Email marketing and UK law: what PECR and UK GDPR actually let you do

Every marketing email your business sends sits at the intersection of two laws: the Privacy and Electronic Communications Regulations (PECR), which governs the sending of marketing messages, and the UK GDPR, which governs the personal data underneath. The ICO enforces both, has fined household-name companies, and publishes guidance that is actually readable.

Consent: the default position

The default rule for marketing to individuals is consent — freely given, specific, informed, and unbundled. A pre-ticked box is not consent. A checkbox bundled into terms and conditions is not consent. An email address collected for a receipt is not consent for a newsletter. Consent means the person actively chose to receive marketing, knowing what they were choosing.

The soft opt-in: the useful exception

PECR’s most practical allowance is the soft opt-in. You may email existing customers — people who bought from you or negotiated to buy — about your own similar products and services, provided three conditions hold: you got their details during a sale or negotiation for one, you gave them a clear chance to opt out when you collected the details, and you give them a clear opt-out in every subsequent message. Sell them a coffee machine; you may email them about coffee beans. You may not email them about insurance.

The mechanical requirements

• Identify yourself: the sender must be clear in every message — no disguised addresses.
• Working unsubscribe: every marketing email must offer an easy opt-out that actually works, promptly.
• B2B is still regulated: the rules apply to sole traders and many partnerships as individuals; “it was a work email” is not a defence.
• Keep records: who consented, when, and to what — you may need to prove it.

The definitive guidance — including the edge cases this article simplifies — is the ICO’s direct marketing guidance. The rules summarised here are correct at the time of writing.

Compliance as a feature

The businesses that handle this well treat the rules as design constraints, not obstacles: a clear sign-up that says exactly what subscribers get, a welcome email that restates the expectation, an unsubscribe that works in one click. None of that costs anything but attention — and it converts a legal obligation into a signal of trustworthiness that the inbox rewards.

The flip side is reputational as much as legal: a complaint to the ICO from a handful of annoyed recipients is a headache no small business needs, and the fix — tighten consent, clean the list — is always cheaper than defending the practice after the fact.

The audit trail matters as much as the practice. Keep a record of who consented, when, and via which form — because the ICO’s question is never “did you mean well?” but “prove it”. A spreadsheet of consent dates is cheap insurance that turns a potential complaint into a two-minute answer.

None of this should scare anyone off email — it remains the highest-return channel most small businesses have. The rules are a floor, not a ceiling: consent given gladly, content worth opening, and an unsubscribe honoured instantly. Do those three things and you are compliant and effective at once.