Can I email my customers? PECR rules for UK email and SMS

Short answer: You may email or text someone for marketing only with their consent, or under the soft opt-in if they are your own customer or negotiated to buy from you. Limited companies and LLPs sit outside the consent rule, but sole traders do not. Every message must say who you are and give a working way to stop. So before you send anything, sort your list by how each contact arrived and who they are.

Most small businesses keep one list, and the whole lot gets the Friday email. That is the mistake. Whether you may send depends on how each contact arrived and who they are. This page sorts the everyday cases and says no where the answer is no. It sits under our guide to marketing automation in the UK, which explains the soft opt-in test and the consent record in full. We read every source below on 10 October 2026. This is a plain-English guide, not legal advice, and the ICO’s pages are the authority.

Two questions decide every message

PECR, the Privacy and Electronic Communications Regulations, governs the channel: may you send marketing by this route to this recipient. UK GDPR governs the personal data: lawful basis, telling people how you use it, and their rights. The ICO enforces both.

Ask two things of every contact. Who is this, an individual or a corporate body? And how did they arrive on the list?

First, is it marketing at all?

Service messages sit outside the rule. The ICO’s Identify direct marketing guidance, last updated on 20 August 2025, gives PECR’s definition: “the communication (by whatever means) of advertising or marketing material which is directed to particular individuals”. Appointment reminders are service messages.

Three traps. A mainly administrative message becomes marketing if it also promotes something, “even if that is not the main purpose of your message”. Genuine market research is not direct marketing, but research that promotes, or is really done to market to people, is: the ICO calls this “sugging”. And asking for consent is itself marketing: the ICO’s example is a hotel emailing past guests to ask whether they want its offers. Even with no offers in it, “the hotel is still sending it for direct marketing purposes.”

The page does not address review requests or surveys. Our view: a plain “how did we do” sits closer to a service message, and a review request with a discount code is marketing. Where unsure, treat it as marketing.

Past customers and people who asked for a quote

The ICO’s electronic mail marketing guide says you may send marketing by electronic mail to an individual only if they have specifically consented to electronic mail from you, or the soft opt-in applies.

PECR regulation 22 sets the soft opt-in, and all three parts must hold: the details came from a sale or negotiations for a sale, the marketing is for your own similar products or services, and the person was given a simple, free means of refusing when the details were collected and in each later message.

The ICO says the soft opt-in “does not apply to prospective customers or new contacts (eg from bought-in lists).” The page we read does not define negotiations, and does not say how long consent or the soft opt-in lasts. Our view: a priced quote request is the safe reading of negotiations, and a general question or a brochure download is not something we would lean on.

Newsletter sign-ups and everyone who never bought

Someone who typed their address into a newsletter box has consented to that newsletter from you. That is consent, not soft opt-in. The ICO’s news release of 20 January 2026 states that consent must be freely given, specific, informed and unambiguous, and that pre-ticked boxes or notices buried in a privacy policy do not count as valid consent or as a simple opt-out.

Our reading: a competition entry, or a free download with marketing bundled in silently, is not consent. For those contacts the answer is no.

A note for charities. Regulation 22 gained a new paragraph 3A, inserted by the Data (Use and Access) Act 2025 and in force from 5 February 2026. A charity may send marketing email where the sole purpose is to further its charitable purposes, the details were obtained when the person expressed interest in or supported those purposes, and a simple free way to refuse was given at collection and in each message. When we read it, the ICO’s electronic mail guide still carried the older line excluding charity fundraising, with a notice that it is under review because of the Act.

A limited company and a sole trader are not the same inbox

The email and text consent rules do not apply to corporate subscribers. The ICO’s business-to-business marketing page says these are bodies with separate legal status: companies, limited liability partnerships, Scottish partnerships and some government bodies. An employee’s work email address counts, because the employer is the subscriber. Sole traders and some partnerships are individual subscribers, so consent or the soft opt-in is needed. If unsure, the ICO says to treat the address as an individual’s. The page carries the same review notice.

Our view: a plumber, a hairdresser, a market trader and many small partnerships are individuals under this rule, so “it is B2B, so it is fine” is wrong for a large share of small UK firms.

Even a corporate subscriber is not a free-for-all. You must not conceal who you are and must give a valid address to opt out. The ICO says to honour opt-outs from businesses though PECR does not explicitly require it, and recommends a “do not email or text” list.

A named person’s work address, firstname.lastname at a company, is personal data, so UK GDPR applies: you need a lawful basis, typically consent or legitimate interests, and they have an absolute right to object to direct marketing.

Bought lists and “partner” consent

The soft opt-in cannot apply to a bought list. So you need consent, and consent has to be specific and informed. Our reading: the person must have known that you, in particular, would contact them. In the January 2026 case below, sign-ups saw a list of 361 “partner” companies with no way to choose among them, and the ICO concluded they could not give informed, specific consent. The sender is responsible even when the list came from someone else.

Our view: for a small business, a bought consumer list is not worth buying. A bought list of limited-company addresses is outside the consent rule, but still needs your identity, a way to stop, UK GDPR for named people, and screening against your do-not-contact list.

Texts follow the email rule, and STOP only stops texts

The ICO’s electronic mail guide says the same rule applies to emails, texts, picture messages, video messages, voicemails and direct messages via social media. It defines electronic mail as “any text, voice, sound or image message sent over a public electronic communications network”. The difference is in stopping. The ICO’s Respect people’s preferences guidance says an opt-out usually covers only the channel it was given on. Its example is a person who texts STOP and stops getting texts but still gets emails. Where you offer opt-out choices, make clear which marketing each one covers.

What every message has to carry

Regulation 23 says you must not send marketing email where the identity of the sender has been disguised or concealed, or without a valid address the recipient can use to ask for the messages to stop. It is not limited to individual subscribers. Your platform handles the unsubscribe link and suppression list only if it is set up; our guide to choosing a marketing automation platform compares them.

When someone says stop

The ICO says of an objection to direct marketing, “There are no reasons that you can use to refuse their objection.” Stopping is not deleting. Keep the minimum on a suppression or “do not contact” list so the person is not re-added later. The ICO’s example is a company that deleted a number, later bought a list containing it and contacted the person again.

You may send one message straight after an opt-out to confirm it and say how to resubscribe, but it must not require the person to do anything. You cannot later ask whether they have changed their mind. Withdrawing consent must be as easy as giving it, and you must stop immediately or as soon as possible. If consent was your basis, you must not switch to another basis to carry on. The page gives no fixed number of days.

A Norwich bike shop sorts its list

This is a hypothetical, not a client: an independent bike shop with a repair workshop in Norwich, and one spreadsheet of contacts. Sorted into five piles:

Pile	Verdict
Bought a bike or paid for a service at the till, receipt email offered an opt-out	Soft opt-in, for bikes, parts and servicing
Asked for a priced service quote, never booked	Soft opt-in on the negotiations limb, only if an opt-out was offered when the details were taken. If not, no
Entered a prize draw at a cycling event, form said nothing clear about marketing	No. An email asking them to opt in is itself marketing, so that door is closed. Invite them in person or on the website
A courier firm, a limited company with a trade account	Outside the consent rule. Still name the shop, give a way to stop, respect the named contact’s objection
A self-employed cycling instructor who buys parts on account	An individual under PECR despite the trade relationship. Soft opt-in applies: a customer who was offered an opt-out

The shop ends up with a smaller list it can defend. Whether sequences on it are worth building is covered in our guide to marketing automation return on investment.

What the ICO fined in January 2026

The ICO’s release of 20 January 2026 announced fines totalling £225,000.

Allay Claims Ltd of Newcastle-upon-Tyne was fined £120,000 for more than 4 million marketing texts, sent between February 2023 and February 2024 to promote PPI tax refund services. Allay said the texts were service updates and relied on the soft opt-in. The ICO found them promotional, since they urged further claims and pointed to landing pages, and found no simple way to refuse had been given when details were collected. More than 46,000 complaints came through the 7726 reporting service.

ZMLUK Limited of Bristol, formerly Zuru Media Ltd, was fined £105,000 for over 67 million marketing emails sent between January and July 2023 without valid consent. The data came mainly from a third-party website, the 361 “partner” list above. Andy Curry, the ICO’s Head of Investigations, said businesses “must only send marketing messages to people who have freely and knowingly consented to receiving them.”

Our view: both failures are ones a five-person firm can make at small scale: calling a promotion a service message, and trusting somebody else’s consent.

Since 5 February 2026 the maximum for a serious PECR breach is £17.5 million or 4% of annual global turnover, whichever is higher, as our marketing automation guide sets out.

This list check comes first when we build AI automation for a client.

Frequently asked questions

Can I email past customers without asking for consent?

Sometimes. Under the soft opt-in in PECR regulation 22, you may market your own similar products or services to people whose details you obtained in the course of a sale or negotiations for a sale, if they were given a simple, free way to refuse at collection and in every later message. It does not cover prospective customers or new contacts.

Do PECR’s email rules apply to business-to-business marketing?

Partly. The consent rules for email and text do not apply to corporate subscribers such as limited companies, limited liability partnerships and Scottish partnerships, including an employee’s work address. They do apply to sole traders and some partnerships, which count as individuals. If unsure, the ICO says to treat an address as an individual’s. Identity and opt-out duties apply to everyone.

Is a text message covered by the same rules as an email?

Yes. The ICO’s electronic mail guide says the same rule applies to emails, texts, picture messages, video messages, voicemails and direct messages via social media. The difference is in stopping: an opt-out usually covers only the channel it was given on, so a person who texts STOP can still get your emails.

Is an email asking people to opt in to marketing allowed?

Only to people you could already market to. The ICO treats asking for consent to marketing as direct marketing in itself, as in its example of a hotel emailing past guests to ask whether they want its offers. For everyone else, invite them to opt in in person or on your website.

Can I use a bought email list in the UK?

For a small business we would not. The soft opt-in does not apply to people from bought-in lists, so you would need each person’s specific, informed consent to hear from you, and you are responsible even when the list came from someone else. Limited-company addresses sit outside the consent rule but still need your identity and a way to stop.

What must I do when someone unsubscribes?

Stop immediately, or as soon as possible; the ICO page gives no fixed number of days. Keep the minimum details on a suppression list so the person is not re-added later. You may send one message to confirm and say how to resubscribe, but it must not ask them to do anything.

---

Not sure how many rows on your list you could defend? Get a free marketing audit and we will check it with you before you send.