PECR regulations: marketing sign-ups and opt-out

The rule

The ICO reads this as covering texts as well as email. Its guidance says: “You must not send marketing emails or texts to individuals without specific consent.”

The ICO’s guide adds that the soft opt-in “does not apply to prospective customers or new contacts (eg from bought-in lists)”.

What counts as consent is set by the ICO’s guidance, which uses the UK GDPR standard: freely given, specific, informed and unambiguous, shown by a clear affirmative action. The guidance says you “must not use pre-ticked opt-in boxes, silence or inactivity as evidence of consent”, and that consent collected through a third party must name your organisation specifically.

The Act also changed enforcement. Schedule 13 to the 2025 Act, which commenced on 5 February 2026 under SI 2026/82, applies the Data Protection Act 2018 penalty machinery to PECR, including the “higher maximum amount” for the regulations it lists. Section 157 of the 2018 Act defines that amount as £17,500,000 or 4% of worldwide annual turnover, whichever is higher. Regulation 22 itself was also amended on 5 February 2026, with new paragraphs (3A) and (5). The fines described below were announced before that date.

What PeekWell checks and how

UK-11 asks what a visitor can see on your pages, and in the members area when you give Peeky a sign-in: where the site invites people to join a marketing list, does the wording ask clearly, and is there a visible way to stop?

The scan is automated. It finds the newsletter and marketing sign-up forms on your public pages, and in the members area when you give it a sign-in, and notes the consent wording around each one. Wording that looks bundled, vague, or silent about marketing by text is flagged. It also looks for an unsubscribe or opt-out line in any marketing it can reach on those pages, such as a newsletter’s web copy. The report quotes the form and the sentences behind each finding, so you can read them yourself.

The scan has limits, and the report says so. It doesn’t sign up, submit a form or read any email your business sends, so it can’t see whether an email carries an unsubscribe link, whether a stop request was acted on, or where an address came from. Those are the facts the ICO’s cases turn on, and they sit in your mail system and your records. The scan sees the public pages it visited, and the members area when you give it a sign-in. It doesn’t read your contracts. A Passed means the expected wording was observed on the pages scanned. It doesn’t say the sending complies.

The US sibling, US-14, asks the same kind of question under the American email rules. This article states the UK rule and its cases.

Why it matters for a company

The ICO’s published cases show what it looks at, and much of it starts with a sign-up. In HelloFresh, the ICO’s enforcement page describes an opt-in statement that did not refer to marketing by text and was bundled with an age confirmation statement that the ICO said was likely to unfairly incentivise customers to agree. It also records that customers were not told their data would be used for marketing for up to 24 months after cancelling. Each of those points is visible in the wording of a form. The penalty was £140,000 for about 79 million emails and 1 million texts over seven months.

ZMLUK turned on a sign-up on a third party’s website. The ICO’s January 2026 release says people were shown 361 partner companies and could not choose among them, so the consent was not specific or informed. The same release records Allay Claims, where the company failed to offer a simple way to refuse when details were collected and could not rely on the soft opt-in. The fines were £105,000 and £120,000.

Consent wording is evidence the ICO can read from outside, and the volumes in these cases are large because one list produces many messages. The rule also reaches whoever instigates the sending, so an agency or a bought list does not move the responsibility elsewhere.

Smaller companies and larger companies

The rules have no size threshold. A one-person shop that emails its customers and a national brand are asked the same questions.

In a small company the list often grows by accident. A web form plugin adds every customer who checks out, a box is pre-ticked by default, or a spreadsheet of old contacts is imported into a mailing tool. The soft opt-in is relied on without anyone checking that the sale, the similar products and the refusal option were all in place. Several of the cases here involve smaller companies. They show that the ICO pursues companies of that size when the volumes are high. In Allay’s case it records more than 46,000 reports through the 7726 service.

In a larger company there are many forms and many senders. One brand’s checkout, a competition page, an app and a partner’s landing page each collect addresses with different wording. Consent has to be recorded per purpose and per channel, and the HelloFresh decision shows that a mismatch between what the form said (email) and what was sent (texts) is something the ICO notices. Retention is a second issue: marketing to former customers months later needs the form to have said so.

How to fix it

1. List every place a person can join. Check the footer, checkout, account sign-up, competition pages, pop-ups and the contact form. Write down the exact sentence beside each one.
2. Make consent an empty box or a button. Remove any pre-ticked marketing box. Keep marketing consent separate from terms, age confirmations and other statements.
3. Say what people are joining. Name your business, say whether you will send email, texts or both, and give each channel its own wording or its own box.
4. Avoid pushing people towards yes. Keep marketing consent separate from other statements, and do not tie it to anything that pushes people to agree.
5. Say how long marketing continues after someone leaves. If you keep marketing to former customers, the form should say so at the start.
6. Put the stop option in every message and on the page. The footer link, the reply route and the address people can write to must all work, and your privacy notice should say how to stop messages.
7. Check where your list came from. Only use a bought-in list if the consent named your business. Keep a record of when, where and with what wording each person said yes.
8. Re-scan. Run a scan again once the forms are updated. Findings about vague or bundled consent wording and missing unsubscribe references should clear.

<label>
  <input type="checkbox" name="marketing_email" value="yes">
  Send me news and offers from Example Ltd by email.
</label>
<p>You can unsubscribe at any time using the link in every email.</p>

The sample is an empty box with a named sender and a stop route. Whether a particular list can rely on it is a question for your legal adviser, and Peeky reports only what it sees.