Consent for marketing texts and emails in the UK (PECR and the soft opt-in)

In the UK, you can only send marketing emails or texts to individuals if they have specifically consented, or if the "soft opt-in" applies. The soft opt-in lets you market your own similar products or services to people whose details you got during a sale or negotiations for a sale, as long as you gave them a clear chance to opt out when you collected their details and in every message since. These rules come from the Privacy and Electronic Communications Regulations (PECR), which sit alongside UK GDPR.

For promoters and artists, that means knowing exactly how each contact got onto your list and what they agreed to. This is general guidance, not legal advice: the ICO's direct marketing guidance is the authoritative source.

Key takeaways

Marketing by email and text to individuals needs specific consent or the soft opt-in.
The soft opt-in only covers your own similar products or services, to people whose details you got through a sale or negotiations for a sale, with an opt-out offered at collection and in every message.
Practical information about an event someone already has a ticket for is usually a service message, not marketing, until you add promotional content.
Consent obtained by someone else for "selected third parties" isn't enough for you to market to those people.
Keep a record of when, where and how each person opted in, and what they were told.

What PECR covers

PECR is the UK law on electronic marketing. It covers marketing by:

Email.
Text message (SMS and MMS).
Phone calls and automated calls.
Similar electronic messages. Most practitioners treat marketing via messaging apps such as WhatsApp in the same way as texts, and WhatsApp's own business policy separately requires opt-in before you message people.

It works alongside UK GDPR. UK GDPR governs how you handle personal data generally. PECR adds specific rules about sending marketing messages. You need to comply with both. See GDPR for promoters and artists for the wider picture.

The Data (Use and Access) Act 2025 amends PECR, including changes to enforcement and an extension of the soft opt-in to charities. Changes are being commenced in stages, so check the ICO's current guidance.

What counts as "direct marketing"

Direct marketing is the communication of advertising or marketing material directed at particular individuals. For promoters and artists, that includes:

Gig and tour announcements.
Presale codes and on-sale reminders.
"Last few tickets" messages.
New release and merch messages.
Newsletters promoting your events or music.

It doesn't have to be selling something directly. Promoting your aims or brand also counts.

The default is that you need the person's specific consent to send them marketing by email or text. Under UK GDPR, consent must be:

Freely given: not a condition of buying a ticket unless genuinely necessary.
Specific: for the channel and the type of messages.
Informed: they know who you are and what they'll get.
Unambiguous: a clear positive action, such as ticking an unticked box or texting a keyword to opt in.

What doesn't count:

Pre-ticked boxes.
Silence or inactivity.
Burying consent in terms and conditions.
Assuming someone who follows you on Instagram wants your emails.

On a sign-up form, something like:

Get first access to tickets and gig news from [Your Name] by email and text. You can unsubscribe at any time. Privacy notice: [link]

with separate unticked boxes for email and SMS if you want to collect them separately. For more on form design, see fan sign-up forms that convert.

Rule 2: the soft opt-in

The soft opt-in is an exception to the consent rule. It only applies if all of the following are true:

You got the person's contact details yourself, in the course of a sale or negotiations for a sale of a product or service.
You're only marketing your own similar products or services.
You gave them a simple way to refuse marketing when you collected their details.
You give them a simple way to opt out in every message you send.

How it applies to promoters

If someone buys a ticket directly from you and, at checkout, you clearly offered them the chance to say no to marketing, you can generally use the soft opt-in to tell them about your future similar events.

The grey areas:

Tickets sold through a ticket platform. The soft opt-in requires you to have obtained the details in the course of the sale. Where the platform is the seller and passes data on, it's less clear-cut. Look at how the platform collects data and what buyers are told. Many promoters ask for explicit consent rather than rely on the soft opt-in here. See getting your customer data out of ticketing platforms.
Free events. The soft opt-in depends on a sale or negotiations for a sale. If no sale is involved, consent is the safer route.
"Similar" products. Club nights to club nights is clearly similar. Club nights to an unrelated product isn't.
Other people's events. You can't use the soft opt-in to market someone else's show to your buyers.

How it applies to artists

If you sell merch or tickets directly to fans, the same logic applies to marketing your own similar products. For a fan who signed up on a form without buying anything, you'll need consent.

Service messages are not marketing

Some messages aren't marketing at all. Practical information sent to someone about something they've already bought is generally a service message, for example:

Ticket confirmations.
Door times and set times for the show they're attending.
Venue changes, postponements and cancellations.
Entry requirements and what to bring.

Service messages don't need marketing consent. But once you add promotional content, such as "and tickets for our next night are on sale now", the message becomes marketing. Keep service messages clean.

You can't buy a list and start emailing it. If someone else collected the consent, it only covers you if you were specifically named at the time. The ICO's view is that consent for "selected third parties" or similar generic wording isn't specific enough.

This matters for co-promotions, venue lists and partnerships. A co-promoter's list is theirs. If you want to use each other's contacts, collect consent that names both of you. See co-promoting a show.

Business contacts

PECR's consent rules for email and text apply to "individual subscribers", which includes sole traders and some partnerships. Messages to employees at their corporate email addresses are treated differently under PECR, but you must still identify yourself and give a valid opt-out address, and UK GDPR still applies. For artists and promoters, almost all fan contacts are individuals, so assume consent or the soft opt-in is needed.

What every marketing message needs

Whatever the basis, every marketing email or text should:

Make clear who it's from. Don't disguise or conceal your identity.
Include a valid way to opt out, such as an unsubscribe link or "Reply STOP".
Be honoured promptly. Once someone opts out, stop sending them marketing.

How to handle opt-outs properly is covered in unsubscribes and STOP replies.

UK GDPR requires you to be able to demonstrate consent. For each contact, record:

What to record	Example
Who	Contact's name and email or number
When	Date and time of sign-up
Where	Sign-up form on the event landing page, QR code at the merch table
What they were told	The consent wording shown at the time
Which channels	Email, SMS, WhatsApp
Basis	Consent or soft opt-in

In Backline, consent is tracked against each contact, so you can see which channels someone agreed to and where they signed up.

There's no fixed time limit in the legislation. The ICO's view is that how long consent lasts depends on context, including what people were told and how they'd reasonably expect it to be used. If you haven't contacted someone for a long time, or they signed up for one specific thing, it's sensible to refresh consent rather than rely on an old opt-in.

A quick compliance checklist

Know how each contact joined your list.
Use unticked boxes and clear wording on every form.
Ask separately for email, SMS and WhatsApp where appropriate.
Use the soft opt-in only for your own similar events, with an opt-out at collection.
Keep service messages free of promotional content.
Never use bought or borrowed lists.
Identify yourself and include an opt-out in every message.
Store consent records you could show the ICO.

Frequently asked questions

What is the soft opt-in?

The soft opt-in is an exception in PECR that lets you send marketing emails and texts without explicit consent to people whose details you got during a sale or negotiations for a sale. It only covers your own similar products or services, and you must offer a simple opt-out when you collect the details and in every message. This is general guidance, not legal advice.

Can I text people who bought a ticket to my last event?

Possibly, under the soft opt-in, if you sold them the ticket yourself, offered a clear opt-out at the time, and you're promoting your own similar events with an opt-out in each text. If the ticket was sold by a platform or you didn't offer an opt-out, get consent first.

Does PECR apply to WhatsApp messages?

Marketing via messaging apps is generally treated the same way as text messages, so you should have consent or the soft opt-in. WhatsApp's own business rules also require people to opt in before you message them. Check the ICO's current guidance for the latest position.

Is a "doors open at 8pm" text marketing?

No, a practical message to someone who already has a ticket for that event is generally a service message. It becomes marketing if you add promotional content, such as promoting another event or merch, so keep the two separate.

Can I use a mailing list from another promoter?

Only if the people on it specifically consented to hear from you by name. Generic consent for "partners" or "selected third parties" isn't enough under the ICO's guidance. The safest approach is for each promoter to collect consent that names both parties.