You collected customers' emails and phone numbers when they bought from you, so can you now send them marketing? Sometimes yes, sometimes only with consent. In England and Wales, electronic marketing is governed mainly by PECR (the Privacy and Electronic Communications Regulations 2003), backed by the UK GDPR. Here is how to stay on the right side of the rules.
Two rulebooks, both apply
- PECR sets specific rules for electronic marketing, emails, texts and phone calls.
- The UK GDPR / Data Protection Act 2018 governs the personal data behind it (the contact details themselves).
You need to satisfy both.
Email and text marketing to individuals: consent is the default
For marketing emails and texts to individuals (including sole traders and partnerships), the general rule under PECR is that you need prior consent, a clear, specific, opt-in agreement, not a pre-ticked box.
The "soft opt-in" exception
There is an important exception that lets you market to existing customers without fresh consent. You can email or text a customer about your own similar products or services, without separate consent, if all of these apply:
- you obtained their details in the course of a sale (or negotiations for a sale) of your product or service;
- you are marketing your own similar products or services; and
- you gave them a simple way to opt out when you collected the details, and in every message since.
The soft opt-in can apply not only to existing customers but also to people whose details you obtained during genuine negotiations for a sale, even if they did not go on to buy, provided the other conditions are met. But you generally cannot rely on it for a bare enquiry that did not amount to sale negotiations, or to promote unrelated third-party products.
Phone calls
Live marketing calls can be made to individuals who have not opted out and are not registered with the Telephone Preference Service (TPS), you must screen against the TPS. Automated marketing calls require prior consent.
Always allow opt-out, and respect it
Every marketing message must offer an easy way to unsubscribe, and you must act on opt-outs promptly (keeping a suppression list). Under the UK GDPR, individuals also have an absolute right to object to direct marketing.
What about B2B?
Marketing to corporate subscribers (companies and limited liability partnerships) is treated more flexibly under PECR than marketing to individuals, but the underlying personal data (a named person's work email) is still subject to the UK GDPR, so transparency and the right to object still apply.
Practical checklist
- Map how you obtained each contact and whether you have consent or a valid soft opt-in.
- Keep records of consent.
- Put an easy unsubscribe in every message and maintain a suppression list.
- Screen marketing calls against the TPS.
- Provide a clear privacy notice explaining your marketing.
Key takeaways
- Electronic marketing is governed by PECR plus the UK GDPR.
- Email/text marketing to individuals generally needs consent, unless the soft opt-in applies (existing customers, own similar products, easy opt-out).
- Marketing calls require TPS screening; automated calls need consent.
- Always offer easy opt-out and honour the right to object.
Sources
- Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), including the soft opt-in
- UK GDPR and Data Protection Act 2018 (lawful basis, right to object)
- ICO direct marketing guidance; Telephone Preference Service
--- This article is general information about the law of England & Wales as at 2026, not legal advice. For advice on your circumstances, consult a qualified solicitor.