- The law
- PECR regulations 22–23; UK GDPR
- Who enforces it
- Information Commissioner's Office (ICO)
- Penalties
- Up to £17.5 million or 4% of global turnover (whichever is higher) since the Data (Use and Access) Act 2025 changes of 5 February 2026
What’s changed (2026/27 edition). Since 5 February 2026, fines for breaking the email rules can reach £17.5 million or 4% of global turnover.
What it means for your email
- Every marketing email must include a valid address or link where people can ask you to stop.
- This applies to every subscriber type, including emails to companies.
- For soft opt-in contacts, the opt-out must be simple and free of charge apart from the cost of sending the request, at collection and in every message after.
- The ICO says "You should act promptly to respect their wishes." The law sets no fixed number of days.
- The ICO says you should not ask people to create an account, or log in to an existing one, to unsubscribe.
Do
- Put a working unsubscribe link in every marketing email, and test it in a real inbox before sign-off.
- Add people who opt out to a suppression list, and apply it to every system and list that sends marketing.
- Make withdrawing consent as easy as giving it.
- Name the sender clearly in the from name and footer.
Don't
- Don't hide the link, break it or make it depend on a password.
- Don't charge for opting out or send people to a premium-rate number.
- Don't keep emailing someone who has opted out because they are on another list or in another tool.
- Don't disguise or conceal who the email is from.
Good to know
- Under UK GDPR, people also have the right to object to their data being used for direct marketing at any time.
- Sender identification is a separate rule (regulation 23): you must not disguise or conceal your identity in a marketing email.
Sources
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 22 (legislation.gov.uk)
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 23 (legislation.gov.uk)
- How do we comply with the PECR electronic mail marketing rules? (ICO)
- Statement on the commencement of the Data (Use and Access) Act (DUAA) (ICO)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.