Are your marketing emails, SMS blasts, and cold calls actually lawful under UK regulations? Many marketing teams assume GDPR covers everything. But there is a separate, equally important law that governs how you reach people electronically. It is called PECR, and ignoring it can cost your business up to 500,000 pounds in fines.
The Privacy and Electronic Communications Regulations (PECR) sit alongside UK GDPR and set strict rules for direct marketing through electronic channels. Whether you send promotional emails, run SMS campaigns, or make marketing calls, PECR applies to every message. For marketers, understanding this law is not optional. It is a business-critical requirement.
This blog breaks down exactly why PECR compliance for marketers matters, what the rules demand, and how you can run high-performing campaigns without falling foul of the ICO. If you run any form of electronic marketing in the UK, this is the guide you need.
PECR stands for the Privacy and Electronic Communications Regulations 2003. It is a UK law that controls how organisations use electronic channels for marketing.
PECR was introduced to protect individuals from unsolicited electronic marketing. It covers emails, SMS, phone calls, faxes, and automated calling systems. Every time your marketing team hits send on a campaign, PECR governs whether that action is lawful or not.
Unlike UK GDPR, which covers the broader processing of personal data, PECR focuses specifically on the communication channel. It tells you when you can send, who you can send to, and what consent you need before reaching out.
The Information Commissioner’s Office (ICO) enforces PECR in the UK. Since March 2022, the ICO has issued 49 monetary penalty notices totalling 4.63 million pounds for PECR breaches. The average fine sits at roughly 94,490 pounds per case. These are not theoretical risks. They are active enforcement actions against real businesses.
HelloFresh received a 140,000-pound fine in January 2024 for sending 80.9 million unsolicited messages. Quick Tax Claims Limited was fined 120,000 pounds for 7.8 million unwanted contacts. For marketers, every campaign that skips proper consent is a potential enforcement case.
PECR does not replace UK GDPR. Both laws apply at the same time when marketing involves personal data. You need a lawful basis under UK GDPR, and you must meet PECR’s consent rules for the communication channel. Complying with one does not automatically cover the other. Marketers must satisfy both frameworks simultaneously.
PECR sets different rules depending on the channel you use and whether you are contacting individuals or businesses.
For business-to-consumer (B2C) marketing, you must obtain prior consent before sending emails or SMS messages. This means the recipient must actively agree to receive your communications. Pre-ticked boxes, buried terms, or assumed consent do not qualify. The standard of user consent under PECR aligns with UK GDPR requirements. It must be freely given, specific, informed, and unambiguous.
For business-to-business (B2B) marketing, the rules are more relaxed. You can send marketing emails to corporate email addresses without prior consent. However, if the email address identifies a specific person, data protection rules still apply. You must always identify yourself as the sender and offer a clear way to opt out.
Live marketing calls do not require prior consent. However, you must screen your calling lists against the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS) at least every 28 days. If a number appears on these registers, you cannot call it unless the person has specifically consented to hear from you.
Automated or pre-recorded marketing calls require prior consent from the recipient. There are no exceptions for this rule, regardless of whether you are contacting individuals or businesses.
PECR also governs cookies and similar tracking technologies. You must tell visitors what cookies you use, explain their purpose, and collect valid consent before setting any non-essential cookies. This directly affects marketing activities like retargeting, conversion tracking, and behavioural advertising. Without proper cookie consent, the data behind your campaigns may be unlawfully collected.
PECR includes one valuable exception that gives marketers more flexibility. It is called the soft opt-in, and understanding the difference between opt-in vs opt-out is essential to using it correctly.
The soft opt-in lets you send marketing emails or SMS to existing customers without explicit consent, provided certain conditions are met. This is particularly useful for e-commerce brands, subscription services, and any business with a direct sales relationship.
However, this is a PECR mechanism, not a shortcut around UK GDPR. You still need a lawful basis for processing the personal data involved in the communication.
Many marketers assume all existing customers automatically fall under the soft opt-in. That is wrong. If you bought a marketing list, the soft opt-in does not apply. If the customer enquired about one product but you market something entirely different, the soft opt-in does not apply. Each of the five conditions must be met, or the exemption fails entirely.
PECR compliance is not just about avoiding fines. It directly affects how well your campaigns perform and how much trust your audience places in your brand. Adopting consent-based marketing practices is a proven route to stronger engagement and better results.
When you send messages only to people who have genuinely consented, your email deliverability improves. Internet service providers and email platforms track sender reputation. Lists full of unengaged or non-consenting recipients trigger spam filters, reduce inbox placement, and lower your open rates.
Marketers who follow PECR rules naturally maintain cleaner lists. Cleaner lists mean higher open rates, better click-through rates, and stronger return on every campaign you send.
People notice when brands respect their communication preferences. A clear opt-in process tells your audience that you value their choice. This builds trust, and trust drives repeat purchases, referrals, and long-term customer value.
On the other hand, unsolicited messages damage your brand. They generate complaints, increase unsubscribe rates, and can trigger ICO investigations. The short-term gain from sending to non-consenting contacts rarely outweighs the long-term cost.
ICO fines for PECR breaches currently reach up to 500,000 pounds. Under proposed reforms through the Data Use and Access Act, penalties could rise to 17.5 million pounds or 4% of global turnover. Beyond the financial hit, enforcement actions are published publicly. Your brand name appears in ICO records alongside the violation details, causing reputational harm that outlasts the fine itself.
Here is a practical framework your marketing team can use to stay compliant. Avoiding consent fatigue while still collecting valid permissions requires a thoughtful approach.
Review how every contact on your marketing lists provided their consent. Check whether the consent was freely given, specific, and recorded with a timestamp. If you cannot prove consent, you should not be sending marketing to that contact.
This also means reviewing any third-party lists you may have purchased. Under PECR, contacts from bought lists almost never meet the consent standard required for lawful electronic marketing.
Make sure every sign-up form, checkout page, and lead capture point includes a clear, unticked consent checkbox for marketing communications. The opt-out must be just as easy as the opt-in. Unsubscribe links must work instantly. SMS campaigns must honour STOP replies without delay.
If your team makes marketing calls, you must check numbers against the TPS and CTPS registers at least every 28 days. Set up a recurring process to ensure this never slips. Calling a registered number without specific consent is a direct PECR violation.
PECR does not operate in isolation. Marketers must understand how it connects with other privacy laws that affect campaigns.
When you send a marketing email, PECR governs whether you can send it. UK GDPR governs how you handle the personal data behind it. You need to satisfy both. For example, you might rely on the soft opt-in under PECR for the communication itself, but you still need a lawful basis under UK GDPR for processing the recipient’s email address and any segmentation data.
Understanding which of the best consent management platforms suits your setup can help you manage consent records across both frameworks efficiently.
The UK government’s Data Use and Access Act proposes significant reforms to PECR. Penalties for certain PECR breaches would increase dramatically, aligning them with UK GDPR fine levels. The Act also proposes changes to cookie consent rules and how direct marketing regulations are enforced.
For marketers, this means the compliance bar is rising. Teams that build solid PECR-compliant processes now will be better positioned when stricter rules take effect.
PECR implements the EU ePrivacy Directive in the UK. If your campaigns target EU audiences, you also need to comply with each member state’s own ePrivacy implementation. The rules are broadly similar, but specific requirements can vary. Running international campaigns without checking local electronic marketing laws is a compliance risk many marketers overlook.
PECR compliance for marketers is not a box-ticking exercise. It shapes how your brand communicates, how your audience responds, and how regulators view your business. The rules are clear: obtain proper consent, respect opt-out requests, and screen your contact lists. Marketers who treat PECR as a growth tool rather than a restriction will build stronger, more profitable customer relationships.
Managing consent across email, SMS, and telephone marketing takes more than a spreadsheet. Seers.ai gives your marketing team the tools to collect, record, and manage consent properly, so every campaign meets PECR standards without slowing down your growth.
Start Free TodayPECR stands for the Privacy and Electronic Communications Regulations 2003. It is a UK law that regulates electronic marketing channels including email, SMS, telephone calls, faxes, and cookies. The law sets out when organisations can contact individuals and businesses for marketing purposes and what level of consent is required for each channel.
PECR treats B2B emails differently from B2C emails. You can send marketing emails to generic corporate addresses like info@ or sales@ without prior consent. However, if the email is sent to a named individual at a business, data protection rules apply alongside PECR. You must always include sender identification and a working opt-out mechanism in every message.
UK GDPR covers how you collect, store, and process personal data. PECR specifically governs the electronic communication channel you use to reach people. Both laws apply simultaneously when marketing involves personal data. Meeting PECR requirements does not automatically satisfy UK GDPR obligations, so marketers need to comply with both frameworks separately.
The ICO can currently impose fines of up to 500,000 pounds for PECR breaches. Under proposed changes through the Data Use and Access Act, penalties could increase to 17.5 million pounds or 4% of global annual turnover, whichever is higher. Directors and officers can also face personal liability if breaches happen with their knowledge or consent.
SMS falls under the definition of electronic mail in PECR. For B2C SMS marketing, you need prior consent from the recipient unless the soft opt-in exception applies. The soft opt-in requires five conditions to be met, including direct collection of the contact details during a sale or negotiation and offering an opt-out at the point of collection.
PECR requires organisations to screen their calling lists against the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS) at least every 28 days. If a number is registered on either service, you cannot make marketing calls to it unless the person has specifically consented to receive calls from your organisation.
The soft opt-in is a PECR exception that lets you send marketing emails or SMS to existing customers without explicit consent. Five conditions must be met: you collected the details directly, during a sale or negotiation, for similar products only, with an opt-out offered at collection, and with an opt-out included in every message. Purchased lists never qualify.
PECR Regulation 6 governs cookies and similar tracking technologies. You must inform visitors about what cookies you use, explain their purpose clearly, and obtain valid consent before placing non-essential cookies. This directly affects marketing tools like retargeting pixels, conversion tracking scripts, and behavioural advertising technologies used across campaigns.
The Data Use and Access Act proposes several changes to PECR enforcement. Maximum penalties would increase significantly to match UK GDPR fine levels. Cookie consent rules may also be reformed. Marketers should prepare now by building robust consent processes, because compliance requirements are tightening rather than relaxing under the proposed legislation.
Start by auditing consent records for every contact on your marketing lists. Ensure every sign-up form includes an unticked consent checkbox. Screen telephone lists against TPS and CTPS every 28 days. Include working unsubscribe mechanisms in every email and SMS. Use a consent management platform to centralise records and automate compliance checks across channels.
Rimsha ZafarRimsha is a Senior Content Writer at Seers AI with over 5 years of experience in advanced technologies and AI-driven tools. Her expertise as a research analyst shapes clear, thoughtful insights into responsible data use, trust, and future-facing technologies.
Take our Free Cookie Audit and find out
Join 50,000+ websites using Seers.Ai to turn compliance into trust, insights, & measurable business growth.
