- The law
- PECR regulations 22–23; UK GDPR
- Who enforces it
- Information Commissioner's Office (ICO)
- Penalties
- Up to £17.5 million or 4% of global turnover (whichever is higher) since the Data (Use and Access) Act 2025 changes of 5 February 2026
What’s changed (2026/27 edition). Since 5 February 2026, fines for breaking the email rules can reach £17.5 million or 4% of global turnover, and charities have their own soft opt-in for supporters.
What it means for your email
- Marketing emails to individuals need their consent first. That includes sole traders and ordinary partnerships.
- Consent must be a clear, positive action. A pre-ticked box doesn't count.
- The soft opt-in lets you email existing customers without fresh consent, but only if all its conditions are met.
- Emails to limited companies, LLPs and public bodies (corporate subscribers) don't need consent under PECR.
- Every marketing email must say who it's from and give a valid address to opt out. This applies whatever your basis for sending.
Do
- Use an unticked box or a clear sign-up action, separate from your terms and conditions.
- Keep a record of when, where and how each person agreed, and which basis you rely on.
- Use the soft opt-in only where you got the details yourself during a sale or sale negotiations, you market only your own similar products or services, and you offered a free, simple opt-out when you collected the details.
- Check that a "service" email with promotional content still meets the marketing rules.
Don't
- Don't use pre-ticked boxes or "by signing up you agree to marketing" wording.
- Don't email bought or rented lists unless each person's consent names your organisation and covers email. The soft opt-in never applies to them, and publicly available addresses still need consent.
- Don't use the soft opt-in for people whose contact had nothing to do with buying, such as only browsing your site or asking a general question (asking for a quote, a free trial or product details can count), or for other companies' products.
- Don't assume "it's B2B" covers sole traders or named people's data. UK GDPR still applies to a named person's address.
Good to know
- Charities have their own soft opt-in. It covers people who showed interest in or supported the charity's purposes, for details the charity collected itself on or after 5 February 2026, with an opt-out offered at collection and in every message. The email must only further the charity's own purposes.
- The ICO says it is still developing guidance on how it will set the higher fines.
Sources
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 22 (legislation.gov.uk)
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 23 (legislation.gov.uk)
- How do we comply with the PECR electronic mail marketing rules? (ICO)
- Statement on the commencement of the Data (Use and Access) Act (DUAA) (ICO)
- One year on: marking the 12-month commencement of the Data (Use and Access) Act (ICO)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.