every name on it will be someone you are allowed to talk to.
Rules continue to change as the Data (Use and Access) Act 2025 comes into force, so check the ICO guidance regularly or ask a qualified adviser when you are unsure.
