UK Email Marketing Rules: Consent and 3 Soft Opt-In Tests

Quick answer

UK marketing emails are governed by PECR as well as UK GDPR. Individuals and sole traders need prior consent, unless the soft opt-in applies: you got their details during a sale or negotiation, you market only similar products, and you offer an opt-out at collection and in every email. Limited companies can be emailed without consent, with an opt-out.

Most small businesses know “GDPR” means they should be careful with email lists, but the specific rules for marketing emails live in a different law that gets far less attention: the Privacy and Electronic Communications Regulations, usually called PECR. This guide explains who you can email, what valid consent looks like, how the soft opt-in works for existing customers, what every marketing email must include, and the common mistakes that put small businesses on the wrong side of the rules. It is a practical summary, not legal advice.

PECR and UK GDPR: which law does what

Think of it in two layers. UK GDPR covers how you collect, store and use personal data in general: having a lawful reason, keeping it secure, telling people what you do with it. PECR adds specific rules for electronic marketing: emails, texts and calls. When you send a marketing email to a person, both apply.

The core rule is regulation 22 of the Privacy and Electronic Communications Regulations 2003: you must not send unsolicited marketing emails unless the recipient has previously told you they consent, with one exception for existing customers, known as the soft opt-in. Everything else in this guide flows from that.

One practical note: the ICO says its guidance on electronic mail marketing is under review because of the Data (Use and Access) Act and may change. Check it for updates before relying on any detail.

Who you are emailing changes the rules

This matters a great deal for trades and B2B suppliers. A builders’ merchant emailing local tradespeople is often emailing sole traders, so the consumer-style rules apply, even though it feels like business-to-business marketing.

What valid consent looks like

Consent under UK GDPR has a high bar. The ICO’s guidance on what valid consent is describes it as freely given, specific, informed and unambiguous, given by a clear affirmative action. It states that silence, pre-ticked boxes or inactivity should not be treated as consent, and that you must be able to show consent was given.

In practice, valid consent for email marketing means:

• An unticked box, or a separate sign-up form, that the person actively chooses.
• Wording that names your business and says what they will receive, such as “monthly offers and tips by email”.
• Consent that is not bundled into your terms and conditions or made a condition of a quote.
• A record of who signed up, when, where and what they were shown.

The soft opt-in for existing customers

The soft opt-in is the most useful rule for small businesses, and the most misunderstood. Under regulation 22(3), you can email someone without prior consent if all three conditions are met:

1. You obtained their contact details in the course of a sale, or negotiations for a sale, of a product or service to them.
2. Your marketing is about your own similar products and services only.
3. You gave them a simple, free way to refuse marketing when you collected their details, and you give one in every message.

A heating engineer who services someone’s boiler can usually email them a reminder offer for next year’s service under the soft opt-in, provided they offered an opt-out when taking the booking. Someone who asked for a genuine quote and did not go ahead may also count, because the regulation covers negotiations for a sale as well as completed sales; the ICO guidance explains where the line sits. The ICO notes the exception does not cover prospective customers you have never dealt with, bought-in lists, or non-commercial promotions.

What every marketing email must include

Whoever you email, and under whichever rule, the ICO guidance is clear on a few points:

• Do not disguise or conceal who you are. Your business name should be obvious in the sender name and the email.
• Give a valid way to opt out, such as an unsubscribe link or a reply address that works.
• Act on opt-outs promptly and keep a suppression list so people are not added back later.
• Screen new lists against that suppression list before sending.

Even for limited companies, where consent is not required, the ICO suggests keeping a “do not email” list of businesses that have objected.

Sign-up forms that comply

Your website is where most consent is collected, so get the forms right. A compliant sign-up form:

• Has an email field and, at most, a first name. Collect only what you need.
• Says in one line what people are signing up for and how often.
• Uses an unticked checkbox on contact or quote forms, separate from the enquiry itself.
• Links to your privacy notice.
• Stores the date, time, form and wording alongside the address.

If your website’s contact form is unreliable in the first place, fix that before adding marketing consent to it; our guide to a contact form that is not working covers the common causes.

Common mistakes and how to fix them

A proper sending platform also helps with deliverability. If your emails are going to spam, our guide to business emails going to spam explains the technical setup.

A worked example: a plumber’s customer list

Take a plumbing and heating firm with three sources of email addresses: past customers from invoices, people who filled in the website quote form, and a spreadsheet of local letting agents collected from their websites.

• Past customers who paid for a job can usually receive emails about boiler servicing, repairs and similar work under the soft opt-in, as long as they were given a chance to opt out when they booked. If no opt-out was offered at the time, the firm should ask for consent rather than assume.
• Quote form enquiries are covered only if the form offered an opt-out or an unticked consent box. Adding one now fixes future enquiries; older ones need asking.
• Letting agents that are limited companies can be emailed without consent, with the firm clearly identified and an unsubscribe link in every email. Any that are sole traders or ordinary partnerships need consent first.

The same list, three different rules. Tagging each contact with its source when it is added makes this simple to manage later.

Records to keep

If anyone ever complains, your records are your defence. For each subscriber, keep the date and time they joined, the form or situation, the wording they saw, and for soft opt-in contacts, the sale or quote it relates to. Keep unsubscribes permanently on a suppression list, even after deleting the rest of the record. Most email platforms store sign-up data automatically if you connect your website forms to them rather than copying addresses across by hand.

Getting your email marketing set up properly

Done well, email is one of the cheapest ways to bring back past customers. If you would rather not set up the platform and sequences yourself, see our email marketing automation service. If you need a dedicated page to collect sign-ups, a landing page is £199, and a custom WordPress website is £499 with contact forms connected to your inbox. All prices are on the pricing page.