Are Email Campaigns Legal in the UK?

Short answer: yes. Sending marketing emails and texts is entirely legal in the UK, and the rules are clear enough that a small business can follow them without a legal department. They sit in two places. The Privacy and Electronic Communications Regulations 2003 (PECR) decide whether you may send an unsolicited marketing message at all. UK GDPR and the Data Protection Act 2018 govern how you collect, store and use the personal data behind it. The Information Commissioner’s Office (ICO) enforces both.

This page is general information, not legal advice. If you are unsure how the rules apply to your organisation, speak to a UK data-protection solicitor.

What PECR actually requires

Regulation 22 of PECR says you must not send unsolicited marketing by “electronic mail” to an individual subscriber unless they have specifically consented, or an exemption applies. Electronic mail includes email, SMS and MMS, so the same rule covers your newsletter and your text campaigns. Individual subscribers include consumers, sole traders and some partnerships. Before any send, ask three questions:

• Did this person consent? Consent must meet the UK GDPR standard: freely given, specific, informed and unambiguous, shown by a clear positive action. A pre-ticked box or silence does not count. Our glossary explains what makes consent valid.
• If not, does the soft opt-in apply? See the next section.
• Is the recipient a corporate subscriber? Emails to limited companies, LLPs and public bodies don’t need prior consent under PECR, but you must still identify yourself and offer a working opt-out. A named employee’s work address is also personal data, so UK GDPR still applies.

Every marketing message must also say who it is from and give a valid address where people can opt out. Disguising or concealing the sender breaches Regulation 23.

The soft opt-in for existing customers

The soft opt-in lets you email or text your own customers without separate consent when all of these are true:

1. you obtained their details during a sale, or negotiations for a sale, of a product or service;
2. you are marketing your own similar products or services;
3. you gave them a simple way to refuse marketing when you collected their details, and you repeat that option in every message.

It only works for the organisation that collected the details. You can’t pass it to a partner or a sister brand, and it never applies to a bought or rented list.

New in 2026: the charitable purposes soft opt-in

The Data (Use and Access) Act 2025 created an equivalent route for charities. Since 5 February 2026, a charity may send electronic marketing about its charitable purposes to people who have expressed an interest in, or offered support for, those purposes, provided the charity collected their details directly and offered an opt-out at that point and in every message. The ICO published guidance on using it in April 2026. Details gathered by a trading subsidiary or a third-party fundraising platform do not qualify.

Fines: why the £500,000 figure is out of date

For years the maximum PECR fine was £500,000, and many UK guides still quote it. That cap has gone. The Data (Use and Access) Act 2025 brought PECR penalties into line with UK GDPR, so since 5 February 2026 the ICO can fine up to £17.5 million or 4% of global annual turnover, whichever is higher. The ICO can also issue enforcement notices that order you to stop sending, and it publishes its enforcement action, so the reputational cost arrives alongside any penalty.

Tracking pixels count too

PECR’s rule on storing or accessing information on a user’s device applies to tracking pixels in emails as well as to website cookies. The 2025 Act added some consent exemptions, for example for certain analytics used only to produce aggregate statistics, and the ICO finalised its updated guidance on storage and access technologies in April 2026. If you measure opens, say so in your privacy notice and check the current ICO guidance.

A compliant UK send, step by step

1. Collect sign-ups with an unticked box or a double opt-in form, naming email and SMS separately.
2. Keep a record of when, where and on what wording each person agreed.
3. Show your trading name, a contact address and an unsubscribe link in every message. One-click unsubscribe is also what Gmail and Yahoo expect from bulk senders.
4. Honour opt-outs promptly and keep the address on a suppression list so it is never re-imported.
5. Never buy lists. Consent given to someone else does not transfer to you, as our article on why bought lists backfire explains.

Where Mailpro fits

Mailpro has been built around European privacy law since 2001, and contact data is hosted on private infrastructure in Switzerland, outside US jurisdiction. The UK recognises Switzerland as providing adequate protection, so keeping UK contacts there does not normally require extra transfer safeguards such as the International Data Transfer Agreement. For the wider framework, including UK GDPR principles and the ICO fee, read our overview of UK email marketing law, then see how to collect permission that stands up to scrutiny.