- The law
- PECR regulation 23; Electronic Commerce (EC Directive) Regulations 2002, regulations 6 and 7
- Who enforces it
- Information Commissioner's Office (ICO)
- Penalties
- Up to £17.5 million or 4% of global turnover (whichever is higher) since the Data (Use and Access) Act 2025 changes of 5 February 2026
What’s changed (2026/27 edition). Since 5 February 2026, fines for breaking the email rules can reach £17.5 million or 4% of global turnover.
What it means for your email
- You must not disguise or conceal the identity of the person or business the email is sent for. The ICO says this applies to both individual and business recipients.
- Every marketing email must give a valid address that people can use to ask you to stop.
- The email must be clearly identifiable as a commercial communication, and must clearly identify who it's sent on behalf of.
- Promotional offers, such as discounts, gifts and competitions, must be clearly identified as such, with their conditions easy to find and clearly worded.
- Linking to a website that breaks these e-commerce rules also breaks PECR.
Do
- Use a from name and footer that name the brand the email is really from.
- When an agency sends for a client, make the client's identity clear.
- Label offers and competitions plainly and link to their terms.
- Keep the opt-out address valid. See the UK unsubscribe card for how to handle requests.
Don't
- Don't send from a name or address designed to look like someone else.
- Don't dress marketing up as a personal note or a service message.
- Don't hide the conditions of an offer or prize draw.
Good to know
- Under regulation 6 of the e-commerce rules, you must make your name, geographic address and email address, plus your company register number and VAT number where they apply, easy for recipients to find at all times (usually on your website and in the email footer).
- These identity rules apply whether or not the person asked for the email.
Sources
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 23 (legislation.gov.uk)
- The Electronic Commerce (EC Directive) Regulations 2002, regulation 6 (legislation.gov.uk)
- The Electronic Commerce (EC Directive) Regulations 2002, regulation 7 (legislation.gov.uk)
- How do we comply with the PECR electronic mail marketing rules? (ICO)
- Statement on the commencement of the Data (Use and Access) Act (DUAA) (ICO)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.