Do you need consent to send a newsletter in the UK?

Usually, yes. If your newsletter promotes anything and it goes to people at personal email addresses, or to sole traders, the starting point under the Privacy and Electronic Communications Regulations (PECR) is that they must have agreed to receive it first. There is one exception for existing customers and enquirers, a second for charities, and a lighter rule for addresses at companies. The rest of this letter is about working out which of those applies to the people on your list.

Start with the question people skip: is it marketing?

PECR's consent rule only bites on direct marketing, so that is the first thing to settle. The regulations now define direct marketing as "the communication (by whatever means) of advertising or marketing material which is directed to particular individuals".

That reaches further than people expect. The Information Commissioner's Office (ICO) reads it as covering the promotion of aims and ideals, such as fundraising and campaigning, as well as selling. So a newsletter from a community group that asks for volunteers and donations is in scope, even though nobody is selling a product.

What sits outside is a purely practical message to someone who needs it: a receipt, a notice that a meeting has moved, a reminder that a membership has lapsed. Mix a promotion into one of those and it stops being a purely practical message.

Independent writers land in the awkward middle. A free essay with no pitch in it looks more like the thing readers came for than an advert. Add a nudge towards a paid tier, a book link or a sponsor slot, and it looks like marketing. Most newsletters drift that way eventually, which is why we suggest treating yours as direct marketing from the first issue. Collecting consent you turn out not to need costs little. Finding out later that you needed it and do not have it means starting again.

Who is on the list decides the rule

PECR splits recipients into two groups, and the split does not follow what you might call business and personal.

The ICO's business-to-business guidance also warns that an email address alone will not tell you which kind of recipient you have. An address on a smart-looking domain could belong to a sole trader, so a list you assembled from a trade directory can contain both groups without any way of telling them apart. If you cannot tell, the safe assumption is that the stricter rule applies.

Corporate addresses are not a free pass either. A named person at a company is still a person, UK GDPR still covers their data, and Article 21 gives them an absolute right to object to direct marketing. When they do, you stop.

What "consent" has to look like

PECR borrows its standard from UK GDPR, which defines consent as a "freely given, specific, informed and unambiguous" indication given by a statement or a clear affirmative action. In practice that rules out several familiar habits:

• adding people who gave you a business card at an event, because handing over a card is not agreeing to a newsletter
• a ticked-by-default box, which the ICO says cannot be relied on
• copying everyone from your personal address book because they probably would not mind
• burying agreement inside general terms and conditions

The wording and the record both matter, and we go through them line by line in what a sign-up form should say.

The two exceptions, briefly

If you collected an address while selling something, or while negotiating a sale, you may be able to market your own similar products to that person without separate consent, provided you offered a way to refuse at the time and in every message after. A charity has a parallel route for people who expressed interest in, or offered support to, its charitable purposes. This has been in force since 5 February 2026, and the wording of both is in regulation 22. Neither covers a bought list or a stranger who has never dealt with you. There is more detail, including the traps, in our letter on the soft opt-in.

Three situations we would look at twice

A list you inherited

The volunteer who ran the newsletter has handed you a spreadsheet and nobody remembers how it was built. Ask what people were told and whether any record survives. If nothing does, you cannot show consent, and Article 7 puts that burden on you. Be careful about emailing the whole list to ask if they would like to stay: that message promotes your newsletter, so we would treat it as marketing in its own right.

A list you were offered

The ICO's position on marketing lists is that people on a bought-in list must have validly consented to marketing from you by that method. Consent that does not name your organisation does not count. For a small sender, that makes bought lists a poor idea long before you reach the deliverability damage they tend to do.

A move between tools

Changing your email provider does not reset anything. Take your consent records and your unsubscribe list with you, because the next provider will not know who already left. Our letter on cleaning a list covers what to keep.

What every issue must carry, whoever receives it

Regulation 23 applies across the board. You cannot disguise who the message is from, and you must provide a valid address where someone can ask you to stop. A working unsubscribe link and a real sender name deal with most of this. Withdrawing consent must also be as easy as giving it, so an unsubscribe route that demands a login or a reason is worth rethinking.

Getting this wrong has consequences beyond annoyed readers. The government's factsheet on the Data (Use and Access) Act 2025 notes that senders of nuisance direct marketing can be fined even when a communication never connects, so a send that bounces is not automatically in the clear.

This is general information, and the ICO flags that parts of its guidance are under review following the 2025 Act. If your situation is unusual or the list is large, read the ICO's email marketing guidance directly or ask a solicitor who handles data protection work.