Can I Email My Customers? A Simple Guide to UK Email Marketing Rules
You’ve sold someone a ticket and want to tell them about the next event.
Someone has asked for a kitchen quote. Can you add them to your newsletter?
A customer has booked an appointment. Can you email them an offer afterwards?
These are normal small business questions. Unfortunately, the answer isn’t a neat yes or no.
Sometimes you can email them. Sometimes you need consent. And sometimes the difference comes down to what happened when you first collected their email address.
The rules mainly come from the Privacy and Electronic Communications Regulations (PECR). UK GDPR also applies where you’re using someone’s personal data.
This isn’t legal advice, but it should help you work out whether that list sitting in your CRM is actually ready to use.
First, is it a service email or a marketing email?
This is the easiest place to start.
A genuine service or transactional email might include:
- An order confirmation
- A ticket confirmation
- A booking reminder
- An update about an existing order
- A response to an enquiry
- Details of a call-back someone requested
- A password reset
- An important account or service notice
You normally don’t need marketing consent simply to send somebody information they need about something they’ve bought, requested or already have an agreement with you about.
Marketing is different.
If you’re trying to encourage another purchase, promote another service, advertise an event or otherwise sell something, you should treat that part of the message as marketing.
For example:
“Your appointment is confirmed for Tuesday at 2pm.”
That’s a service message.
“Your appointment is confirmed for Tuesday at 2pm. Book another treatment today and get 20% off.”
You’ve now added marketing.
Calling an email a “customer update” doesn’t change what it is. Look at what the message is actually trying to achieve.
Do I need consent to send marketing emails?
For marketing emails to individual subscribers, you generally need either:
- Valid consent; or
- To meet all the conditions of the soft opt-in.
Individual subscribers include consumers, sole traders and some partnerships.
If you rely on consent, it needs to be clear and specific on your website.
For example:
☐ I’d like to receive marketing emails from [Business Name] about products, services and offers.
The person should actively choose to opt in.
A pre-ticked box doesn’t count. Nor does hiding permission inside your terms and conditions or privacy policy.
You should also keep a record of what they agreed to, when they agreed and how you collected it.
And remember that consent should cover the method you intend to use. Someone agreeing to emails hasn’t automatically agreed to marketing texts or WhatsApp messages.
What is the soft opt-in?
Despite its name, the soft opt-in isn’t actually an opt-in.
It’s an exception that can allow you to send marketing emails to some customers and genuine prospects without them actively ticking a marketing consent box.
You can generally rely on it only when all of these conditions are met:
- You collected their contact details directly from them.
- You collected them during a sale or genuine negotiations for a sale.
- You’re marketing your own similar products or services.
- You gave them a clear opportunity to opt out when you first collected their details.
- You give them an easy way to opt out every time you contact them.
Miss one of those conditions and the soft opt-in doesn’t apply.
They don’t actually need to have bought from you
This catches people out.
Someone can potentially fall within the soft opt-in even if they never became a customer.
The ICO says negotiations for a sale can count. That could include someone who:
- Requests a quote
- Asks for more information because they’re considering buying
- Signs up for a free trial
- Makes another genuine buying enquiry
So, if somebody fills in your website form asking you to quote for a new kitchen, that could potentially qualify.
Someone asking what time your shop closes probably wouldn’t.
There needs to be a genuine indication that they’re considering buying something.
The opt-out needs to be there when you collect the details
This is one of the most important parts of the soft opt-in.
You need to give the person a clear opportunity to refuse marketing when you first collect their contact details.
For example, your enquiry form could include something along the lines of:
☐ I don’t want to receive occasional emails about similar services and offers.
If they leave that unticked, and all the other soft opt-in conditions are met, you may be able to send them relevant marketing afterwards.
What you can’t do is collect an email address with no mention of marketing, add it to your newsletter six months later and assume an unsubscribe link at the bottom makes everything fine.
It doesn’t.
That makes your website forms worth checking before you import years of old enquiries into an email platform.
What counts as a similar product or service?
There isn’t a neat official list.
But a useful test is:
Would this person reasonably expect to hear about this based on what they originally bought or asked about?
For example...
Someone buys a ticket to your food festival. An email about your next similar event might be reasonably related.
Someone books a haircut. Emails about other salon treatments may be reasonably related.
Someone asks you to quote for a new boiler. Occasional emails about heating and cooling services might be relevant, depending on what they originally asked about and how you collected their details.
But somebody buying lunch from your café wouldn’t reasonably expect you to start marketing unrelated financial services to them.
The soft opt-in also only covers your own similar products and services. It isn’t permission to start sending offers on somebody else’s behalf.
What about emailing other businesses?
The rules are different when the recipient is a corporate subscriber.
PECR’s consent rule for electronic marketing generally doesn’t apply in the same way to limited companies, LLPs and certain other corporate organisations.
So you can generally send relevant B2B marketing to a limited company without getting marketing consent first.
That doesn’t mean anything goes.
A named employee still has data protection rights
There’s a difference between:
info@company.co.uk
and:
sarah.jones@company.co.uk
The second identifies Sarah personally, so UK GDPR applies to how you use her information.
That doesn’t automatically mean PECR requires her consent if you’re marketing to a limited company.
It does mean you need an appropriate lawful basis for processing her personal data, you need to be transparent about what you’re doing, and you must respect her right to object to direct marketing.
Legitimate interests can sometimes provide the lawful basis for B2B marketing, but it isn’t a magic phrase either. The use still needs to be necessary, proportionate and fair.
And if Sarah asks you to stop emailing her, stop.
Sole traders are different
A sole trader is treated as an individual subscriber.
So if you’re marketing to a self-employed plumber, photographer or consultant, the normal consent or soft opt-in rules apply.
If you aren’t sure what kind of organisation you’re dealing with, it’s sensible to check rather than assume.
Finding an email address online isn’t consent
Another common assumption is:
“Their email address is on their website, so I can email them.”
Not necessarily.
Publishing an email address doesn’t amount to consent to receive marketing.
If it belongs to a corporate subscriber, relevant B2B marketing may still be permitted under PECR without consent.
If it belongs to a sole trader or another individual subscriber, simply finding it on a website, LinkedIn profile, or business directory doesn’t give you marketing permission.
And if the address identifies a person, UK GDPR may apply regardless.
Can I email them? Some common examples
| Situation | Can you send marketing? | Why? |
|---|---|---|
| A customer bought from you and was offered an opt-out when ordering | Usually, yes | The soft opt-in may apply to your own similar products or services. |
| A customer bought from you, but you never offered an opt-out | Usually, no | You can’t rely on the soft opt-in if the original opt-out opportunity was missing. |
| Someone requested a genuine quote and was offered an opt-out | Potentially, yes | A genuine buying enquiry can count as negotiations for a sale. |
| Someone used your contact form to ask a general question | Usually, no | Simply contacting you doesn’t necessarily amount to negotiations for a sale. |
| Someone actively ticked a clear email marketing consent box | Yes | Assuming the consent was valid and they haven’t withdrawn it. |
| A customer has an appointment and you need to send a reminder | Yes, as a service message | It relates to something they’ve already booked. |
| You add an offer to the appointment reminder | Treat that part as marketing | Promotional content is still marketing even when added to a service email. |
You email info@limitedcompany.co.uk about a relevant business service |
Generally, yes | Limited companies are normally corporate subscribers. |
| You email a named employee at a limited company | Generally possible without PECR consent | But UK GDPR applies because you’re using that person’s data. |
| You market to a sole trader whose email you found online | Usually, no without consent or soft opt-in | Sole traders are individual subscribers. |
| You bought a consumer email list | Don’t assume you can use it | You need to establish that the appropriate consent actually covers your business and your marketing. |
| Somebody unsubscribed, then appears in a later CRM import | No | Their objection still stands. |
| A charity meets the conditions of the 2026 charitable purposes soft opt-in | Potentially, yes | There is now a separate soft opt-in for qualifying charity marketing. |
| A Community Interest Company (CIC) wants to use the charity soft opt-in | No | A CIC isn’t a charity, even if its work benefits the community. |
These are useful rules of thumb rather than substitutes for checking the actual circumstances.
A quick note for charities and CICs
There was an important change to the rules in 2026.
From 5 February 2026, charities gained a new charitable purposes soft opt-in.
In broad terms, this can allow a charity to send electronic marketing connected to its charitable purposes to someone who has expressed an interest in or offered support to those purposes, provided the charity met the required opt-out conditions when collecting the details and continues to offer an opt-out in later messages.
Charities should check the ICO’s current guidance before relying on it.
A Community Interest Company is different.
A CIC is a type of limited company set up to benefit the community, but it does not have charitable status. A company cannot be both a CIC and a charity.
So a CIC shouldn’t assume that the new charity soft opt-in applies simply because its work has a charitable or community purpose.
It may still be able to rely on the normal customer soft opt-in where those conditions are met, or the corporate subscriber rules when marketing to another business.
What about old customer lists?
Having collected someone’s email address years ago doesn’t automatically mean you can start marketing to them now.
Before using an old list, work out:
- Why you originally collected the address
- Whether marketing consent was given
- What that consent actually covered
- Whether the soft opt-in conditions were met at the time
- Whether they’ve since unsubscribed or objected
- Whether it’s still reasonable to use the information
If you can’t establish why someone is on your list, guessing isn’t a great compliance strategy.
The safest answer, even if it's not the one you want, is that you might not be able to market to that contact.
Keep the reason behind every contact
If your contacts live partly in HubSpot, partly in Mailchimp or EmailOctopus, partly on your website and partly in a spreadsheet somebody started four years ago, this becomes especially important.
Don’t keep only the email address.
Where relevant, keep records of:
- Where the details came from
- When they were collected
- Whether they actively consented
- What they consented to
- The wording used at the time
- Whether you’re relying on the soft opt-in
- Whether they’re a customer, prospect or corporate contact
- Any unsubscribe or objection
- When that objection was made
When you move contacts between systems, this information needs to move with them.
A brand-new email platform doesn’t turn a questionable old list into a compliant one.
Don’t just delete people who unsubscribe
Someone unsubscribes, so deleting their record completely sounds logical.
It can actually cause another problem.
Their email address might later be imported again from your CRM, booking system or an old spreadsheet. If you deleted all trace of them, you’ve also deleted the record showing that they asked you to stop.
It’s usually better to maintain a suppression list or “do not market” record.
That means keeping enough information to recognise the address and prevent it being accidentally added back to your mailing list.
Make unsubscribing easy
Every marketing email should clearly identify who it comes from and provide a valid way to stop future marketing.
For most email marketing, a working unsubscribe link is the obvious choice.
People shouldn’t have to:
- Create an account
- Remember a password
- Phone you during office hours
- Quote an account number
- Send a carrier pigeon to reception
Click. Unsubscribe. Done.
If somebody withdraws consent or objects to direct marketing, update your records and stop using their details for that marketing.
Before you upload that spreadsheet…
If you’re about to import customers or enquiries into Mailchimp, MailerLite, HubSpot or another email platform, run through this first:
- Is what we’re sending actually marketing?
- Are we emailing an individual subscriber or a corporate subscriber?
- If it’s an individual, do we have valid consent?
- If not, do we meet every soft opt-in condition?
- Did we offer an opt-out when we originally collected their details?
- Is what we’re promoting genuinely similar to what they bought or enquired about?
- Do our records show why we’re entitled to contact them?
- Have we checked previous unsubscribes and objections?
- Can they unsubscribe easily from this message?
If you can’t confidently answer those questions, having someone’s email address probably isn’t enough.
Not sure what your website is actually collecting?
We can’t give legal advice or decide your lawful basis for you.
What we can do is look at the practical setup around it.
That might include:
- Your website enquiry forms
- Newsletter sign-ups
- Your CRM
- Your email marketing platform
- How consent or soft opt-in status is recorded
- What happens when somebody unsubscribes
- Whether those preferences survive when contacts move between systems
It’s much easier to sort that out before you send 2,000 emails than after somebody asks why they’re on the list.
Get in touch with Virens if you’d like us to take a look.
For the legal detail, see the ICO’s current guidance on direct marketing using electronic mail.
This article provides general information, not legal advice. The rules depend on the circumstances, so check the latest ICO guidance or take professional advice where necessary.
About Emily Williams
I help small businesses turn marketing ideas into work that actually brings in enquiries.
Before Virens, I spent 20+ years in digital marketing, working with brands including Friends Reunited and XE.com. I’ve led teams, built growth plans and helped high-growth businesses get ready for the next stage, including sale.
At Virens, I focus on Google Ads, customer journeys, campaign planning and conversion. In reality, that means helping businesses stop guessing, spend more wisely and make it easier for the right people to become customers. I like the creative side. I like the data side. The useful bit is when the two meet.
