PECR and Cold Email in the UK: Regulations 22 and 23 Explained

PECR allows unsolicited marketing email to UK limited companies, LLPs and Scottish partnerships without consent, because the consent rule in regulation 22 applies only to "individual subscribers". Sole traders and ordinary partnerships are individual subscribers, so they need consent or the soft opt-in, which cold prospects cannot meet. Every marketing email, to any recipient, must identify the sender and give a valid opt-out address under regulation 23.

This post works through the Privacy and Electronic Communications Regulations 2003 as amended, and the ICO's guidance on them. UK GDPR is a separate layer that also applies to named work addresses; that is covered in GDPR and B2B cold email. This is not legal advice, and the ICO itself says its PECR guidance is under review following the Data (Use and Access) Act 2025, so check the current version before you rely on it.

What regulation 22 actually says

Regulation 22 bans unsolicited direct marketing email to individual subscribers unless they consented or a soft opt-in applies. The scope line comes first. Regulation 22(1):

"This regulation applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers."

Regulation 22(2) then sets the rule:

"a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender."

Two words matter for cold outreach. "Unsolicited" means the person did not ask for this message. "Instigate" means you are responsible even when someone else presses send. The ICO gives the example of asking people to forward a message to friends: "you are 'instigating' them to send that message, so you must still comply with PECR." The same logic applies when an agency or lead-generation contractor sends a campaign for you.

Corporate or individual subscriber: the test that decides everything

The legal form of the recipient's business, not whether the email is "B2B", decides whether you need consent. The ICO's key concepts guidance sets out the split:

Subscriber type	Includes	Consent needed under reg 22?
Individual	People, sole traders, ordinary partnerships	Yes, or a soft opt-in
Corporate	Limited companies, LLPs, Scottish partnerships, other bodies with legal personality	No

The ICO's compliance guidance puts the corporate position plainly: "You can send unsolicited electronic mail marketing to corporate subscribers without consent or a soft opt-in." It is equally plain about published details: publicly available contact details do not amount to consent from an individual subscriber.

The key concepts page also notes that PECR applies whether or not you know a person's name, so a generic info@ address at a sole trader is still an individual subscriber.

How to check a UK prospect's legal form

Trading names do not tell you legal form. "Smith Plumbing" might be a limited company or one person. A practical sequence:

1. Search Companies House for the business name and the website's registered details. Limited companies and LLPs are registered there.
2. Look for "Ltd", "Limited", "LLP" or a company number in the website footer, terms page or email signature. Many companies print their registered name and number there.
3. If you cannot find a registration, treat the business as an individual subscriber and leave it out of a cold campaign.

Local trades, freelancers, consultants and small practices are where this goes wrong most often, because many of them are sole traders. If your list was built from maps or directories, expect a share of it to fail step 3. Our guide to cold email for local service businesses covers sourcing for that segment.

The soft opt-in does not cover cold prospects

The soft opt-in in regulation 22(3) only applies where you got the person's details "in the course of the sale or negotiations for the sale of a product or service" to them. All three conditions must hold:

• the details were obtained during a sale or negotiations for a sale;
• the marketing is about "similar products and services only"; and
• the person was given "a simple means of refusing" at collection and in every later message.

The ICO's PECR guide says it "does not apply to prospective customers or new contacts (eg from bought-in lists)." For a sole trader you have never dealt with, there is no soft opt-in to rely on.

The Data (Use and Access) Act 2025 added regulation 22(3A), a separate soft opt-in for charities, in force from 5 February 2026. It applies only where "the sole purpose of the direct marketing is to further one or more of the charity's charitable purposes". It does not help commercial senders.

Regulation 23: the rules for every recipient

Regulation 23 applies to all direct marketing email, corporate recipients included. You must not send marketing email:

"(a) where the identity of the person on whose behalf the communication has been sent has been disguised or concealed; ... (b) where a valid address to which the recipient of the communication may send a request that such communications cease has not been provided"

The ICO's B2B guidance repeats this for corporate recipients: you must "not disguise or conceal your identity" and must "give a valid address for business to opt-out or unsubscribe." In practice, that means your real company name in the email and an opt-out route that works for as long as the campaign runs. If you send from secondary domains, the sender name and footer still need to identify the business behind them. Setting up secondary domains covers the technical side.

What counts as "electronic mail"

Email is only one channel PECR covers. The ICO's key concepts guidance lists email, SMS, picture and video messages, voicemail, in-app messages and private social media messages, and excludes public banner ads and social media news feed advertising. A private LinkedIn message to a sole trader is therefore subject to the same consent rule as an email to them.

Penalties after the Data (Use and Access) Act

The ICO says it can now fine up to £17.5 million or 4% of global turnover for PECR breaches. Its statement on commencement of 5 February 2026 says the Act gives it powers to:

"issue fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations (PECR)."

Before that, the ICO's PECR guide gave the maximum monetary penalty as £500,000, and noted that the regulations were amended in 2018 "to introduce director liability for serious breaches of the marketing rules." That page carries the under-review notice, so treat the newer statement as the current position.

For a sense of how the ICO enforces, in January 2026 it announced fines of £105,000 against ZMLUK Limited over 67,772,285 marketing emails promoting solar and energy-saving products, and £120,000 against Allay Claims Ltd over text messages. The ICO's summary: "businesses must only send marketing messages to people who have freely and knowingly consented to receiving them." Those were consumer campaigns, but the same regulation 22 applies to sole traders.

A PECR checklist for a UK cold campaign

1. Classify every UK business as corporate or individual subscriber using Companies House. Remove anything you cannot confirm as corporate.
2. Do not rely on publication. A sole trader's address on their own website is not consent.
3. Treat agencies and contractors as your own sends. If they transmit on your instruction, you instigated it.
4. Name your business and give a working opt-out in every email, including follow-ups and every rotated inbox.
5. Apply the same rules to private social messages sent to individual subscribers.
6. Run the UK GDPR layer for named contacts at corporate subscribers: lawful basis, transparency and objections. See GDPR and B2B cold email and is it legal to collect business emails.
7. Verify the remaining list before sending. Verification does not make a send lawful, but it keeps bounces off your domain. The free list health check catches duplicates, bad syntax and role addresses in the browser before you run a full verification.

For a UK cold list, PECR asks one question per contact: "is this a company with its own legal personality?" If the answer is yes, PECR's consent rule does not apply, though regulation 23 and UK GDPR still do. If it is no or you do not know, the contact is not a cold email prospect.