Marketing compliance under DUAA and PECR

The Data Use and Access Act 2025 (DUAA) has brought a notable change to UK electronic marketing law, shifting the risk profile for compliance. From 5 February 2026, organisations can face fines of up to £17.5 million, or 4% of annual global turnover, for serious breaches of the Privacy and Electronic Communications RegulationsPECR is the UK implementation of the ePrivacy Directive (Directive 2002/58/EC) providing certain rules on marketing, cookies, communication services security and customer privacy (in relation to traffic/location data, billing, line identification and caller directories). (PECR). 

Whilst many organisations have focused heavily on the UK General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU.) in recent years, PECR deserves equal attention. Marketing emails, cookiesData which tracks a visitor’s movement on a website and remembers their behaviour and preferences., and online tracking remain areas of active regulatory interest and can expose organisations to substantial financial penalties if overlooked. 

This blog explores the marketing and tracking activities most likely to create UK GDPR compliance risk, and what your team should be checking now to stay on the right side of PECR. 

Key takeaway: Maximum PECR fines have risen from £500,000 to £17.5 million or 4% of global turnover, bringing penalties in line with UK GDPR. Organisations should not treat email and cookie complianceCompliance with the rules on cookies as provided by the Privacy and Electronic Communications Regulations (PECR) and Privacy and Electronic Communications Directive 2002/58/EC. as a lower priority. ConsentAn unambiguous, informed and freely given indication by an individual agreeing to their personal data being processed., cookie banners, and unsubscribe processes all need regular review to avoid significant financial exposure.

• New​ ICO​ enforcement powers under PECR 
• Does PECR apply to B2B marketing? 
• Do we need consent for marketing emails? 
• Can we use cookies without consent? 
• What should a compliant cookie banner include? 
• What should marketing teams check now? 
• New data protection complaints​ process​ 
• PECR compliance checklist 

What are the ICOThe Information Commissioner's Office (ICO) is the United Kingdom’s independent supervisory authority for upholding information rights in the public interest, ensuring compliance with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).’s new enforcement powers under PECR?

The underlying PECR requirements haven’t changed but the consequences of getting them wrong have.  

Alongside an increase to maximum fines, the Information Commissioner’s OfficeThe United Kingdom’s independent ‘supervisory authority’ for ensuring compliance with the UK GDPR, Data Protection Act 2018, the Privacy and Electronic Communications Regulations etc. (ICO) now has stronger enforcement powers when investigating suspected PECR breaches. These include the ability to: 

• Compel witnesses to attend interviews 
• Require data controllersEntities (such as an organisation) which determine the purposes and means of the processing of personal data. to produce technical reports at their own expense 

Together, these changes mean complex investigations no longer rely on voluntary cooperation, making it harder for organisations to slow or deflect an ICO inquiry. 

Does PECR apply to B2B marketing?

Yes, although the rules differ depending on who you are contacting. This means marketing teams need to know which category applies before sending emails or texts. 

The two main groups to check are corporate subscribers and sole traders. The rules for each are set out below.

Corporate subscribers

If you’re marketing to a genuine corporate subscriber, such as a limited company or LLP, PECR’s consent requirement doesn’t apply to email or text marketing. You can utilise the corporate subscriber exemption to contact firstname.lastname@company.co.uk without prior consent. However, you still need to meet your obligations under GDPR, including: 

• Collecting the information lawfullyIn data protection terms, 'lawfully' must satisfy one of the appropriate lawful basis for processing and must not contravene any other statutory or common law obligations. and transparently 
• Applying an appropriate lawful basis 
• Informing individuals that you have collected their information 
• Identifying your organisation clearly 
• Giving recipients a simple way to opt outA positive action to choose not to be part of an activity or to stop being involved in it. 

Sole traders

PECR treats sole traders and certain types of partnership as individual subscribers, the same as consumers. That means you need consent or a valid soft opt-in before emailing them, even though they look like a business contact. This can cause difficulties for businesses that deal with both corporates and sole traders. 

Getting this distinction wrong is an easy way to breach PECR without realising it. Before you market to any B2B list, check what type of entity you’re contacting to determine whether consent is required.   

Do we need consent for marketing emails? 

Unless a specific exemption applies, PECR requires consent before sending marketing emails or texts to individual subscribers. 

To be valid, consent must be informed, specific, and freely given through a clear, affirmative action. Pre-ticked boxes or consent buried in lengthy terms and conditions don’t meet this standard and won’t protect you if challenged.

Soft op-in exemption

The main exemption to the consent requirement is the ‘soft opt-in’. There are now two relevant versions to understand – the customer soft opt-in and the charity soft opt-in. 

Customer soft opt-in
If someone has bought a similar product or service from you before, and you gave them a clear chance to opt out at the time (and in subsequent messages), you can keep marketing to them without fresh consent.

This only applies to your existing customers, not bought-in lists or new prospects. 

Charity soft opt-in
The DUAA also extended a version of this exemption to charitable organisations. Under the new charity soft opt-in, charities can send electronic marketing, such as fundraising emails and texts, without explicit consentA clear and unambiguous expressed statement of consent. This can be provided in writing, by filling out online forms using electronic signatures, or even via oral statements (so long as the conditions for valid consent have been met)., provided: 

• The contact’s details were collected whilst they were expressing an interest in, or actively supporting, the charitable purpose 
• They were given a clear opportunity to opt out at the time of collection and in every subsequent message 
• The sole purpose of the marketing is to further the charity’s charitable purposes 

Learn more about the charity soft opt-in

Whether you rely on consent, the customer soft opt-in, or the charity soft opt-in, keep clear records demonstrating when and how consent was obtained. You should be able to evidence a logged date, method, and exact wording. With PECR fines now reaching seven figures, a missing audit trail is the difference between a quick resolution and a serious penalty. 

Can we use cookies without consent?

In most cases, no. The default position under PECR hasn’t changed: you need consent before placing non-essential cookiesCookies created by third parties and dropped on website users, for the purposes of analytics or advertisement tracking. on a user’s device, particularly anything used for advertising, retargeting, or behavioural profiling. 

The DUAA has introduced limited flexibility, and a small number of new exemptions apply. Since February 2026, you can run the following cookies without consent: 

• Analytics cookies, provided they’re used solely to improve your website or service (not shared with third parties for other purposes) 
• Cookies that adjust site appearance or functionality to a user’s preferences 

You must still clearly tell users what cookies are being used and why, and give them a simple, free way to opt out. 

Many organisations still get this wrong by activating cookies as soon as a website loads, before visitors have made a choice. The new exemptions don’t fix this problem, as they only cover cookies that genuinely match one of the narrow categories above.  

What should a compliant cookie banner include?

A compliant banner should give users a clear and genuine choice before any non-essential cookies are set. The ICO expects organisations to: 

• Keep non-essential cookies switched off until consent is obtained 
• Give ‘Accept’ and ‘Reject’ equal visual prominence, including same size, same number of clicks, and no design bias toward one option 
• Avoid colours, wording, or layouts that nudge users towards accepting cookies 
• Clearly explain what cookies are being used and why 
• Make it just as easy to withdraw consent later as it was to give it 

A non-compliant banner is one of the quickest ways to draw scrutiny. 

Your cookie banner is often the most visible part of your PECR compliance, and the easiest for the ICO to assess at a glance. If your banner makes accepting easier than rejecting or sets non-essential cookies before a visitor has made a choice, it’s unlikely to meet PECR’s standard. 

What should marketing teams check now?

To ensure compliance with PECR, marketing teams should focus on: 

• Consent records: make sure they’re still valid and that you can produce evidence of when and how consent was given 
• Customer preference and suppression lists: check they’re up to date and being followed across all your marketing channels 
• Cookie Management Platform (CMP) configuration: confirm non-essential cookies remain switched off by default until a visitor consents 
• Unsubscribe mechanisms: test that they’re clear, simple, and working properly 
• Website tags and tracking technologies: review what’s been added over time, as these often drift out of compliance unnoticed 
• Documentation: keep a record of the decisions you’ve made around marketing and cookie compliance, so you can evidence your reasoning if the ICO ever asks 

Don’t forget the new data protection complaints processA series of actions or steps taken in order to achieve a particular end. 

Alongside the PECR changes, the DUAA introduces a new complaints requirement. 

By 19 June 2026, all organisations must have a formal process in place for handling data protection complaints, with a 30-day acknowledgement obligation. 

This applies more broadly than just marketing activities, but it’s worth factoring into your wider compliance review. A documented intake and response process, rather than just an inbox, is now expected. 

If you are reviewing your PECR compliance, it can help to have an external view of your marketing, cookie, and tracking processes. The DPO Centre can support your team in identifying gaps, strengthening records, and preparing for regulatory scrutiny. Get in touch to find out how we can help.

In case you missed it…

• 5 signs your organisations needs a DPO 
• Bring your own device (BYOD) risk management guide 
• CRM​ data​ retention​: Balancing commercial objectives with GDPR compliance