What is the soft opt-in, and can your newsletter use it?

The soft opt-in lets you send email marketing to someone without their express consent, on tight conditions. For most organisations, that means you got the address while selling them something, you are only promoting your own similar products, and you offered a way to refuse both at the time and in every message since. Since 5 February 2026 charities have had a version of their own. Someone who simply signs up for free updates, or whose address you found elsewhere, does not qualify under the commercial route.

Both routes live in regulation 22 of PECR, and they are short enough to read in full. It helps to set them next to each other.

The sale has to be real

The ICO's guide to email marketing says plainly that the commercial route is only available when you are selling something or negotiating to sell something. It also says that the rule does not extend to prospective customers or new contacts from bought-in lists. Picture what that means for a few ordinary newsletters.

A craft shop that takes an order through its website, offers an opt-out box at checkout, and later emails that customer about new stock in the same line looks like a fair fit. A writer who sells a paid annual subscription can probably rely on it for news about that publication. But the same writer's free readers have not bought anything, so the free list needs consent.

Enquiries are the harder case. Someone who asks for a quote is at least in the neighbourhood of "negotiations for the sale". Someone who enters a free prize draw, downloads a guide or follows you on social media is further away, and we would not lean on the soft opt-in for any of them. Where you are unsure, ask for consent. It takes one extra tick box.

"Similar" is narrower than you might like

The commercial route covers your similar products and services. It does not cover whatever else you might want to tell a past customer about. A garden centre emailing a buyer about seasonal plants is on safe ground. The same garden centre promoting a partner's car insurance is not, because those are neither its products nor similar ones.

There is a second limit that catches campaigning groups out. According to the ICO's direct marketing guidance, the commercial soft opt-in only applies to commercial marketing of products and services. It does not stretch to promoting aims and ideals. A non-charity that sells tickets to a fundraising dinner cannot use that sale to justify later emails asking people to support a campaign.

What changed for charities

Before February 2026, a charity could use the soft opt-in only in the commercial sense, for example with buyers from its shop. The Data (Use and Access) Act 2025 added regulation 22(3A), and the government's factsheet describes the effect: charities can now send fundraising and promotional messages to people who have previously shown an interest in their charitable purposes.

The conditions deserve a careful read if you run a charity's mailing list.

1. You must actually be a charity under the definition. Regulation 22(5) points to the Charities Act 2011, the Northern Ireland Act of 2008 and the Scottish Charity Register. A residents' association, sports club or community company falling outside those definitions cannot use this route, however good its work.
2. The date matters. The ICO's guidance says the route covers contact details obtained on or after 5 February 2026. An address from an event in 2024 needs another basis.
3. The charity itself must collect the details from the person. The ICO is direct on this: there is no such thing as a third-party marketing list that is compliant with the soft opt-in.
4. The purpose must be the charity's own. An email promoting a commercial partner's offer falls outside "sole purpose".

What the opt-out has to do

Both routes share a condition that many forms fail. The chance to refuse has to appear at the moment you collect the address. A notice three emails later does not repair a checkout that never offered it.

A short line beside the email field is enough, along these lines:

We'd like to email you about new stock in our pottery range. Tick here if you'd rather we didn't. You can also unsubscribe from any email.

That box starts unticked, and ticking it means no. Then every email carries a working way out. The law says refusal must be free apart from the cost of sending it, so asking someone to phone a premium line, or to log in to a paid account first, would be hard to defend.

You still need a lawful basis

The soft opt-in answers PECR's question only. UK GDPR asks a separate one about why you may use the personal data at all, and the ICO's page on choosing a lawful basis indicates that legitimate interests could be available where PECR does not require consent. That means weighing your interest against the person's and telling them about it in your privacy information. Their right to object to direct marketing remains absolute.

Keep a record of how each address arrived. A note saying "website order, opt-out shown, date" tells you later which route applies. Without that, a mixed list of buyers, enquirers and sign-ups becomes guesswork, and the honest answer may be that only those with clear consent can stay. Our letter on sign-up form wording shows how to capture this as you go.

The rules here are recent and the ICO's guidance is still catching up with the 2025 Act. Treat this as a starting point, and take legal advice if your fundraising depends on a borderline reading.