The short version
The Data (Use and Access) Act 2025 (DUAA) changed PECR, the UK rules on marketing emails, texts, calls and cookies. The changes that matter most to email teams came into force on 5 February 2026:
- Much bigger fines. The ICO can now fine up to £17.5 million or 4% of global turnover for PECR breaches. The old maximum was £500,000.
- A new soft opt-in for charities. Charities can email supporters without consent in some circumstances, if they meet strict conditions.
- Messages that are sent count, whether or not they arrive. Spam that's blocked before it reaches an inbox is now clearly in scope.
What didn't change is just as important: you still need consent (or a valid soft opt-in) to email individuals, you still have to say who you are, and every message still needs a way to opt out.
If you want the full picture of UK email law, read our guide to UK email marketing law: GDPR and PECR.
Fines: from £500,000 to £17.5m or 4% of turnover
On 5 February 2026 the ICO published a statement on the commencement of the DUAA confirming it can now "issue fines of up to £17.5 million or 4% of global turnover" under PECR. The ICO's own summary of the PECR changes describes this as bringing PECR enforcement "into line with UK GDPR".
That's a big shift. Under the old cap, a PECR fine was a nuisance for a large company. Now it's on the same scale as a data protection fine.
Two things worth knowing:
- The ICO hasn't said how it will set these higher fines yet. In June 2026 it said it is "currently developing separate guidance to cover these higher fines" (ICO, one year on).
- It intends to use them for the worst cases. The same post says the ICO "can, and will, use these powers where necessary for the most serious cases".
Some older ICO pages still mention the £500,000 cap. They haven't all been updated, so go by the commencement statement.
The charity soft opt-in
Before February 2026, charities generally needed consent to send fundraising and campaigning emails to individuals. The ordinary soft opt-in didn't help, because it only covers marketing your own similar products and services to customers.
The DUAA added a charitable purposes soft opt-in. According to the ICO's email marketing guidance, you can only rely on it if all of these are true:
- You're a charity.
- You obtained the person's contact details yourself. Lists from third parties don't qualify; law firm summaries of the guidance (for example Lewis Silkin) note this also rules out details collected by a trading subsidiary or a fundraising platform.
- You got them because the person expressed an interest in, or offered or gave support for, your charitable purposes. For example, by donating, volunteering or signing up to hear about your work.
- The sole purpose of the email is to further your charitable purposes. Not to promote other organisations, including other charities.
- You gave them a chance to refuse or opt out when you collected their details.
- You give them a chance to opt out in every message after that.
There's also a date limit: it only applies to contact details collected on or after 5 February 2026. You can't apply it to your existing database retrospectively.
The ICO consulted on draft guidance in late 2025 and updated its direct marketing guidance at the end of April 2026, as reported by the DMA. Its preparation page, what can we do to prepare for the charitable purpose soft opt-in?, says you must update your privacy notice if you intend to use it, and should keep separate lists for people who consented and people emailed under the soft opt-in.
Sent but not received still counts
The ICO's summary also notes that the definition of "communication" now covers information that has been transmitted, and a "recipient" includes an intended recipient. In plain terms: if you send unlawful marketing emails, it's no defence that a spam filter stopped some of them. The number sent can count, not just the number delivered.
What didn't change
It's easy to read about new fines and new exemptions and assume the ground rules moved too. They didn't.
- Consent is still the default for marketing emails to individuals (including sole traders and some partnerships). It must be freely given, specific and informed.
- The ordinary soft opt-in is unchanged. You can email existing customers about your own similar products and services if you got their details during a sale or negotiation, gave them a chance to opt out then, and give them one in every message.
- Every marketing email must identify you and give a valid address to opt out. The ICO is clear you must not disguise or hide your identity.
- B2B rules are unchanged. Emails to corporate subscribers don't need consent under PECR, but you still need to identify yourself and offer an opt-out, and UK GDPR still applies to named individuals.
- Bought lists are as risky as ever. In January 2026 the ICO fined ZMLUK £105,000 over more than 67 million emails, where people had been shown a list of 361 "partner" companies with no way to choose. The ICO said that consent wasn't informed or specific.
How the ICO enforces PECR
Most published PECR fines are for nuisance calls and texts, often against small firms sending in huge volumes. Recent examples include £120,000 for Allay Claims (texts it said were service messages but which were promotional, with no valid soft opt-in) and £105,000 for ZMLUK (emails, invalid consent), both in January 2026.
The patterns are familiar: invalid consent from third-party sign-up pages, "service" messages that were really marketing, a soft opt-in claimed without an opt-out at collection, and complaints that kept coming after the sender knew about them. Complaints to the ICO and the 7726 spam reporting service are often what starts an investigation.
I haven't found a published PECR fine at the new higher levels yet. The ICO says it has published draft enforcement procedural guidance and will finalise it "in due course". My reading: the ICO hasn't changed what it looks for, but the ceiling is now high enough that a well-known brand making the same mistakes as a lead-generation firm could face a fine that matters to its board.
A practical checklist for UK email teams
Run through this once now, and build the per-send checks into your approval process.
Consent and lists
- Every individual on your marketing list has consent or a valid soft opt-in, and you can show which.
- Consent wording is specific: no long lists of partners, no pre-ticked boxes, no "by signing up you agree to marketing".
- No bought or rented lists for email to individuals. If you use third-party data at all, document your due diligence.
- Soft opt-in contacts came from a sale or negotiation, were offered an opt-out at the time, and are only sent your own similar products and services.
Charities
- Contact details used under the charity soft opt-in were collected on or after 5 February 2026, by the charity itself, from someone who showed interest in or supported your purposes.
- Consent and soft opt-in contacts are kept in separate lists or clearly flagged.
- Your privacy notice explains the soft opt-in, and the opt-out is offered at collection, not hidden in a policy.
- Soft opt-in emails only further your own charitable purposes.
Every email
- The sender is clearly identified in the from name and footer.
- There is a working unsubscribe link that needs no login, tested in a real inbox.
- Unsubscribes are processed promptly and applied to every system that sends marketing.
- "Service" or transactional emails with promotional content are treated as marketing.
Footer checks like these are easy to automate. Rule-based tools (including Brand Guard in MailFois) can flag a missing unsubscribe link or sender details before an email goes for sign-off.
Records
- Keep a record of where and when each person's consent or soft opt-in came from.
- Keep the approved version of each campaign and who signed it off.
- Note your suppression list sources and when they were last applied.
Frequently asked questions
When did the PECR changes come into force?
The main PECR changes from the Data (Use and Access) Act, including the higher fines and the charity soft opt-in, came into force on 5 February 2026.
What is the maximum PECR fine now?
Up to £17.5 million or 4% of global turnover, according to the ICO. The previous maximum was £500,000.
Can charities now email supporters without consent?
Sometimes. Under the charitable purposes soft opt-in, a charity can email people whose details it collected itself, on or after 5 February 2026, when they expressed interest in or supported its purposes, as long as it offered an opt-out at collection and in every email and the email only furthers its own charitable purposes.
Has the soft opt-in for businesses changed?
No. The commercial soft opt-in for existing customers and similar products and services works the same as before.
Do I need to re-permission my list because of the changes?
Not because of the DUAA alone. If your consent was valid before, it still is. But with fines now much higher, it's a good moment to check that your consent records would stand up to scrutiny.
