Soft Opt-In: When You Can Email Customers Without Consent
The soft opt-in is the rule that lets UK businesses send marketing emails and texts to existing customers without asking for explicit consent first. It is useful, but it is narrower than many owners assume. This explainer covers the three conditions, the grey areas, and how to set up your checkout and email flows so you can rely on it with confidence.
Key takeaways
- The soft opt-in is an exception in PECR that allows marketing emails and texts to individuals without prior consent, if all conditions are met.
- You must have collected the details during a sale or negotiations for a sale, be marketing your own similar products or services, and give a simple opt-out at collection and in every message.
- It does not cover bought lists, newsletter sign-ups with no sale, or promoting other companies' products.
- UK GDPR still applies: tell customers in your privacy notice and honor objections.
Every small online shop, salon, consultancy and trades business faces the same question: can I email the people who have already bought from me? Under the UK's Privacy and Electronic Communications Regulations (PECR), the default answer for individuals is "only with consent". The soft opt-in is the main exception, and it was written precisely for businesses that want to keep in touch with existing customers.
This article is general information, not legal advice. Check the ICO guidance on what currently applies, especially as parts of the Data (Use and Access) Act 2025 come into force in stages, and ask a qualified adviser if your situation is unusual.
Why the soft opt-in exists
PECR requires prior consent before you send marketing emails or texts to individual subscribers. That includes private individuals, sole traders and some partnerships. Consent must be freely given, specific, informed and unambiguous, which in practice means an unticked box or a clearly labeled sign-up.
Lawmakers recognized that a customer who has just bought from you reasonably expects to hear about similar offers. The soft opt-in balances that expectation against privacy: you may market to them, but they must be told and must be able to say no easily, from the start. It is called "soft" because the customer has not actively opted in, but they have been given a clear chance to opt out.
The soft opt-in only matters for individual subscribers. Companies, LLPs and government bodies (corporate subscribers) can be emailed without consent anyway under PECR, provided you identify yourself and give an opt-out, although UK GDPR still applies to named employee addresses.
The three conditions, one by one
All three conditions must be met. If even one fails, the soft opt-in does not apply and you need consent.
1. You got the details in the course of a sale or negotiations for a sale
The contact details must come from the person directly, as part of buying from you or actively discussing a purchase. A completed order clearly qualifies. Negotiations can also qualify: for example, someone who requests a quote, asks for a price or starts a booking enquiry about a specific service. The person needs to have shown real interest in buying, not simply visited your website or entered a competition.
Details collected some other way, such as from a business card left at a trade show stand, a free download with no sales discussion, or a list bought from a broker, do not meet this condition.
2. You are marketing your own similar products or services
You can only promote products or services that are similar to what the person bought or asked about, and they must be yours. The test is about reasonable expectations: would a customer who bought this be surprised to hear about that?
A garden centre customer who bought seeds would expect emails about plants and tools. They would probably not expect emails about your separate car valeting business, even if you own both. And you cannot use the soft opt-in to promote a partner's products or pass the details to another company.
3. You gave a simple opt-out at collection and in every message
When you collected the details, you must have given the person a clear, simple way to refuse marketing. Typically this is an unticked box at checkout saying something like "Tick here if you do not want to receive offers from us by email". Then every single marketing message must include an easy, free way to opt out.
If you did not offer the opt-out at the time of collection, you cannot rely on the soft opt-in for those contacts later. You would need to ask for consent instead.
Common mistake
Relying on the soft opt-in for years of old customer data collected before the checkout had any opt-out option. If the opt-out was missing at collection, the third condition fails, and those contacts need fresh consent before you market to them.
What does and does not qualify
Grey areas cause most of the confusion. This table sets out common scenarios. Treat it as a guide to thinking, not a final ruling, since context matters.
| Scenario | Soft opt-in likely? | Why |
|---|---|---|
| Customer bought a product online, with an opt-out box at checkout | Yes | Sale, own similar products, opt-out given |
| Prospect asked for a quote and was offered an opt-out | Often yes | Negotiations for a sale can qualify |
| Visitor signed up for a free guide only | No | No sale or negotiation; use consent instead |
| Competition or prize draw entrant | No | Entering a competition is not a purchase |
| Customer details passed to a sister company | No | Not your own products or services |
| Promoting a very different product line | Doubtful | May not be "similar" to the original purchase |
| List bought from a data broker | No | Not collected by you during a sale |
Example
Imagine a small online tea shop, Leafwell. At checkout, it shows an unticked box: "Tick if you would rather not get tea offers and recipes from Leafwell by email. You can unsubscribe at any time." A customer named Priya buys a box of green tea and leaves the box unticked. Leafwell can send her emails about new teas, teaware and brewing tips, each with an unsubscribe link. It cannot use her address to promote a friend's candle shop, and if it launches an unrelated clothing range, it should get Priya's consent before marketing that to her.
Email and text: the same rule, different mechanics
The soft opt-in applies to both email and SMS marketing. The conditions are the same, but the practical setup differs.
- Email: include a one-click unsubscribe link in the footer of every marketing email. Do not require a login or ask people to fill in a long form to leave.
- Text: offer a simple opt-out in every message, such as replying with a keyword. It should be free apart from normal network charges.
- Collection: if you collect both an email address and a mobile number at checkout, the opt-out should make clear which channels it covers. A good approach is a separate option for each channel.
Pro tip
Store the source of every contact in your email platform, for example "checkout", "quote request" or "newsletter form". That one field lets you send soft opt-in contacts only the content they qualify for, and it proves where each address came from if anyone asks.
The soft opt-in and UK GDPR
The soft opt-in answers the PECR question of whether you can send the message. You still need to comply with UK GDPR for the personal data itself. In practice:
- Lawful basis: where you rely on the soft opt-in, legitimate interests is typically the lawful basis for processing the data for marketing, rather than consent.
- Transparency: your privacy notice should explain that you send marketing to customers about similar products, and how they can stop it.
- Right to object: people have an absolute right to object to direct marketing. When someone unsubscribes or asks you to stop, you must stop.
- Data minimization: keep only what you need, and review how long you keep inactive customers on your marketing list.
Charities and the Data (Use and Access) Act 2025
Until recently, the soft opt-in was available only for commercial marketing of products and services. The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, extends a version of the soft opt-in to charities, so they may be able to market to supporters who have shown interest in their work. Commencement is being phased in, so charities should check the ICO guidance on what is in force before changing their approach.
The same Act aligns maximum PECR fines with UK GDPR levels, up to £17.5 million or 4% of global turnover. That makes it more important than ever to get the conditions right rather than stretch them.
How to set up the soft opt-in properly
- Review your checkout and quote forms. Add a clear opt-out statement or unticked box at the point you collect contact details. Name your business and the channels you will use.
- Tag contacts by source. Mark which contacts came from a sale or negotiation, so you know who qualifies.
- Define "similar". Write down which product categories you consider similar to each purchase type, and keep soft opt-in campaigns within them.
- Check every template. Make sure each marketing email and text includes your business identity and a working, free opt-out.
- Keep a suppression list. Store everyone who has opted out, at checkout or later, and block them from future imports.
- Update your privacy notice. Explain the marketing you send to customers and how to stop it.
Soft opt-in checklist
- Contact details collected during a sale or negotiations for a sale
- A clear opt-out offered at the point of collection
- Marketing limited to your own similar products or services
- Unsubscribe or STOP option in every email and text
- Contacts tagged by source in your email or SMS platform
- Suppression list maintained and checked before every import
- Privacy notice explains customer marketing and how to object
- Consent sought for anything outside the soft opt-in
Frequently asked questions
Does the soft opt-in apply outside the UK?
Similar exceptions exist in EU countries under their own ePrivacy laws, but the details vary by country. If you market to people in the EU, check the local rules where your customers live.
How long can I keep emailing a customer under the soft opt-in?
There is no fixed time limit in PECR, but the longer it has been since a purchase, the weaker the expectation of hearing from you. Many businesses set a review point and stop marketing to customers who have not bought or engaged for a long period.
Can I use the soft opt-in for people who abandoned their basket?
Possibly, if they gave their details while actively trying to buy and were offered an opt-out at that point. This is a grey area, so keep messages closely related to what they were buying, and check the ICO guidance.
Does the soft opt-in cover phone marketing calls?
No. The soft opt-in applies to email and text marketing. Marketing calls have their own separate PECR rules.
Related reading
The bottom line
The soft opt-in is a fair deal: customers who buy from you can hear about similar products, as long as you tell them up front and make leaving easy. Meet all three conditions, keep your marketing close to what they bought, and put an opt-out in every message. For anything outside those limits, ask for consent.
Rules and their commencement dates change, so check the ICO guidance or a qualified adviser before relying on the soft opt-in for anything unusual.
