UK email marketing rules: who you can contact, and how

This is general information about UK rules, checked on the date above. It is not legal advice, and rules change. For a decision that matters, check the sources below or ask a qualified adviser.

Most small businesses assume that if a contact is another business, marketing emails are fine. That is only half right. The rule that catches people out is that a sole trader is treated like a member of the public, so the local plumber you want to contact may be protected in a way that a limited company is not.

The short version

• You must not send marketing emails or texts to individuals without specific consent, apart from a limited exception for your own previous customers.¹
• Sole traders and some partnerships count as individuals under these rules.²
• Limited companies and LLPs are “corporate subscribers”, and the consent rule does not apply to them.²
• You must never hide who you are, and you must give a valid address for opting out.¹

The law

The rules are in regulation 22 of the Privacy and Electronic Communications Regulations 2003, usually called PECR. It says a person must not send unsolicited direct marketing by electronic mail unless the recipient has previously consented, subject to a specific exception.³ The ICO notes that “electronic mail” has an intentionally broad meaning, which includes texts and newer forms of messaging, so this is not just about email.¹

Who counts as what

This distinction decides almost everything.

The classifications come from the ICO’s business-to-business guidance.² It gives an example of an online building supplies company whose customers are likely to include sole traders, which is exactly why you cannot assume that a trade customer is a corporate body.²

So before you send a cold email to a business, check what kind of business it is. Companies House will show you whether a company is registered.

What the soft opt-in allows

The soft opt-in is the limited exception for your own customers. According to the ICO, it applies where someone bought something from you recently, gave you their details and did not opt out, and it lets you market similar products or services to them. You must give a clear chance to opt out both when you collected their details and in every message.¹

It does not apply to prospective customers or new contacts, for example from bought-in lists.¹

Corporate does not mean anything goes

Even when the consent rule does not apply, other rules do:

• Identify yourself. You must not disguise or conceal your identity, and must provide a valid contact address so people can opt out.¹
• Respect opt-outs. PECR does not explicitly say you must comply with a corporate subscriber’s opt-out, but the ICO says you should, and recommends keeping a “do not email or text” list and screening new lists against it.²
• UK GDPR still applies. If you are processing personal data, such as a named person’s work email, UK GDPR applies even in a business context. You must tell them about it and have a lawful basis. This includes publicly available personal data.²
• People can object. Businesses and business contacts can object to your direct marketing, and can withdraw consent at any time.²

The ICO does enforce this

In January 2026, the ICO announced fines totalling £225,000 against two companies. One was fined £120,000 for more than 4 million unlawful marketing texts. The other was fined £105,000 for over 67 million marketing emails sent using data from third parties, where people were not given clear and informed choices.⁴

Those are large operators, but the second case shows why buying a list is risky. The ICO is also updating its guidance in this area, so check the current version before you run a campaign.⁵

Replies are not marketing campaigns

Replying to someone who enquired is normally different from sending them marketing. It is ordinary customer service, and that is what an automatic acknowledgement does. Be careful not to slide into promotion. If your “thanks for your enquiry” email also pushes a special offer, you may have turned it into a marketing message.

A safe approach for a small business

This is our practical summary, and it is not legal advice:

1. Keep a record of how you got each contact, and which type of subscriber they are.
2. Do not buy lists.
3. Contact sole traders only with consent, or as your own customers under the soft opt-in.
4. Make every marketing email easy to opt out of, and act on opt-outs immediately.
5. Keep one suppression list, and check it before every send.
6. Send relevant messages in small numbers. A short, personal note about something useful to that business is better for everyone.

Keeping this straight is easier when all your contacts are in one system. Our lead generation software can record where each lead came from, and we do not offer bought lists or bulk cold email. If you want to win more of the enquiries you already get, start with how fast you reply.