Quick answer: PECR, the Privacy and Electronic Communications Regulations, are the UK rules for marketing by email, text and phone, and for cookies on your website. They sit alongside UK GDPR. For most small organisations that means two things: get consent before sending marketing emails or texts to individuals, unless a soft opt-in applies, and get consent for non-essential cookies.
PECR rarely gets the attention that UK GDPR does, yet it governs two things almost every dental practice, care provider and small charity does every week: sending emails or texts, and running a website. The rules changed in 2026, with a new soft opt-in for charities, new cookie exceptions and much higher fines. This guide explains what PECR asks of a small organisation in plain English, using the Information Commissioner’s Office (ICO) guidance read on 15 October 2026. It is not legal advice.
What is PECR and who does it apply to?
PECR applies to any organisation that markets by phone, email, text or fax, or uses cookies or similar technologies on its website. According to the ICO’s guide to PECR, the regulations also cover the security of public communications services and some customer privacy rules for phone and internet providers, but for a small practice or charity the marketing and cookie rules are the ones that matter.
Two points often surprise people. First, PECR uses the UK GDPR standard of consent, so if you send electronic marketing or use cookies you need to comply with both. Second, PECR can apply even when you are not processing personal data, for example when a cookie is set on a device.
When do you need consent to send marketing emails or texts?
You normally need consent before sending marketing emails or texts to individuals. The ICO’s electronic mail marketing guidance says pre-ticked boxes, silence or inactivity cannot count as consent, and consent should be asked for separately for each type of message, such as email and text.
Three details matter for small organisations:
- Sole traders and ordinary partnerships count as individuals. A self-employed dental hygienist or a two-partner practice needs the same consent or soft opt-in as a member of the public.
- Corporate subscribers are different. You can send unsolicited marketing emails to limited companies and other corporate bodies without consent, but you must still say who you are and give a valid address to opt out.
- Fundraising is marketing. The ICO’s guidance on identifying direct marketing says promoting aims and ideals, including fundraising and campaigning, counts as direct marketing.
What are the soft opt-ins, and can a charity use one?
A soft opt-in lets you send marketing emails or texts without consent, as long as strict conditions are met. Since 5 February 2026 there are two.
The commercial soft opt-in is open to any organisation, charities included. All five conditions apply: you got the contact details directly from the person, during a sale or negotiations for a sale, you only market similar products or services, you offered a way to opt out when you collected the details, and you offer one in every message after that.
The charitable purposes soft opt-in is open only to charities. The ICO says it commenced on 5 February 2026 and can only be used for contact details obtained on or after that date. All six conditions apply:
- You meet the legal definition of a charity in your UK nation.
- You got the contact details directly from the person.
- They gave them while expressing an interest in, or offering or providing support for, your charitable purposes.
- The sole purpose of the marketing is to further your charitable purposes.
- You offered a free, simple way to opt out when you collected the details.
- You offer one in every message after that.
Our guide to the DSPT and Cyber Essentials for charities covers the security side of holding supporter data.
What does PECR say about cookies on your website?
You need consent for cookies and similar technologies unless one of the exceptions applies. The ICO’s guidance on exceptions for storage and access technologies lists five: transmitting a communication, providing a service the visitor has asked for where the cookie is strictly necessary, collecting statistics to improve your service, adapting appearance or functionality to the visitor’s preference, and locating someone who needs emergency assistance.
The statistics exception is the one most small organisations ask about, because it can cover website analytics. The conditions are strict:
- The sole purpose is collecting statistical information about how your own service is used, to improve it.
- You give clear, comprehensive information about it and a simple, free way to object, and you stop if someone objects.
- Individual-level data is aggregated, does not identify people and is kept only as long as needed.
- Any analytics provider acts as your processor, not a joint controller, and you tell visitors you use one.
- It never covers tracking individuals, profiling or any advertising purpose.
Many popular analytics set-ups share data for advertising, so check your settings before you drop the consent banner for them.
What are the fines for breaking PECR?
The ICO can now fine up to £17.5 million or 4% of global turnover for breaches of PECR. Its statement on the commencement of the Data (Use and Access) Act, published on 5 February 2026, confirms the new power. Before that, PECR fines were capped at £500,000. A small organisation is unlikely to face the maximum, but the change shows how seriously unwanted marketing and cookie misuse are now treated.
A simple PECR checklist for a small organisation
- List what you send. Newsletters, appeals, offers, recall texts and appointment reminders.
- Separate service messages from marketing. The ICO says messages for administrative or customer service purposes, such as confirming an appointment, are not direct marketing, but adding a promotion turns them into marketing.
- Record your basis for each list. Consent, the commercial soft opt-in or, for charities, the charitable purposes soft opt-in.
- Check every message has an opt-out and that opt-outs are acted on promptly.
- Audit your website cookies. Keep strictly necessary ones, check whether analytics meets the statistics exception, and ask consent for the rest.
- Check your email domain is protected, so nobody can send marketing that looks like it came from you. Our free email authentication check shows where you stand.
If a supporter or patient asks what you hold about them for marketing, our guide to handling a subject access request explains the process. You can read how we handle cookies on this site in our privacy notice.
FAQs
Are appointment reminders covered by the marketing rules?
Not if they are purely about the appointment. The ICO treats routine service messages as outside direct marketing. If the reminder also promotes a treatment, offer or appeal, it counts as marketing and the consent rules apply.
Can a charity use the new soft opt-in for supporters it already has?
Only for contact details collected on or after 5 February 2026, and only if all six conditions were met at the time. For older contacts, rely on the consent you already hold, or ask for it again.
Is PECR the same as UK GDPR?
No. PECR is a separate set of rules that sits alongside UK GDPR and uses its standard of consent. If you send electronic marketing or use cookies, you need to comply with both.
Who enforces PECR?
The Information Commissioner’s Office. It handles complaints about unwanted marketing and cookies and can issue fines, including the higher amounts introduced by the Data (Use and Access) Act.
How we can help
Unavoidably Secure offers independent audits for dental practices, care providers and small charities. We can check your website cookies, your email security and how your marketing lists are collected, and tell you plainly what to fix. We do not certify or guarantee compliance, and nothing in this article is legal advice. For more guides, head back to the blog.
Not sure your emails and cookies are in order?
Book a free external audit. We will look at your website, your cookies and your email security, and tell you plainly what to fix.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.