Update - PECR charitable purposes soft opt in guidance published
What’s happening?
Changes to data protection law which came into effect on 5 February 2026 mean that charities have more flexibility when sending electronic marketing messages. A new “charitable purposes soft opt‑in” extended an existing exception, previously available only to commercial organisations, to charities.
The ICO has now published its updated guidance on direct marketing using electronic mail which, following a period of consultation, includes guidance relating to the charitable purposes soft opt in giving charities greater clarity around its use.
What is electronic marketing and what are the rules?
The law relating to electronic marketing is the Privacy and Electronic Communications (EU Directive) Regulations 2003 (PECR), and where such marketing involves personal data UK GDPR applies as well.
PECR restricts unsolicited marketing by phone, email, text or other electronic message (e.g direct message on social media). There are different rules for different types of communication but the rules are generally more robust where the unsolicited electronic marketing is sent by organisations to individuals rather than to companies.
Some organisations sending unsolicited electronic marketing messages to individuals will need specific consent to do so lawfully. However, an organisation selling goods or services has been able to send unsolicited electronic marketing messages to individuals more easily and without consent if:
- The organisation has previously sold them goods or services, or negotiated the sale of goods or services with them; and
- The individual provided their contact details to the organisation directly and did not opt out of receiving electronic marketing messages (despite being given the opportunity to do so when their details were first collected and in every message subsequently sent to them).
The problem for charities was that this soft opt-in did not apply to non-commercial promotions like fundraising.
So, what’s changed this year?
Data protection law has been going through a process of reform brought about by the Data (Use and Access) Act 2025 (DUAA) and this includes an amendment to create the new charitiable purposes soft opt-in.
However, it is important to note before we go on, that these changes do not mean charities have a blanket permission to send unsolicited electronic marketing messages to members of the public, even those they have interacted with previously.
How does the charitable purposes soft opt-in work?
The ‘charitable purposes soft opt-in’ allows a charity to send unsolicited electronic marketing messages where the sole purpose of that message is to further one or more of its own charitable purposes to people who have expressed interest in and/or offered or provided support to further the charity’s charitable purposes, without needing their prior consent.
Actively expressing an interest in or offering support can include donating, purchases clearly supporting the charitable purposes (the guidance says this might include activities such as taking out an annual membership, sponsoring an animal, entering a charity raffle or paying to take part in a charity’s fundraising event) and volunteering. Receiving support from a charity isn’t enough, on its own, to show an “active” interest however.
To benefit from the soft opt-in though, the charity must have obtained the person’s contact details directly from them. In addition, charities must ensure individuals are given a clear opportunity and simple means to opt out of receiving electronic marketing at the time their personal data is collected and in every communication they are sent. And, of course, any opt outs must be honoured.
It is also important to be aware that:
- Unfortunately, the change to the PECR rules only applies to registered charities and not other non-profit organisations.
- Charities cannot use existing databases to send unsolicited electronic marketing messages. The ICO is very clear in its guidance saying: “the charitable purposes soft opt-in commenced on 5 February 2026. You must only use it if you obtained the recipient’s contact details on or after this date”.
What should charities do now?
1. Assess whether the charitable purposes soft opt-in is right for your charity
Evaluate whether using the charitable purposes soft opt-in to send unsolicited electronic marketing messages aligns with your charity’s objectives and values. For some organisations, it may not be appropriate to apply this approach to all individuals, regardless of their previous engagement.
2. Mixed messages
Take care if you use both the commercial and charitable purposes opt ins as there are specific rules about mixed messages (containing both commercial and charitable purposes marketing messages) which must be complied with.
3. Establish your lawful basis under UK GDPR
Since consent will not be required under the soft opt-in, consider whether legitimate interests is the most suitable lawful basis for processing personal data. If you choose this route, you must complete a Legitimate Interest Assessment (LIA) to demonstrate and document your reasoning.
4. Update your privacy notices
Clearly explain how you will use personal data under the charitable purpose soft opt-in. Transparency is key.
5. Explain the soft opt-in at data collection
When collecting contact details, tell people what the soft opt-in means and why they may receive marketing communications from your charity.
6. Review processes and templates
Update data collection and storage processes, ensure communication templates include information about marketing messages and opt-out methods, and put systems in place to record and action opt-outs promptly.
7. Restructure your marketing databases
The ICO recommends keeping separate lists of:
- People who should not receive unsolicited marketing
- People who have given consent
- People who will be contacted under the charitable purposes soft opt-in
8. Train staff and volunteers
Ensure your team understands the rules, including how to respond to queries and complaints about electronic mail marketing.
9. Always offer an opt-out
Provide an opt-out option when you first collect contact details and in every marketing communication.
Need help?
If you require any further guidance on the charitable purposes soft opt in, please contact a member of our Data Protection team.
Important
Charities also need to be aware of the new requirement to have a data protection complaints process in place by 19 June 2026. You can read more about this requirement here.
___________________________________________________________________________________________
Disclaimer
This information is intended for general informational purposes only and does not constitute legal advice. We recommend seeking professional advice before taking any action on the information provided. If you would like to discuss your specific circumstances, please feel free to contact us on 0800 2800 421.
