# Direct marketing and the Privacy and Electronic Communications Regulations (PECR)

> **Key takeaway:** Electronic mail/SMS marketing to individuals: needs prior consent, or the narrow reg 22(3) soft opt-in (existing customer, own similar products, opt-out offered throughout). Calls: reg 21, check TPS registration. PECR consent is separate from, and stricter than, a UK GDPR Art 6 basis, which is still needed regardless.

- **Jurisdiction:** England & Wales
- **Practice area:** Commercial
- **Last reviewed:** 2026-09-05
- **Interactive page:** https://www.kttclegal.info/library/notes/Commercial/direct-marketing-and-pecr
- **Keywords:** PECR, direct marketing, soft opt-in, electronic mail marketing, telephone marketing, consent, unsolicited marketing, UK GDPR

## What is this about?

Direct marketing by electronic means is governed primarily by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), which sit alongside, and impose stricter consent requirements than, UK GDPR. PECR is the reason most electronic marketing needs opt-in consent even where UK GDPR alone might permit processing under legitimate interests.

## What is the core rule?

PECR regulation 22 prohibits unsolicited direct marketing by electronic mail (including email and SMS) to individual subscribers unless the recipient has given prior consent, subject to the narrow 'soft opt-in' exception in reg 22(3): the sender obtained the contact details in the course of a sale or negotiations for a sale to that person, the marketing is for the sender's own similar products or services, and the recipient was given a clear, free opportunity to opt out at collection and in every subsequent message. Regulation 21 imposes similar restrictions on live and automated telephone marketing calls, cross-referencing the Telephone Preference Service. Where PECR permits marketing (consent obtained, or the soft opt-in applies), the processing of the personal data involved is still separately subject to UK GDPR, and a lawful basis under Art 6 is still required for that processing.

## What are the elements or test?

1. Is this 'direct marketing' — the communication of advertising or marketing material directed at particular individuals?
2. What channel is used — electronic mail (reg 22), live/automated calls (reg 21), or another PECR-regulated channel?
3. For electronic mail to individuals: has valid prior consent been obtained, or does the reg 22(3) soft opt-in exception apply in full (sale/negotiation, own similar products, opt-out offered at collection and each message)?
4. For calls: has the recipient consented, or objected/registered with the Telephone Preference Service?
5. Separately: is there a valid UK GDPR Art 6 lawful basis for the underlying processing of the marketing data?
6. Is an easy, free unsubscribe/opt-out mechanism provided in every communication?

## Which authorities matter?

- **Privacy and Electronic Communications (EC Directive) Regulations 2003, reg 22** — The core prohibition on unsolicited electronic mail marketing absent consent, subject to the soft opt-in exception.
- **PECR, reg 22(3)** — Sets the three cumulative conditions for the 'soft opt-in' exception to the consent requirement.
- **PECR, reg 21** — Separately regulates live and automated telephone marketing calls.
- **UK GDPR, Art 6** — A lawful basis is still required for the personal data processing involved in marketing, even where PECR consent/soft opt-in is satisfied.
- **ICO guidance on direct marketing** — The ICO's primary enforcement guidance on PECR, including business-to-business marketing and the soft opt-in in practice.

## How does this apply in practice?

This note focuses on electronic mail and call marketing to individual subscribers; business-to-business marketing to corporate subscribers is treated differently under PECR and is not developed in detail here. PECR enforcement (including fines) is carried out by the ICO under a separate but related regime from UK GDPR enforcement. Marketing via post is regulated by UK GDPR alone, not PECR.

## What are common pitfalls?

- Relying on UK GDPR legitimate interests to justify email marketing while ignoring that PECR's stricter consent rule applies on top
- Misapplying the soft opt-in exception where the products marketed are not genuinely 'similar' to those originally purchased
- Failing to offer an opt-out at the point of collection as well as in every subsequent marketing message, as reg 22(3) requires
- Buying or renting marketing lists without verifying the original consent covers the new sender and this type of marketing
- Treating a purchased list's 'GDPR compliant' label as sufficient without checking PECR consent specifically

## When would a practitioner use this?

Relevant to any client running email, SMS, or telephone marketing campaigns, and central to responding to ICO enforcement action or complaints about unsolicited marketing.

## Quick reference

Electronic mail/SMS marketing to individuals: needs prior consent, or the narrow reg 22(3) soft opt-in (existing customer, own similar products, opt-out offered throughout). Calls: reg 21, check TPS registration. PECR consent is separate from, and stricter than, a UK GDPR Art 6 basis, which is still needed regardless.

---

*Reference material from [KTTC Legal](https://www.kttclegal.info/), not legal advice. Work product supports instructing solicitors and barristers under their supervision. England & Wales.*