Email is still one of the most cost-effective ways to stay in touch with customers. It’s also the channel where business owners most often worry about getting the rules wrong, usually with good reason. Here are the UK email marketing rules in plain English.
In the UK, two sets of email marketing rules matter. The Privacy and Electronic Communications Regulations (PECR) cover when you can send electronic marketing. UK GDPR covers how you handle the personal data involved. The Information Commissioner’s Office (ICO) enforces both.
This guide covers the basics in plain English. It isn’t legal advice, and if your situation is unusual, or you’re planning something large, it’s worth speaking to a data protection specialist and reading the ICO’s own guidance, which is clear and free.
What counts as marketing
PECR applies to direct marketing, which broadly means any message promoting your products, services, aims or ideals. Newsletters, offers, event invitations and “we’ve got a new service” emails all count.
Purely administrative messages usually don’t. An order confirmation, a delivery update, an appointment reminder or a notice about changes to your terms are service messages. But be careful: if you add a promotional block to the bottom of a service email, it can become marketing.
Emailing individuals: consent or the soft opt-in
If you’re emailing individuals, which includes sole traders and some partnerships as well as consumers, you generally need one of two things.
Consent
Consent has to be freely given, specific, informed and given by a clear positive action. In practice that means:
- An unticked box, or a clear sign-up form, not a pre-ticked box
- Plain wording about what they’ll get and who it’s from
- Consent that isn’t buried in your terms and conditions or made a condition of buying
- A record of when and how each person signed up
The soft opt-in
The soft opt-in lets you email existing customers without separate consent, as long as all of these apply:
- You got their details during a sale, or during negotiations for a sale (such as a quote)
- You’re marketing your own similar products or services
- You gave them a simple chance to opt out when you collected their details
- You give them a simple way to opt out in every message
The soft opt-in doesn’t cover people who simply downloaded a free guide or entered a competition without any sales conversation, and it doesn’t let you market unrelated products or pass details to other businesses.
How the email marketing rules treat businesses
PECR treats “corporate subscribers” differently. Limited companies, LLPs, government bodies and similar organisations can generally be sent marketing emails without prior consent. You must still say who you are, include a valid way to contact you and honour opt-out requests.
That doesn’t mean anything goes. A named person’s work email address is still personal data under UK GDPR, so you need a lawful basis (often legitimate interests), you need to tell people how you use their data, and your emails should be relevant to their role. And remember that sole traders and some partnerships count as individuals, so the consent rules above apply to them.
If you can’t show how and when someone agreed to hear from you, or that they’re an existing customer who was given the chance to opt out, don’t send them marketing.
Bought lists, unsubscribes and record keeping
Buying or renting an email list is where many businesses fall foul of the email marketing rules. For emailing individuals, consent has to be specific enough to cover you by name, and generic “selected third parties” wording is unlikely to be enough. Bought lists also tend to be low quality, which hurts your deliverability even if the legal side were sound. Growing your own list is slower but much safer.
A few habits keep you on the right side of the email marketing rules:
- Make unsubscribing easy. One click, no login, no “are you sure” maze.
- Act on opt-outs promptly. Any reputable email platform will do this automatically.
- Keep a suppression list. Don’t delete people who unsubscribe, flag them, so they aren’t re-imported by accident.
- Keep records of consent. Date, time, source and the wording they saw.
- Update your privacy notice. It should explain what you collect, why and how people can object.
- Tidy your list. Remove people who haven’t engaged for a long time, or ask them if they still want to hear from you.
A quick audit you can do this week
Open your email platform and your sign-up forms and check:
- Every form has clear wording and no pre-ticked boxes
- You can see where each contact came from
- Customers were given an opt-out when you collected their details
- Every email has a working unsubscribe link and your business details
- Your privacy notice mentions email marketing
If any of these fail, fix the form first, then decide what to do about existing contacts. Where you’re unsure whether you have valid permission for part of your list, a re-permission campaign asking people to confirm is usually the cleaner route, but ask for it before the old permission is in doubt, not after.
Doing email properly
Getting the email marketing rules right is the foundation, not the finish line. Our email marketing service sets up compliant sign-up forms, clean lists and campaigns people actually want to open. If you’d like sign-ups to trigger welcome emails and follow-ups automatically, we can also build that through marketing automation.
