United KingdomPECR, Electronic Mail for Direct Marketing Purposes
PECR (S.I. 2003/2426), regs. 22 and 23
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since .
A commercial messages rule binding public and private bodies.
As of .
What it requires
- Get the individual recipient's prior consent before sending, or instigating the sending of, unsolicited electronic mail, which reaches SMS and other messaging as well as email, for direct marketing purposes, unless the soft opt-in below applies.
- You do not need consent if you obtained the recipient's contact details in the course of a sale or sale negotiation with them, you market only your own similar products or services, and you gave the recipient a simple, free means of opting out at the time the details were collected and with every later message.
- From , a charity does not need consent to email or text someone to further its own charitable purposes if it obtained their details because they expressed an interest in, or offered or gave support to, those purposes, and gave them a simple, free means of refusing at collection and with every later message.
- Do not disguise or conceal the identity of the person on whose behalf a marketing message is sent, and always provide a valid address the recipient can use to ask you to stop.
- Do not send a marketing message that breaks the Electronic Commerce (EC Directive) Regulations 2002's identification rules for commercial communications, or that encourages the recipient to visit a website that breaks them.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
The PEC Regulations' own enforcement route (reg. 31 and Sch. 1) applies Data Protection Act 2018 s.157 with modifications. Schedule 1 paragraph 18(b)(ii), as substituted by the Data (Use and Access) Act 2025, Sch. 13 (in force under S.I. 2026/82, reg. 2(z14)), gives a failure to comply with regulation 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23, 24 or 32B(4) or (5) the higher maximum amount defined at Data Protection Act 2018 s.157(5): the greater of £17,500,000 or 4 percent of worldwide annual turnover for an undertaking, or £17,500,000 for anyone else. Every other PEC Regulations contravention keeps the lower, standard maximum amount under s.157(6) (the greater of £8,700,000 or 2 percent, or £8,700,000).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commissioner's Office (ICO), exercising the enforcement powers Schedule 1 applies to it under regulation 31 of the Regulations.
What it reaches
Obligation class
Consent, Disclosure
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Regulation 22 requires an individual subscriber's prior consent before sending, or instigating the sending of, unsolicited electronic mail (a term that reaches SMS and other messaging, not only email) for direct marketing purposes, unless a soft opt-in applies because the sender obtained the recipient's details in a sale or sale negotiation, markets only its own similar products or services, and gave the recipient a free opt-out at collection and with every later message.
Since the Data (Use and Access) Act 2025 gives a charity the same soft opt-in where it obtained the recipient's details because the recipient expressed interest in, or offered support for, the charity's own charitable purpose, on the same free opt-out terms.
Regulation 23 separately bars sending a direct-marketing email that disguises or conceals the sender's identity or that omits a valid address for the recipient to ask that such communications stop, and bars one that would contravene, or that encourages a visit to a website that would contravene, the labelling and identification rules of the Electronic Commerce (EC Directive) Regulations 2002.
When LexLint raises it
automated_outreach
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.