The PECR business email marketing rules treat companies and people differently. The ICO says you may send unsolicited marketing email to a corporate subscriber without consent or the soft opt-in. Sole traders and some partnerships count as individuals, so consent or the soft opt-in is needed. For every recipient, you must not hide who you are and must give a valid address for opting out.
This is general information, not legal advice. We read the sources below in October 2026, and they have a caveat: the ICO marks parts of its guidance as under review after the Data (Use and Access) Act 2025. Check the ICO’s current pages before you rely on any line here.
PECR business email marketing rules: the short version
- Corporate subscribers (companies, LLPs, government bodies): no consent or soft opt-in needed for unsolicited marketing email, per the ICO.
- Individual subscribers (sole traders and some partnerships): consent or the soft opt-in is needed.
- Everyone: do not disguise or conceal the sender, and give a valid address to stop (regulation 23).
- Signatures: none of the ICO pages we read mention signatures or footers, so a promotional banner is a judgement call.
What we read for these PECR business email marketing rules
- The ICO’s guide to PECR, its electronic mail marketing page and its page on how to comply with the electronic mail marketing rules. None of the three shows a last-updated date, and the electronic mail marketing page says the guidance “is under review and may be subject to change”.
- The text of the Privacy and Electronic Communications (EC Directive) Regulations 2003 on legislation.gov.uk: regulation 2, regulation 22 and regulation 23. Regulation 22 is shown with amendments effective 5 February 2026.
- The ICO’s DUAA page (19 June 2026) and its statement on commencement (5 February 2026).
Corporate and individual subscribers under the PECR business email marketing rules
The rules turn on who the recipient is, not on whether the message is “B2B”. Regulation 22 applies to unsolicited email “to individual subscribers”. Regulation 2 defines a corporate subscriber as a company, a company set up by royal charter, a Scottish partnership, a corporation sole, or any other body corporate or entity that is a legal person distinct from its members.
| Recipient | How the ICO treats it | Consent or soft opt-in? |
|---|---|---|
| A limited company, LLP or government body | Corporate subscriber | Not needed for unsolicited marketing email |
| A sole trader | Individual subscriber | Needed |
| Some partnerships | Individual subscriber | Needed |
| A charity | Depends on its legal form | See the charity rule below |
The ICO’s wording is that sole traders and some partnerships are treated as individuals, so check the legal form of the recipient where you can. The page also says it is good practice to keep a “do not email” list for people at companies who object, even though the law does not require consent for corporate subscribers.
The PECR business email marketing rules sit alongside the UK GDPR and the Data Protection Act, according to the ICO’s page on what PECR are. A named person’s work email address is still personal data, so PECR is not the only law in play.
What every marketing email must carry
Under the PECR business email marketing rules, regulation 23 applies to direct marketing by email whoever receives it. A person shall neither transmit nor instigate a marketing email:
- where the identity of the person on whose behalf it is sent has been “disguised or concealed”;
- where a valid address to which the recipient may send a request that such communications cease has not been provided.
Regulation 23 also covers messages that would breach regulation 7 of the Electronic Commerce (EC Directive) Regulations 2002. We did not read that regulation for this page. The ICO says the same two basics in plainer words: do not hide your identity, and give a valid contact address to opt out.
Soft opt-in and the charity rule in the PECR business email marketing rules
For individuals, regulation 22 allows marketing email without prior consent in two cases. The summary below is ours, from the regulation text on legislation.gov.uk.
- Soft opt-in. You obtained the contact details in the course of a sale or negotiations for a sale to that person. The marketing is for similar products and services only. The person was given a simple, free way to refuse when the details were collected and with each message.
- Charities. A charity may email people to further its charitable purposes, if the details came from the person expressing interest in or supporting those purposes, with the same chance to refuse. The ICO’s DUAA page (19 June 2026) says this applies to people who support or express interest in a charity’s work.
The ICO’s electronic mail page, which carries the “under review” note, adds that the product soft opt-in does not reach prospective customers or bought-in lists.
Fines under the PECR business email marketing rules: the ICO’s pages do not agree
The ICO’s statement of 5 February 2026 on the commencement of the Data (Use and Access) Act says its new powers include fines of up to £17.5 million or 4% of global turnover under PECR. Its page “What are PECR”, also read in October 2026, still says the Commissioner can issue fines of up to £500,000. That page also says the guidance is under review.
We cannot tell which page was updated last, because the second carries no date. The first is dated and is about the Act’s commencement, so plan for the higher figure, and check the ICO’s enforcement pages before you quote a number to anyone.
Signature banners and the PECR business email marketing rules
None of the ICO pages above mention signatures or footers. The ICO’s electronic marketing page defines direct marketing as communicating “advertising or marketing material which is directed to particular individuals”. It says routine customer service messages are outside it. Whether a banner under an ordinary one-to-one reply counts is not something these pages answer. This table is our reading, so ask your adviser.
| Line in a signature | Our reading |
|---|---|
| Name, job title, company, phone, address | Contact details. Not advertising |
| Registration line or confidentiality notice | Not advertising |
| A link to a product page or a “book a demo” banner | Could be read as marketing. Treat it with care |
| A campaign banner sent to a purchased list | Marketing. Needs the full rules |
The reason to take the middle rows seriously is the recipient. A banner goes to everyone you write to, including sole traders, and you cannot tell who is who. A cautious company keeps promotions out of general signatures, or runs them from a separate list with consent records. Our email signature banner guide and signature marketing campaign plan cover the practical side.
If you do send marketing from a signature or footer, make sure it shows the sender and a way to stop. Here is a made-up footer that does both.
|
A marketing footer that names the sender and gives a stop address. The company and person are made up.
Five checks before a B2B send
- Who is the recipient in law? A limited company contact, or a sole trader?
- Is the sender named? The company, not a vague brand.
- Is there a working stop address? Test it, and act on replies promptly.
- Do you have a source for each address? The soft opt-in needs a sale or negotiation behind the contact.
- Is a promotion hiding in the signature? If so, apply the same checks to it.
The PECR business email marketing rules are under review, so these checks do not replace a lawyer or the ICO’s current guidance. For other countries, see our pages on CAN-SPAM, CASL and what the GDPR says about email disclaimers.
Frequently asked questions
Do the PECR business email marketing rules require consent to email a company?
For a corporate subscriber, the ICO says no consent or soft opt-in is needed for unsolicited marketing email. You must still not hide your identity and must give a valid address to opt out.
Are sole traders covered by the PECR business email marketing rules?
Yes, as individuals. The ICO says sole traders and some partnerships are treated as individual subscribers, so consent or the soft opt-in is needed.
Does PECR email marketing apply to a signature banner?
The ICO pages we read do not say. If the banner counts as advertising directed to particular individuals, the PECR business email marketing rules would apply to it. Ask your adviser, and keep promotions out of general signatures if in doubt.
What are the fines under the PECR business email marketing rules?
The ICO’s February 2026 statement gives up to £17.5 million or 4% of global turnover under PECR. Another ICO page still says £500,000. Check the current ICO enforcement pages.
Keep reading
- CAN-SPAM and your email signature: what the US rules actually require: A CAN-SPAM email signature guide: the FTC’s requirements mapped to footer lines, and what the guide says, and does not say, about one-to-one business email.
- CASL email signature: what Canada’s rules require in commercial emails: A CASL email signature has no required wording for ordinary replies, but commercial email needs sender ID, contact details and unsubscribe. Dated sources.
- GDPR email disclaimer: do you need one? What the rules say: Is a GDPR email disclaimer required? What the UK GDPR text and ICO pages say about privacy information, business emails and footers, plus a sample line.
- Email signature marketing campaign: a banner plan for your whole team: Plan an email signature marketing campaign in seven steps: goal, banner, tagged link, dates and retirement, with honest expectations on volume and cost.
Make every signature in your company match
emailfooter is a free WordPress plugin. You design the signature once, and each person adds their own details and installs it in their mail app. Prefer not to run a website? emailfooter Managed is the same software, hosted for you.