UK GDPR and Marketing Compliance: Consent, PECR and Cookies

What Is UK GDPR and Why Does It Matter to Marketers?

Almost every modern marketing activity uses personal data: email lists, loyalty schemes, website tracking and targeted adverts. In the UK, that data is governed by the UK GDPR, which sits alongside the Data Protection Act 2018, and by the Privacy and Electronic Communications Regulations 2003 (PECR), which deal specifically with marketing messages and cookies. Both are enforced by the Information Commissioner’s Office (ICO).

The UK GDPR began as the EU’s General Data Protection Regulation. After Brexit it was kept in UK law (now called “assimilated law”) and has since been amended by Parliament, so it is legally separate from the EU GDPR. A UK business selling into the EU may need to follow both. For the wider international picture, see our overview of data privacy regulations.

UK GDPR: Lawful Bases, Data Minimisation and the Right to Object

Under UK GDPR, every use of personal data needs a lawful basis. Two matter most in marketing. Consent must be freely given, specific, informed and clear, usually through an unticked box. Legitimate interests allows processing a business reasonably needs, provided a balancing test shows it does not override the individual’s rights.

From 5 February 2026, the UK GDPR names direct marketing as an example of a possible legitimate interest. The balancing test still applies, so campaigns are not automatically lawful. This is separate from the new, narrow list of “recognised legitimate interests”, such as crime prevention and safeguarding.

Data minimisation means collecting only what you need: a newsletter sign-up needs an email address, not a date of birth. And the right to object to direct marketing is absolute. If someone says “stop”, you must stop, with no exceptions.

PECR: The Rules for Emails, Texts, Calls and Cookies

Emails and texts to individuals. You need the person’s specific consent to receive marketing by email or text from you, and every message must identify the sender and offer a simple way to unsubscribe. This is the legal backbone of permission marketing.

The soft opt-in. A business may email or text its existing customers without prior consent if it obtained their details during a sale (or negotiations for a sale), it markets only its own similar products, and it gave a simple chance to opt out when collecting the details and in every message since. From 5 February 2026, registered charities can use a similar soft opt-in for supporters who have expressed interest in, or supported, their charitable purposes.

Business-to-business (B2B). PECR treats companies, LLPs and government bodies as “corporate subscribers”, so marketing emails to them do not need consent. However, sole traders and some partnerships count as individuals. A named work email address is still personal data under UK GDPR, so the right to object applies.

Phone calls. Live marketing calls must not be made to numbers registered with the Telephone Preference Service (TPS) unless the person has told you they are happy to be called.

Cookies. Placing cookies or similar trackers on a device needs consent unless an exemption applies. From 5 February 2026, new exemptions cover some low-risk uses, including analytics used only to improve your own website and cookies that remember a user’s display preferences. You must still tell users clearly and give them a simple, free way to object. Advertising cookies still need consent.

What Changed with the Data (Use and Access) Act 2025?

The Data (Use and Access) Act 2025 amended both UK GDPR and PECR in stages, with most marketing changes starting on 5 February 2026. Besides those above, the biggest change was to PECR fines. The ICO can now fine up to £17.5 million or 4% of global annual turnover, whichever is higher, matching UK GDPR (ICO, 2026). The previous PECR maximum was £500,000. From 19 June 2026, organisations must also have a process for handling data protection complaints.

Recent UK Enforcement

In January 2026, the ICO fined Allay Claims Ltd £120,000 for sending over four million texts. The company could not rely on the soft opt-in because it had not offered a simple way to refuse marketing when collecting customers’ details. In the same announcement, ZMLUK Limited was fined £105,000 for sending over 67 million marketing emails. Its “consent” came from a form that listed 361 partner companies with no way to choose between them (ICO, 2026). Later in 2026, KRA Consultancy Ltd was fined £300,000 (June) for 5.5 million unlawful texts to people in debt, and Elderly Aids Ltd £190,000 (August) for over 758,000 calls to TPS-registered numbers.

On cookies, by December 2025, 979 of the UK’s top 1,000 websites met ICO standards, many only after the regulator intervened (ICO, 2025). Banner design matters: studying popular UK websites, Nouwens et al. (2020) found that only 11.8% of consent pop-ups met minimal legal requirements. Removing the “reject” button from the first screen increased consent by 22 to 23 percentage points.

Compliance as Good Marketing

Compliance is not only about avoiding fines. Email marketing built on genuine consent reaches people who want to hear from you, and respecting privacy is part of doing the right thing for customers.

Summary

UK marketers work under UK GDPR, the Data Protection Act 2018 and PECR, all enforced by the ICO. Marketing emails and texts to individuals need consent unless the soft opt-in applies, and objections must always be honoured. Since 5 February 2026, the Data (Use and Access) Act 2025 has extended the soft opt-in to charities, added low-risk cookie exemptions and raised PECR fines to UK GDPR levels. This lesson is general education, not legal advice; check current ICO guidance for your situation.