Email and text marketing rules: what a small business must get right

Email and text messages are still some of the cheapest ways for a small business to bring customers back. They are also one of the few areas where the Information Commissioner's Office (ICO) hands out real fines to real companies. The rules sit in the Privacy and Electronic Communications Regulations, usually shortened to PECR, and they are older and simpler than most people expect. This guide explains what they say, where small firms trip up, and what to check this week.

The basic rule: consent first

The ICO's guidance for email and text marketing says you must not send marketing emails or texts to individuals without their specific consent. The rule covers more than email. The ICO lists texts, picture and video messages, voicemails and direct messages on social media as well.

Consent has to be freely given, specific, and based on a clear positive action, such as ticking an opt-in box. It must name your organisation and cover the type of message, so agreeing to emails does not automatically cover texts. The ICO recommends unticked opt-in boxes wherever possible and says that pre-ticked boxes do not give valid consent under the UK GDPR. It also says that wording buried in a privacy policy is unlikely to count if it is hard to find or rarely read.

Two practical points follow from this:

• Keep records of what each person agreed to, when, and how. The ICO asks for exactly this.
• Make withdrawing consent easy. People can change their mind at any time, and you should tell them how.

The soft opt-in: useful, but narrow

There is one well-known exception. You can market to your own existing customers without fresh consent if three things are true. They bought, or negotiated to buy, a similar product or service from you. You gave them a simple way to opt out when you first collected their details. And you offer an opt-out in every message you send.

The ICO is clear about what it does not cover. It does not apply to prospective customers or to new contacts, for example from bought-in lists. It also does not cover non-commercial promotion such as charity fundraising or political campaigning. So the café that emails its loyalty customers about a new menu is probably fine. The same café emailing a list of local office workers bought from a data broker is not.

If you do rely on consent from a third party, the ICO says that consent must specifically name you. Generic consent to receive marketing from "partners" or "selected companies" is not enough.

Who counts as an individual?

This catches out a surprising number of small firms. The ICO says sole traders and some partnerships are treated as individuals, so the consent and soft opt-in rules apply to them. You can email or text corporate bodies, such as limited companies, LLPs, Scottish partnerships and government bodies, without the same consent requirement. The ICO still treats keeping a "do not email or text" list as good practice. It also notes that emailing employees at personal corporate addresses may raise data protection considerations.

In practice, that means a business-to-business campaign is not a free-for-all. If half your list is plumbers, electricians and market traders who trade in their own name, treat them as individuals.

Opt-outs and identity

Every marketing message needs a valid contact address and a way to unsubscribe. The ICO expects you to act on opt-outs promptly, keep a "do not contact" list, and screen new marketing against it. There is no email or text equivalent of the Telephone Preference Service, so your own suppression list is the only protection you and your customers have. You must also not disguise or hide who is sending the message.

You are responsible for your agency and your tools

If a marketing agency, freelancer or automated tool sends messages for you, the responsibility does not disappear. The ICO's guidance says that where it takes action over marketing, it would usually take it against you as the instigator. The same applies to what the ICO calls viral marketing. If you send a marketing message, or instigate someone else to send one, the rules apply, and the ICO advises against asking customers for their friends' contact details.

That has a direct consequence for anyone using an automation platform or AI tool to send follow-up messages. The tool does not decide whether the recipient agreed. You do. If you are connecting a booking system, shop or CRM to a messaging tool, make sure the consent field travels with the contact record, so a customer who did not opt in never lands in a campaign. Our process automation work often involves exactly this kind of check.

What enforcement looks like

The headline fines go to large-scale spammers rather than local shops, but they show the ICO takes this seriously. In May 2026 the ICO fined KRA Consultancy Ltd £300,000 for sending over 5.5 million unsolicited direct marketing and fake bailiff texts, in breach of regulations 22 and 23 of PECR. The messages led to over 60,000 complaints to the 7726 spam reporting service.

A small business is unlikely to send millions of messages. The lesson is about complaints: ordinary recipients can report unwanted texts for free, and those reports are how the ICO finds targets. A short, honest, well-managed list is far safer than a large, vague one.

Guidance is under review

One caution before you rely on any of this. The ICO's own email marketing page says its guidance is under review because of changes made by the Data (Use and Access) Act, and that it may change. The core rules above are the ICO's current published position, but check the ICO site for updates before you build a long-term process around them.

A checklist for this week

• Find where your marketing list came from. If any of it was bought, scraped or inherited without clear consent, stop mailing it.
• Check your sign-up forms. Boxes should be unticked, the wording should name your business, and it should say whether you mean email, text or both.
• Record the date and source of each opt-in. A spreadsheet column is better than nothing.
• Test your unsubscribe link in every template, then check that opted-out people really are removed from every tool you use.
• Split sole traders from limited companies if you run business-to-business campaigns.
• Ask any agency or freelancer how they obtained consent, and get the answer in writing.
• Reply to opt-out requests quickly and keep the record.

The sensible approach

None of this should put you off marketing by email or text. Customers who asked to hear from you are more likely to open and respond, and they are far less likely to complain. If your website sign-up forms or booking flow need tidying so that consent is captured properly, our web design team can help. This article is general information, not legal advice, so for anything complex speak to a data protection adviser.