UK charity soft opt-in: What charities need to know

The introduction of the charity soft opt-in was widely welcomed across the sector. Brought in through the UK’s Data Use and Access Act 2025 (DUAA) and available to use from February 2026, the change allows charities to send certain electronic marketing communications without obtaining explicit consentA clear and unambiguous expressed statement of consent. This can be provided in writing, by filling out online forms using electronic signatures, or even via oral statements (so long as the conditions for valid consent have been met)., provided specific conditions are met. 

By aligning charities to the existing soft opt-in model available to commercial organisations, the change was expected to help charities strengthen supporter engagement and unlock additional fundraising opportunities. 

However, adoption appears slower than many anticipated. Whilst some charities have embraced the change, others have delayed implementation or decided not to use it at all.  

In this blog, we explore why some charities are hesitant to adopt the exemption, what the Information Commissioner’s OfficeThe United Kingdom’s independent ‘supervisory authority’ for ensuring compliance with the UK GDPR, Data Protection Act 2018, the Privacy and Electronic Communications Regulations etc. (ICOThe Information Commissioner's Office (ICO) is the United Kingdom’s independent supervisory authority for upholding information rights in the public interest, ensuring compliance with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).) guidance tells us about its practical limitations, and the steps organisations should take before implementing the charity soft opt-in. 

Key takeaway: The charity soft opt-in creates new opportunities for supporter engagement, but successful implementation requires more than updating marketing preferences. Charities must carefully consider how supporter data is collected, how fundraising activities are delivered, and whether the exemption aligns with supporter expectations and organisational data collection processes.  

• What is the charity soft opt-in? 
• Why are charities reluctant to switch to soft opt-in? 
• What does the ICO guidance say about soft opt-in? 
• What should charities do before implementing soft opt-in? 
• Frequently asked questions 

What is the charity soft opt-in?

Under the UK’s Privacy and Electronic Communications RegulationsPECR is the UK implementation of the ePrivacy Directive (Directive 2002/58/EC) providing certain rules on marketing, cookies, communication services security and customer privacy (in relation to traffic/location data, billing, line identification and caller directories). (PECR), organisations require an individual’s consentAn unambiguous, informed and freely given indication by an individual agreeing to their personal data being processed. before sending electronic marketing communications, unless a specific exemption applies.  

Section 114 of the Data Use and Access Act (DUAA) introduced a new exemption for charities, known as the ‘charity soft opt-in’.  It allows charities to send certain electronic marketing communications, such as fundraising emails and text messages, without obtaining explicit consent.  

To rely on the exemption, charities must meet the following conditions: 

• Only organisations that meet the legal definition of ‘charity’ under the Charities Act can rely on the exemption (or Scottish/Northan Irish equivalent) 
• Contact details must have been collected on or after 5 February 2026 
• The individual must have expressed an interest in, or offered support to, the charity’s charitable purposes 
• The contact details must have been collected directly by the charity (third-party marketing lists do not qualify) 
• A simple notice and opt-out must be provided when the contact details are collected, with an unsubscribe option in every subsequent communication 
• The sole purpose of each communication must be to further the charity’s charitable purposes 

The exemption came into force on 5 February 2026 but cannot be applied retrospectively. This means charities cannot rely on the soft opt-in for contact details collected before that date.  

Whilst the charity soft opt-in creates a new way for charities to communicate with supporters, it is not a blanket permission to send marketing communications. Charities must ensure all conditions are met and continue to comply with their wider data protection obligations. 

Why are charities reluctant to switch to soft opt-in?

The introduction of the charity soft opt-in represents a significant shift in how marketing communications can be delivered, giving charities greater flexibility to communicate with supporters and fundraise more effectively.  

However, many charities have been more cautious than expected. For some, the challenge is not the legislation itself but deciding how to use the exemption in a way that aligns with existing fundraising practices, supporter expectations, and organisational values. 

These are the challenges we hear most often and some useful steps to consider before adopting the exemption: 

Uncertainty around PECR and UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU. obligations

The charity soft opt-in changes when you can send electronic marketing under PECR, but wider data protection obligations remain. 

Under the UK GDPR, charities still need to identify and document an appropriate lawful basis for processing personal dataInformation which relates to an identified or identifiable natural person.. For the soft opt-in, this will still be consent.   

If you are a charity moving away from consent-based marketing into areas such as personalised mailing and telemarketing, you will need to consider Legitimate Interests and complete a Legitimate Interests AssessmentAn assessment that used to demonstrate whether not processing is necessary in the legitimate interests and does not prejudice the data subject’s interests, rights and freedoms. (LIA).  

There are also important limitations on existing supporter data, and the soft opt-in cannot be applied retrospectively, even if a supporter is still making donations or involved through volunteering or similar.  

Before adopting the exemption, consider: 

• What data do you currently hold and how was it collected? 
• Is your lawful basis documented and up to date? 
• Do any areas of your marketing require a separate LIA? 

Concerns around supporter expectations and trust

Just because the law allows you to send marketing communications does not mean supporters expect to receive them. Even where communications are compliant, charities may worry about supporters feeling misled, complaint volumes increasing, or supporter trust being damaged. 

Before moving away from opt-in consent-based models, ask yourself: 

• Will supporters understand why they are receiving marketing communications?  
• Are your collection notices and messaging clear and transparent?  
• How will you explain the change to existing supporters? 

Reputational risk can outweigh compliance risk

For many charities, the decision is not simply about what is legally permissible, but what is consistent with their values and supporter relationships.  

A marketing campaign can be fully compliant and still generate complaints, negative feedback, or unwanted media attention. For organisations that depend on public goodwill to attract volunteers, major donors, and legacy gifts, reputation can be just as important as compliance.  

You may want to consider: 

• Does the soft opt-in align with your organisation’s values and fundraising approach? 
• How would you respond to supporter complaints or concerns? 
• Could the change affect donor trust, volunteer engagement, or public perception? 

Internal governance challenges

Introducing the charity soft opt-in can increase complexity, particularly where different data collection methods, systems, and supporter journeys are involved. 

Before implementing the exemption, make sure you can: 

• Identify which supporters qualify 
• Demonstrate when and how contact details were collected 
• Maintain accurate records of opt-outs 
• Train staff to understand when the exemption can be relied upon 
• Evidence compliance if questioned by the ICO 

What does the ICO guidance say about soft opt-in?

In April 2026, the Information Commissioner’s Office (ICO) published guidance on the charity soft opt-in, clarifying how the exemption works in practice. Here’s what it means for you: 

• Existing supporters may still qualify 

The soft opt-in cannot be applied retrospectively, but existing supporters are not automatically excluded. They may still qualify if they re-engage with the charity after 5 February 2026 and are presented with the required soft opt-in information and opt-out opportunity. It’s the quality of the new interaction that matters, not when the relationship started.  

• Direct collection remains a significant limitation 

The ICO guidance makes clear that the soft opt-in can only be relied upon where your charity directly collects a supporter’s contact details. If someone donates through a third-party platform or via a face-to-face fundraiser, the third-party is considered the data collector, not the charity. In these circumstances, the soft opt-in does not apply, and consent remains necessary before electronic marketing communications can be sent. 

What about contracted fundraiser agencies?

The ICO guidance does not address whether an agency operating under a charity’s instructions should be treated differently from a platform collecting data in its own right. Until further clarification is provided, don’t assume agency-collected data falls within the scope of the exemption. Proceed cautiously and take professional DPO advice if agencies are a significant part of your fundraising model.  

What should charities do before implementing soft opt-in? 

You should first understand how supporter data is collected, how consent is currently managed, and whether existing fundraising practices can support the new approach. 

1. Review your marketing

Before making any changes, review your current consent processes and consider where the soft opt-in may be appropriate. This includes understanding which supporters may qualify, what information is presented at the point of collection, and how opt-out preferences are recorded and maintained. 

Where you move away from consent-based marketing, you will typically need to rely on legitimate interestsLegitimate interests is one of the six lawful bases for processing personal data. You must have a lawful basis in order to process personal data in line with the ‘lawfulness, fairness and transparency’ principle. under UK GDPR. This requires completing a Legitimate Interests Assessment (LIA) before launching any soft opt-in campaign. 

2. Map your supporter journeys

Identify every point at which you collect supporter contact details and review the opt-out language, consent mechanisms, and privacy information provided. Any collection point used to generate soft opt-in contacts must include a clear and prominent opt-out option at the time details are collected 

3. Review third-party fundraising arrangements

Review your relationships with fundraising platforms, giving sites, and other third-party providers involved in supporter acquisition. Where contact details are collected by an external organisation, the charity soft opt-in is unlikely to apply under the ICO’s current interpretation and full consent may still be required. 

4. Update your privacy information

If you introduce the soft opt-in, update your privacy noticeA clear, open and honest explanation of how an organisation processes personal data. to explain clearly when and how the charitable purposes soft opt-in is used as the basis for contact, what this means for supporters, and how they can opt outA positive action to choose not to be part of an activity or to stop being involved in it. at any time. Transparency about how you use supporter data is not just a legal requirement, it is a practical foundation for donor trust. 

How to write a GDPR-compliant Privacy Notice 

5. Review your data quality

The charity soft opt-in requires you to demonstrate when contact details were collected and whether the required conditions were met. Make sure your systems can accurately record collection dates, supporter interactions, marketing preferences, and opt-out requests. Incomplete or inconsistent records may make it difficult to demonstrate compliance if challenged by the ICO.  

6. Consider supporter expectations

Think about how supporters are likely to perceive the change before you commit to a broader rollout. Supporter surveys, focus groups, or a phased approach with clear opt-out messaging can help you assess the likely impact first. 

7. Train your fundraising and marketing teams

Anyone responsible for collecting supporter information should understand when the soft opt-in can be used and when it cannot. Training should cover the conditions of the exemption, the importance of providing clear opt-out opportunities, and the differences between information collected directly by the charity and information obtained through third parties. 

Frequently asked questions 

Does the charity soft-opt in replace consent?

No. The charity soft opt-in is an alternative way of obtaining permission for certain electronic marketing communications under PECR, but it only applies in specific circumstances and where the required conditions are met.

Does every charity need to use soft opt-in?

No. The exemption is optional and charities can continue to rely on their existing consent-based approach if it better aligns with their fundraising strategy, supporter expectations, or organisational values.

Can charities email anyone under the new soft opt-in rules?

No. The soft opt-in only applies where contact details were collected directly by the charity on or after 5 February 2026 from individuals who have expressed an interest in or supported the charity’s charitable purposes. Existing supporters may also qualify if they re-engage after that date, but third-party data, historical records, and individuals who opted out are not covered.

Do charities still need a lawful basis under the UK GDPR?

Yes. The charity soft opt-in affects the PECR rules around electronic marketing, but charities must still ensure they have an appropriate lawful basis for processing personal data and comply with their wider UK GDPR obligations.

The DPO Centre supports charities of all sizes with PECR and UK GDPR compliance. If you are considering introducing the charity soft opt-in and would like independent advice, get in touch.

In case you missed it…

• CRM data retenxtion: Balancing commercial objectives with GDPR compliance
  
• How to share data legally for safeguarding 
• DUAA vs UK GDPR: What businesses need to know