Marketing emails, texts and calls: the maximum fine is now £17.5m

On 5 February 2026 the maximum fine for breaking the marketing rules in PECR rose from £500,000 to £17,500,000, or 4% of total annual worldwide turnover if that is higher. The rules on when you may send a marketing message did not change — with one exception, a new soft opt-in for charities.

Last updated 31 July 2026. This page explains the law as it stands on that date. It is general information, not legal advice.

What the maximum fine is now, and which breaches attract it

Section 115(8) of the Data (Use and Access) Act 2025 replaced Schedule 1 to the Privacy and Electronic Communications Regulations 2003 (PECR) with the Schedule set out in Schedule 13 to that Act. The change came into force on 5 February 2026 under SI 2026/82.

The new Schedule 1, paragraph 18 applies section 157 of the Data Protection Act 2018 to PECR. That section sets the 'higher maximum amount' at £17,500,000 or 4% of an undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher. For anything that is not an undertaking, it is £17,500,000. The 'standard maximum amount', which applies to any PECR breach not on the list below, is £8,700,000 or 2%.

Paragraph 18 names the regulations that attract the higher maximum: 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23, 24 and 32B(4) and (5). In plain terms that is the entire direct marketing suite — automated calls (19), faxes (20), live calls (21), claims management calls (21A), pensions calls (21B), email and text (22), concealing your identity or failing to give an opt-out address (23), and failing to identify yourself on a call (24). It also covers regulation 6, the cookies and similar technologies rule, and regulation 5, security.

Has consent changed, or only the penalty?

Only the penalty, plus the charity change below. Regulation 22 still says you must not send unsolicited direct marketing by electronic mail to an individual subscriber unless they have consented or a soft opt-in applies. None of the following moved:

• Consent still takes its meaning from the UK GDPR: freely given, specific, informed and unambiguous, with a positive action. No pre-ticked boxes.
• Every marketing email or text must still carry a simple, free way to opt out, and must not disguise who sent it (regulation 23).
• Live marketing calls must still be screened against the TPS and CTPS, and automated calls still need specific consent.
• The UK GDPR was amended by the Act, not replaced. If you are processing personal data for marketing, it still applies alongside PECR.

Section 110 of the Act tightened PECR's interpretation provisions from the same date. A 'call' now includes an *attempt* to establish a connection. A 'communication' now covers information *transmitted to* a party, rather than exchanged or conveyed between parties. And where information is sent but not received, 'recipient' means the intended recipient — so a text that never arrives can still be a breach. The same section writes a standalone definition of 'direct marketing' into PECR.

The soft opt-in, and when you can actually use it

The products and services soft opt-in lets you email or text an individual subscriber without consent. The ICO's position is that all of these must be true:

1. You obtained the contact details yourself, directly from that person.
2. You obtained them while selling, or negotiating to sell, a product or service.
3. You are only marketing your own similar products or services.
4. You gave a clear opportunity to opt out at the point you collected the details.
5. You give an opportunity to opt out in every message you send afterwards.

'Negotiating a sale' means the person actively expressed an interest in buying — an enquiry about a product, a quote request, a free trial sign-up. Browsing your site is not enough. Nor is an enquiry about something other than buying. And the opt-out must be offered *when you collect the details*: putting it in the order confirmation is too late.

Charities: a second soft opt-in, but check the collection date

Section 114 of the Act inserted a new regulation 22(3A). From 5 February 2026 a charity may send direct marketing by electronic mail — email, text or social media direct message — without prior consent, where all of the following apply: you are a charity within the relevant UK definition, which the Act ties to the Charities Act 2011, the Charities Act (Northern Ireland) 2008 or the Scottish Charity Register; you obtained the contact details in the course of the person expressing an interest in, or offering or providing support to further, your charitable purposes; the sole purpose of the marketing is to further those charitable purposes; you offered a simple, free means of refusal at collection; and you offer one in every later message.

Two further limits. The charitable purposes soft opt-in cannot be used to promote other organisations, including other charities. And charities must not use the ordinary products and services soft opt-in to send electronic mail about campaigning or fundraising, even to existing supporters. Where both soft opt-ins apply, the ICO expects separate opt-out boxes for each, at collection and in every later message.

Cold emailing businesses, and where sole traders sit

PECR splits recipients into corporate subscribers and individual subscribers. Companies, LLPs, Scottish partnerships and some public bodies are corporate — and so is any other unincorporated body of persons in Scotland. Sole traders, ordinary partnerships and other unincorporated bodies outside Scotland are individual subscribers and get the same protection as private individuals.

Cold B2B email to a limited company is therefore lawful under PECR without consent. But regulation 23 still applies to every message: identify yourself and give a valid opt-out address. And if the address identifies a person — j.smith@company.co.uk — you are processing personal data, so you need a lawful basis under the UK GDPR, you must provide privacy information, and the right to object to direct marketing is absolute. Where you cannot tell which type of subscriber an address belongs to, the ICO's advice is to take the cautious route and treat it as an individual subscriber.

New ICO powers, and what it is enforcing right now

The substituted Schedule 1 imports Data Protection Act 2018 enforcement machinery into PECR. The practical additions are the power to compel a witness to attend an interview, the power to require a report from an approved person, and assessment notices in place of the old PECR audit provision in regulation 5B, which was removed. The Data Protection Act 2018 penalty regime also contains no requirement to show substantial damage or substantial distress.

In a blog on 23 June 2026 the ICO said it is "currently developing separate guidance to cover these higher fines", while noting that the law has commenced and that it can and will use the new powers where necessary for the most serious cases.

Enforcement is active. On 29 July 2026 the ICO executed search warrants at residential and business premises linked to five companies in Bolton, Burnley, Liverpool, London and Swansea, over car finance claim texts. The ICO says it has received more than 12 million complaints about unwanted marketing texts linked to car finance claims since September 2025, at up to 100,000 a day, and that the five companies are believed responsible for a combined 170 million texts between September 2025 and May 2026. The action sits within a joint taskforce with the FCA, the ASA and the SRA. Andy Curry, the ICO's Head of Investigations, said: "This week's searches send a clear message to the claims management sector: comply with the law or expect to hear from us."

Fines are still landing at pre-February levels because the conduct predates the change. KRA Consultancy Ltd was fined £300,000 — a penalty notice dated 20 May 2026, announced on 23 June 2026 — for 5,575,715 unsolicited and fake bailiff texts sent between April 2022 and May 2025, under regulations 22 and 23. Jacksons Marketing Ltd was fined £130,000, announced on 8 July 2026, for more than 230,000 calls to TPS-registered numbers over an 11-month period. Treat these as evidence of what the ICO pursues, not of the new ceiling in use.

What to check in your marketing stack this quarter

1. Step 1 Prove your permission, record by record For every contact on a marketing list, you should be able to say whether you rely on consent, the products and services soft opt-in, the charitable purposes soft opt-in, or corporate subscriber status — and show when and how you obtained the details.
2. Step 2 Flag sole traders and partnerships They are individual subscribers. If your B2B list mixes limited companies with sole traders and you cannot tell them apart, the ICO's advice is to treat the whole list as individual subscribers.
3. Step 3 Check the opt-out is offered at collection A prominent opt-out on the form or a verbal offer at the point of collection. An opt-out that first appears in the confirmation email does not meet the soft opt-in.
4. Step 4 Check every send template A working unsubscribe link or STOP code, free of charge, in every message. No account login required to unsubscribe. A clear sender identity.
5. Step 5 Charities: separate your lists by date Only details collected on or after 5 February 2026, through an expression of interest or offer of support, can sit on the charitable purposes soft opt-in. Keep separate preference flags for each basis.
6. Step 6 Look at your cookie banner too Regulation 6 is on the higher-fine list. The exceptions added to PECR in February 2026 are narrow — statistical purposes, adapting appearance or functionality, software updates and emergency assistance — and none of them covers advertising or marketing tracking.

Common questions

Sources

This page summarises the following primary sources. Where they disagree with this summary, they take precedence.

• Data (Use and Access) Act 2025, section 115 (Commissioner's enforcement powers under PECR)
• Data (Use and Access) Act 2025, section 110 (interpretation of the PEC Regulations)
• Data (Use and Access) Act 2025, section 114 (use of electronic mail for direct marketing by charities)
• PECR 2003, Schedule 1, paragraph 18 (modification of DPA 2018 s.157)
• Data Protection Act 2018, section 157 (maximum amount of penalty)
• PECR 2003, regulation 22 (use of electronic mail for direct marketing)
• SI 2026/82 — DUAA 2025 commencement and transitional and saving provisions
• ICO — DUAA summary of changes: privacy and electronic communications
• ICO — How do we comply with the PECR electronic mail marketing rules?
• ICO — Business-to-business marketing
• ICO — Charities given new flexibility to contact supporters under data law change (28 April 2026)
• ICO — One year on: marking the 12-month commencement of the Data (Use and Access) Act (23 June 2026)
• ICO — Multiple properties searched across UK after millions of car finance complaints (31 July 2026)
• ICO — Two home improvement companies fined £370,000 for nuisance calls targeting vulnerable people (8 July 2026)
• ICO — Manchester firm fined £300,000 for bombarding people in debt with over 5.5 million unlawful texts (23 June 2026)