PECR Explained: Who Can You Email in the UK?
PECR consent rules for email marketing - individuals, subscribers, soft opt-in and lawful bases, explained clearly.
PECR sets out who you can email for marketing. This is general information, not legal advice - but it will help you understand the landscape before you build your list.
The headline rule
Under PECR you generally need consent to send marketing emails to individual subscribers. The ICO currently advises that the 'soft opt-in' route is not available for email marketing to individuals, so consent is normally required.
Individuals vs corporate subscribers
- Individual subscribers (people emailing from personal addresses): consent is generally required.
- Corporate subscribers (eg business email addresses like info@company or a named business contact): the rules are more nuanced and can involve legitimate interests. Take specific advice before relying on this.
What valid consent looks like
- Freely given, specific, informed and unambiguous.
- Given by a clear positive action.
- Separate from any other terms or consents.
- Capable of being withdrawn easily at any time.
- Properly documented.
Transactional messages
Service messages (order confirmations, password resets, delivery updates) aren't marketing and don't need marketing consent. But be careful: adding promotional content to a service message can turn it into marketing.
Take it seriously
PECR breaches carry fines and damage trust. The safest path for most UK businesses is a clear, documented consent-based approach. For anything beyond that, get professional advice and check the ICO's current guidance.