Is Your Email Marketing Legal in the UK? PECR, UK GDPR and Consent Rules Explained

You have built an email list, designed a great newsletter and written a strong offer. You are one click away from hitting send. But before you do, there is a question that many UK businesses never ask: "Is this email actually legal?"

It is a serious question. The Information Commissioner's Office (ICO) issues most of its marketing fines under PECR, the Privacy and Electronic Communications Regulations, and the Data (Use and Access) Act 2025 has made the penalties much heavier. Maximum fines for breaking the electronic marketing rules were previously £500,000. They have now been aligned with UK GDPR levels, which means up to £17.5 million or 4% of global annual turnover, whichever is higher.

The good news is that email marketing is still completely legal and still one of the best-performing channels available. You simply need to follow the rules. This guide explains PECR, UK GDPR and consent in plain English, so you can send campaigns with confidence.

Please note: this article is general information for businesses and is not legal advice. For your specific situation, check the ICO's official guidance or speak to a qualified data protection adviser.

The Short Answer: When Is Email Marketing Legal in the UK?

In simple terms, your email marketing is legal when you can answer "yes" to these questions:

• Do you have valid consent from the person, or a valid soft opt-in for existing customers, or are you emailing a corporate address?
• Does every email clearly say who you are?
• Does every email offer a free and easy way to unsubscribe?
• Do you honour opt-outs quickly?
• Do you handle personal data fairly, securely and transparently?

If any answer is "no" or "not sure", keep reading. That is exactly where most businesses get into trouble.

The Laws Behind UK Email Marketing

Email marketing in the UK is shaped by several laws that work together. Understanding the role of each one makes everything else easier.

PECR: The Rules for Sending the Email

PECR is the main law that decides whether you are allowed to send a marketing email in the first place. It covers marketing emails, texts and calls, as well as cookies and similar tracking technologies. A key point many people miss is that PECR applies even if you are not processing personal data.

UK GDPR and the Data Protection Act 2018: The Rules for Handling Data

UK GDPR and the Data Protection Act 2018 decide how you collect, store and use personal data. If you hold names, email addresses or behaviour data about your subscribers, you must have a lawful basis, be transparent, keep data secure and respect people's rights. PECR also uses the UK GDPR standard of consent, so the two laws overlap.

The Data (Use and Access) Act 2025: What Changed?

The Data (Use and Access) Act received Royal Assent on 19 June 2025 and updated both PECR and UK GDPR. For email marketers, the most important changes are:

• Much higher fines. PECR penalties now match UK GDPR penalties, rather than the old £500,000 ceiling.
• A clearer definition of direct marketing. The definition of communicating advertising or marketing material directed at particular individuals now sits inside PECR as well.
• A soft opt-in for charities. Charities can now rely on a version of the soft opt-in for people who supported or showed interest in their work, as long as the person can opt out.
• Faster breach reporting. Certain PECR personal data breaches must now be reported to the ICO within 72 hours.

The practical message is simple: the regulator has more power, and the cost of getting it wrong has increased.

Who Can You Email? Consumers vs Businesses

The rules depend on who is receiving your email. This is one of the most important distinctions in UK email marketing.

Individual Subscribers (Consumers, Sole Traders and Some Partnerships)

For individual subscribers, you generally need prior consent before sending marketing emails. The main exception is the soft opt-in, which we explain below. Many small business owners are surprised to learn that sole traders and some partnerships are treated as individuals, even when you are contacting them about their business.

Corporate Subscribers (Limited Companies and Similar Organisations)

For corporate subscribers, such as limited companies and other incorporated bodies, you can generally send B2B marketing emails without prior consent. However, you must still clearly identify yourself, include contact details, offer an easy opt-out and respect anyone who objects. UK GDPR rules on personal data can also apply when the email address identifies a person, such as a named business address.

If you are not sure whether a contact is a corporate or individual subscriber, the safest approach is to treat them as an individual and get consent.

What Counts as Valid Consent?

Consent is the foundation of lawful email marketing, and the bar is high. Under the UK GDPR standard, valid consent must be:

• Freely given. People must have a real choice. You cannot make it a condition of a service that is unrelated to marketing.
• Specific. The person must know what they are agreeing to, such as receiving your email newsletter.
• Informed. You must say who you are and what you will send.
• Unambiguous. It must be a clear action, such as ticking a box.
• Easy to withdraw. Opting out should be as simple as opting in.

What Does Not Count as Consent

• Pre-ticked boxes. Silence or inactivity is not consent.
• Burying marketing in terms and conditions. Consent must be separate and clear.
• Assuming consent from a business card. Handing over a card does not automatically mean agreement to marketing emails.
• Bought or rented lists. A third party saying people "opted in" is not enough unless the consent was specific to you and properly recorded.

The Soft Opt-In: The Exception Most Businesses Rely On

The soft opt-in allows you to email existing customers without fresh consent, but only if all of these conditions are met:

1. You obtained the person's contact details during a sale or negotiation for a sale of a product or service.
2. You are only marketing your own similar products or services.
3. You gave the person a clear chance to opt out when you collected their details, and you offer it again in every message.

If any one of these conditions is missing, the soft opt-in does not apply. For example, you cannot use it to promote a partner's products, and you cannot use it for people who simply visited your website or downloaded a free guide without making a purchase.

Legitimate Interests: A Common Misunderstanding

Many marketers believe that "legitimate interests" under UK GDPR allows them to send marketing emails to anyone. This is a common and costly mistake. For electronic marketing to individuals, PECR requires consent or the soft opt-in. Legitimate interests can still be relevant for some personal data processing in the background, but it does not replace the PECR consent requirement for sending the email itself.

What Every Marketing Email Must Include ?

Even when you have permission to send, your email content must meet legal standards. Check that every campaign includes the following:

• Your real identity. The sender name must clearly show who you are. You must never disguise or hide the sender.
• A valid contact address. People must be able to reach you and use that address to opt out.
• A free and simple unsubscribe option. Requiring a login, a payment or a long form is not acceptable.
• Clear marketing intent. The email should not be disguised as a non-marketing message.
• Company details. Business emails sent by UK companies should include the company name, registration number and registered office address, in line with company law requirements.

Unsubscribe Rules: Keep It Fast and Simple

Under UK GDPR, individuals have an absolute right to object to direct marketing. When someone unsubscribes, you must stop emailing them promptly. Best practice is to process opt-outs immediately, or at the very least within a few days.

Keep a suppression list of people who have opted out. If you delete them completely, you may accidentally email them again when you upload a new list. A suppression list protects you and your subscribers.

Record Keeping: Your Proof If Anyone Asks

If the ICO or a customer questions your marketing, you will need evidence. Keep clear records of:

• Who consented and when
• What they were told at the time, including the form wording
• How and where they gave consent, such as the website form or event sign-up
• When and how they opted out

Good records turn a stressful investigation into a simple answer. Poor records can make even honest businesses look careless.

10 Common Email Marketing Compliance Mistakes in the UK

1. Using pre-ticked consent boxes.
2. Buying email lists without checking how consent was collected.
3. Treating sole traders as companies and skipping consent.
4. Using the soft opt-in for people who never purchased.
5. Hiding the unsubscribe link in tiny, low-contrast text.
6. Ignoring opt-out requests or taking weeks to process them.
7. Sending from a disguised or misleading sender name.
8. Not keeping consent records.
9. Relying on legitimate interests to email consumers.
10. Forgetting to review old lists. Consent collected years ago, in unclear ways, may no longer be reliable.

Your UK Email Marketing Compliance Checklist

Use this quick checklist before every campaign:

• I know whether each contact is an individual or a corporate subscriber.
• I have valid consent or a valid soft opt-in for individuals.
• My sign-up forms are clear, specific and not pre-ticked.
• My emails show who I am and include a working contact address.
• Every email has a visible, free unsubscribe link.
• I process opt-outs quickly and keep a suppression list.
• I keep records of consent and opt-outs.
• My privacy policy explains how I use subscriber data.
• My cookie banner and tracking practices follow PECR rules.
• I review my email list regularly and remove unreliable data.

Why Work with Email Marketing Experts in the UK?

Compliance does not have to slow your marketing down. In fact, it often improves results. A clean, permission-based list has higher open rates, fewer spam complaints and better deliverability. This is why many growing businesses choose to work with email marketing experts in the UK who understand both the creative side and the legal side of campaigns.

An experienced specialist will audit your list, review your sign-up forms, check your email footers and build automated flows that respect consent and unsubscribe rules. They can also write email content that persuades readers without crossing legal lines, such as misleading subject lines or hidden sender details.

Choosing a Top Email Marketing Agency in the UK

When you are comparing options, a top email marketing agency in the UK should be able to demonstrate more than good design. Ask these questions before you sign:

• How do you collect and record consent for your clients?
• How do you manage unsubscribes and suppression lists?
• Do you use or recommend bought lists? (The right answer is no.)
• How do you stay updated on changes to PECR and UK GDPR?
• Will I own my subscriber data and my email platform account?
• Can you share reports on open rates, clicks, complaints and conversions?

Clear, confident answers show a team that takes your reputation as seriously as you do. Vague answers, or promises of "guaranteed inbox delivery to thousands of contacts", are warning signs.

What to Expect from an Email Marketing Company in the UK ?

A professional email marketing company in the UK usually helps with strategy, list building, copywriting, design, automation and reporting. For compliance, a good partner will make sure that your consent wording is clear, your templates include the right sender and unsubscribe details, and your data is stored and used responsibly.

They should also be transparent about pricing, honest about timelines and realistic about results. Email marketing builds gradually, as your list grows and your messages improve. Be cautious of anyone promising instant sales from a purchased database. Besides being risky legally, those lists usually perform poorly because the recipients never asked to hear from you.

Final Thoughts: Compliant Email Marketing Is Better Email Marketing

UK email marketing law can look complicated, but the core idea is simple: respect the people you email. Ask for permission, be honest about who you are, make it easy to leave and keep good records. Businesses that follow these principles do not just avoid fines. They build trust, protect their sender reputation and earn better engagement.

With penalties now much higher than before, this is the right time to review your sign-up forms, your lists and your email templates. A short audit today can save you from a very expensive problem tomorrow.

Frequently Asked Questions (FAQs)

1. Is email marketing legal in the UK?

Yes. Email marketing is legal in the UK as long as you follow PECR and UK GDPR. This usually means having consent or a valid soft opt-in for individuals, identifying yourself clearly and offering an easy way to unsubscribe.

2. What is PECR?

PECR stands for the Privacy and Electronic Communications Regulations. It is the main UK law that decides when you can send electronic marketing, such as emails, texts and calls, and it also covers cookies and similar tracking technologies.

3. Do I need consent to send marketing emails in the UK?

For individual subscribers, you generally need consent, unless you can rely on the soft opt-in for existing customers. For corporate subscribers such as limited companies, you can usually send B2B marketing without prior consent, but you must still identify yourself and offer an opt-out.

4. What is the soft opt-in?

The soft opt-in lets you email existing customers about your own similar products or services without fresh consent. You must have collected their details during a sale or negotiation, and you must have offered a clear opt-out at collection and in every message.

5. How much can I be fined for breaking email marketing rules?

Following the Data (Use and Access) Act 2025, maximum PECR fines have been aligned with UK GDPR penalties, which means up to £17.5 million or 4% of global annual turnover, whichever is higher. Previously the maximum was £500,000.

6. Can I buy an email list and use it for marketing?

It is very risky. Unless the people on the list gave specific, informed consent to receive marketing from you, sending emails to them can breach PECR. It is much safer and more effective to build your own permission-based list.

7. Does "legitimate interests" allow me to email anyone?

No. For electronic marketing to individuals, PECR requires consent or the soft opt-in. Legitimate interests does not replace this requirement for sending the email itself.

8. How quickly must I process an unsubscribe request?

You should stop sending marketing emails as soon as possible. Best practice is to process opt-outs immediately or within a few days, and to keep a suppression list so the person is not accidentally contacted again.

9. What details must be included in a business marketing email?

Your email should clearly identify the sender, include a valid contact address, provide a free and simple unsubscribe option and avoid disguising its marketing purpose. Companies should also include their company name, registration number and registered office address.

10. How can an email marketing agency help me stay compliant?

A good agency will audit your lists and sign-up forms, set up proper consent and unsubscribe processes, build compliant templates and automations and keep up with changes to UK rules, so your campaigns stay effective and safe.

Ready to Send Emails That Are Both Powerful and Compliant?

If you want email campaigns that build trust, protect your reputation and bring real results, HubSol can help. Our team creates permission-based email strategies, compliant templates and high-converting content tailored to your business. Contact us today for a free consultation and start growing your audience the right way.