What changed for UK marketing fines on 5 February 2026?
The maximum fine for breaking the UK's electronic marketing rules rose to £17.5 million or 4% of worldwide turnover. The Information Commissioner's Office (ICO) said so in its statement of 5 February 2026, the day the next phase of the Data (Use and Access) Act 2025 (DUAA) commenced. The commencement regulations, made on 29 January 2026, brought section 115 and Schedule 13 of the Act, which update how the Privacy and Electronic Communications Regulations (PECR) are enforced, into force on that date.
The figure comes from section 157 of the Data Protection Act 2018. Its higher maximum amount is £17,500,000 or, for an undertaking, 4% of total annual worldwide turnover in the preceding financial year, whichever is higher. Schedule 13 of the DUAA applies that higher maximum to breaches of PECR's marketing rules, including regulation 22 (consent for marketing email to individuals) and regulation 23 (sender identity and opt-out address).
| Breach before 5 Feb 2026 | Breach on or after 5 Feb 2026 | |
|---|---|---|
| Rules used for enforcement | PECR as it stood before 5 February 2026 (SI 2026/82, reg. 11) | PECR as amended by the DUAA (SI 2026/82, reg. 11) |
| Maximum fine | Up to £500,000, the figure still given in the ICO's Guide to PECR, a page the ICO marks as under review | £17.5m, or 4% of worldwide turnover if higher, for an undertaking (DPA 2018, s. 157) |
| New investigation powers | Can be used on earlier conduct, but sanctions follow the old rules (reg. 8) | Include compelling witnesses to attend interviews and requesting technical reports (ICO) |
Is cold email legal in the UK?
PECR lets you send unsolicited marketing emails to corporate subscribers without consent, and requires consent or the soft opt-in for individual subscribers. Regulation 22, the email marketing rule, applies to individual subscribers only. The ICO's detailed email guidance, updated on 28 April 2026, says you can send unsolicited electronic mail marketing to corporate subscribers without consent or a soft opt-in.
Regulation 23 applies to every marketing email, whoever receives it. You must not disguise or conceal the identity of the person the message is sent for, and you must give a valid address where the recipient can ask you to stop. The email must also not breach regulation 7 of the Electronic Commerce Regulations 2002, which requires a commercial communication to be clearly identifiable as one and to identify the person on whose behalf it is made. The ICO adds that PECR does not expressly say you must honour a company's opt-out from email, but that you should comply with it anyway.
The rules also cover more than named email addresses. The ICO's key concepts page says PECR applies even if you only hold a generic or role-based address, and that electronic mail covers texts, picture and video messages, voicemail, in-app messages and private direct messages on social media as well as email.
Corporate or individual subscriber: how do you tell?
Look at the recipient's legal form. A subscriber is the person or organisation named on the bill for the communications service. Regulation 2 defines corporate subscribers as companies, companies incorporated by royal charter or letters patent, Scottish partnerships, corporations sole and any other body that is a legal person distinct from its members. The ICO's business-to-business guidance lists sole traders, non-limited-liability partnerships in England, Wales and Northern Ireland, and other unincorporated bodies as individual subscribers, which PECR treats the same as individuals.
| Who you are emailing | PECR status | Unsolicited marketing email without consent? |
|---|---|---|
| An employee at a limited company, at their work address | Corporate subscriber, because the subscriber is the employer | Allowed under PECR; UK GDPR applies if the address identifies the person |
| A limited liability partnership or a Scottish partnership | Corporate subscriber | Allowed under PECR |
| A sole trader | Individual subscriber | Only with consent or the soft opt-in |
| An ordinary partnership in England, Wales or Northern Ireland | Individual subscriber | Only with consent or the soft opt-in |
| A business contact who gave you a personal email address | Individual subscriber | Only with consent or the soft opt-in |
| Anyone whose status you cannot confirm | Treat as an individual subscriber, the ICO advises | Only with consent or the soft opt-in |
The ICO's own worked examples make the line concrete. A recruitment company emails the HR director of a limited company: the consent and soft opt-in rules do not apply because the address is a corporate subscriber, but the address names the director. When the director asks it to stop, the company stops and adds the address to its do-not-contact list. In another example, an online building supplies firm is aware that many of its customers are likely to be sole traders, so it adds an opt-out tick box at checkout and an unsubscribe option in every email, which lets it rely on the soft opt-in. A conference organiser that emails delegates would breach PECR, the ICO says, for any delegate who used a personal address, unless it had consent or met the soft opt-in.
What does the soft opt-in allow?
The soft opt-in lets you email individual subscribers without consent only about your own similar products or services, and only if you collected their details yourself during a sale or negotiation. The ICO lists five conditions, and all must be met:
- You obtained the contact details from the person directly.
- You did so while selling, or negotiating to sell, a product or service.
- You market only your own similar products and services.
- You offered a simple way to opt out when you collected the details.
- You offer the opt-out again in every later message.
Negotiation is broader than a purchase. The ICO says signing up to a free trial, requesting a quote or asking for more details about what you offer can count, while browsing a website does not. For cold outreach, though, the rule rarely helps. The ICO's Guide to PECR, which it marks as under review, says the soft opt-in does not apply to new contacts such as those from bought-in lists, and its detailed guidance puts it bluntly: “There is no such thing as a third-party marketing list that is compliant with the soft opt-in.” The opt-out must be offered when you collect the details; adding one to an order confirmation email is too late.
Since 5 February 2026 there has been a second soft opt-in, for charities only, under regulation 22(3A). The ICO says charities may use it only for contact details obtained on or after that date.
Does UK GDPR still apply when you email a business?
Yes, whenever you process personal data, and an email address that identifies a person counts. The ICO says the UK GDPR applies to B2B marketing if you can identify the individual, even when they act in a business capacity. If you do not know the person's name and write to a generic address, you are not processing personal data and the UK GDPR does not apply to that marketing, though PECR still does.
- Lawful basis. Where PECR does not require consent, the ICO says legitimate interests is likely to be the appropriate basis in many cases, after a three-part test: identify the interest, show the processing is necessary, and balance it against the person's interests, rights and freedoms. The ICO's DUAA overview notes the Act clarifies that direct marketing can be a legitimate interest.
- Privacy information. If you collected the details from somewhere other than the person, such as a website, the ICO says you must give privacy information within a reasonable period and no later than one month, unless an exception applies.
- Objections. A named business contact has an absolute right to object to direct marketing. If they object, you must stop using their data for it.
- Public data. You cannot assume someone agrees to direct marketing because their details are public. The ICO does say a person whose business contact details are on their employer's website may well expect contact from other businesses.
Do the same rules cover LinkedIn and X messages?
Yes, PECR's electronic mail rules cover private direct messages on social media, and the ICO adds a point about professional networks. Its B2B guidance says people on professional networking sites are unlikely to be there only as representatives of their employer. If someone uses such a platform in a personal, albeit professional, capacity, sending them direct marketing messages is not considered B2B marketing. You must comply with the UK GDPR when you collect and use their data, and with PECR if you market to them electronically. The passage does not say which subscriber category applies to such a message.
If you run LinkedIn or X outreach alongside email, apply the same checks to each channel. Our comparison of cold email, LinkedIn and X covers how the channels differ in practice.
A UK cold email checklist for this week
Sort your list by legal form, cut anyone you cannot email, and make every message identifiable and easy to stop. These steps are our suggestions based on the ICO's guidance:
Tag every contact by legal form
Mark each recipient as a company, LLP, Scottish partnership, sole trader or ordinary partnership. Where you cannot tell, treat the contact as an individual subscriber, as the ICO advises.
Remove individual subscribers without consent
Sole traders, ordinary partnerships and personal addresses come out unless you hold consent or meet all five soft opt-in conditions.
Identify yourself and give a way out in every email
Name the business you write for, make clear the email is marketing, and give a working reply address or unsubscribe link in every message, including follow-ups. Our cold email templates leave room for both, and our guide to cold email sequences covers follow-up timing.
Keep a do-not-contact list
When someone objects or opts out, add them to a suppression list instead of deleting their record, and screen every new list against it. The ICO recommends this for companies as well as people.
Write down your UK GDPR basis
Record a legitimate interests assessment for named contacts, and send privacy information within a reasonable period and no later than one month after collecting their details from another source.
Frequently asked questions
Can I send a cold email to a sole trader in the UK?
Only with their consent or if the soft opt-in applies. PECR treats sole traders as individual subscribers. The ICO says the soft opt-in needs contact details you collected yourself during a sale or negotiation, marketing of your own similar products, and a simple opt-out when you collected the details and in every message. It does not cover prospects from bought-in lists.
Is an LLP a corporate subscriber under PECR?
Yes. The ICO lists limited liability partnerships as corporate subscribers, along with companies, Scottish partnerships and some government bodies. Other partnerships, such as ordinary English, Welsh and Northern Irish partnerships, are individual subscribers. You can email corporate subscribers without consent under PECR, but you must identify yourself and give a valid opt-out address, and UK GDPR applies to named contacts.
What is the maximum PECR fine in 2026?
For breaches on or after 5 February 2026, up to £17.5 million or, for an undertaking, 4% of total annual worldwide turnover in the preceding financial year, whichever is higher. That comes from section 157 of the Data Protection Act 2018 as applied to PECR by the Data (Use and Access) Act 2025. Earlier breaches are handled under PECR as it stood before that date; the ICO's Guide to PECR, marked as under review, still gives a maximum of £500,000.
Do I need consent to email someone at a limited company?
Not under PECR. The ICO says an employee's address at a corporate body is a corporate subscriber because the subscriber is their employer. If the address identifies the person, UK GDPR applies: you need a lawful basis, often legitimate interests after a three-part test, you must give privacy information, and you must stop if they object.
Is this article legal advice on PECR?
No. It summarises PECR, the Data (Use and Access) Act 2025 commencement rules and the ICO's guidance as checked on 20 October 2026. The ICO marks several of its PECR pages as under review after the Act, so wording may change. Take advice from a UK data protection lawyer before relying on any rule here for your own campaigns.
Sources
- ICO: Statement on the commencement of the Data (Use and Access) Act (published 5 Feb 2026)
- legislation.gov.uk: The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82) (made 29 Jan 2026)
- legislation.gov.uk: Data Protection Act 2018, section 157 (checked 20 Oct 2026)
- legislation.gov.uk: Data (Use and Access) Act 2025, Schedule 13 (checked 20 Oct 2026)
- legislation.gov.uk: PECR 2003, regulation 2 (checked 20 Oct 2026)
- legislation.gov.uk: PECR 2003, regulation 22 (checked 20 Oct 2026)
- legislation.gov.uk: PECR 2003, regulation 23 (checked 20 Oct 2026)
- ICO: Business-to-business marketing (checked 20 Oct 2026)
- ICO: Guide to PECR, Electronic mail marketing (checked 20 Oct 2026)
- ICO: Guide to PECR, What are PECR? (checked 20 Oct 2026)
- ICO: Guidance on direct marketing using electronic mail (updated 28 Apr 2026)
- ICO: How do we comply with the PECR electronic mail marketing rules? (checked 20 Oct 2026)
- ICO: Key concepts for direct marketing using electronic mail (checked 20 Oct 2026)
- ICO: The DUAA, what does it mean for organisations? (checked 20 Oct 2026)
- GOV.UK: Data (Use and Access) Act 2025, plans for commencement (updated 12 Oct 2026)
- GOV.UK: Data (Use and Access) Act factsheet: ICO (checked 20 Oct 2026)
- legislation.gov.uk: Electronic Commerce (EC Directive) Regulations 2002, regulation 7 (checked 20 Oct 2026)