In the UK you can send marketing email to people who have clearly agreed to it, or to existing customers under the soft opt-in, as long as every email offers a simple way to unsubscribe. PECR sets the rules and UK GDPR covers the data. This is a plain summary, not legal advice.
The Privacy and Electronic Communications Regulations (PECR) decide who you can send marketing email to. UK GDPR decides how you collect, store and use their personal data. The Information Commissioner’s Office (ICO) regulates both. The Data (Use and Access) Act 2025 is bringing PECR fines up to UK GDPR levels, so the stakes have gone up.
For individuals, the default is consent: a clear, positive action such as ticking an unticked box or entering an address in a form that says what they will get. Pre-ticked boxes do not count. Keep a record of when and how each person signed up. Your email platform usually does this for you.
A specific promise at signup helps here as well as with results. The list growth page covers how to word it.
You can email existing customers without explicit consent if all of these are true:
For most shops, that means a checkout with an unticked or clearly worded opt-out, and an unsubscribe link in every email.
Want this checked on your own account? The free audit does it by hand, in five working days.
Get the free auditSee pricingThe consent rule under PECR does not apply to corporate subscribers, such as limited companies and their employees’ work addresses. You still have to identify yourself and offer an opt-out. Sole traders and some partnerships count as individuals, so treat them like consumers. The wholesale guide covers trade lists.
Honour unsubscribes promptly. Gmail and Yahoo expect it within two days, which is stricter in practice than the law.
Do not buy or rent lists of individuals. They almost never have valid consent for you, and they damage deliverability as well as breaking the rules. If you have an old list with no record of how people joined, a single re-permission email is safer than a campaign, and suppressing the rest is safer still.
If you sell to the US or Australia as well, the rules differ. The New York and Sydney pages cover them.
Yes, under the soft opt-in, if you gave them a chance to opt out at checkout, you are marketing similar products, and every email includes an unsubscribe.
Not for limited companies under PECR, but you must identify yourself and offer an opt-out. Sole traders need consent like consumers.
No. Consent has to be a positive action.
No. It is a plain summary. For anything unusual, check the ICO’s guidance or ask a solicitor.