Can we email our supporters without explicit consent?

England and Wales: This page sets out the position in full. Scotland: the same rules — PECR is UK-wide, and the charity soft opt-in expressly covers bodies on the Scottish Charity Register (reg. 22(5)(c)). Northern Ireland: the same rules — the soft opt-in expressly covers Northern Ireland charities (reg. 22(5)(b)).

Since 5 February 2026, charities have their own soft opt-in

A charity can now email supporters without consent where three conditions in PECR, the UK’s electronic marketing rules, are all met. The ICO enforces them in England and Wales, Scotland and Northern Ireland alike. The fundraiser or manager who runs the mailing list needs to know all three. This page assumes you have already established your lawful basis for each purpose: holding a supporter’s details is that question, and emailing them is this one.

The Data (Use and Access) Act 2025, section 114(3), inserted a new regulation 22(3A) into PECR. It was brought into force on 5 February 2026 by SI 2026/82, regulation 2(x). The regulation says, verbatim:

“A charity may send or instigate the sending of electronic mail for the purposes of direct marketing where— (a) the sole purpose of the direct marketing is to further one or more of the charity’s charitable purposes; (b) the charity obtained the contact details of the recipient of the electronic mail in the course of the recipient— (i) expressing an interest in one or more of the purposes that were the charity’s charitable purposes at that time; or (ii) offering or providing support to further one or more of those purposes; and (c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of their contact details for the purposes of direct marketing by the charity, at the time that the details were initially collected, and, where the recipient did not initially refuse the use of the details, at the time of each subsequent communication.”

All three conditions must be met. Where they are, you do not need consent to send that message. The charity soft opt-in is this rule. It allows marketing email without consent to people who gave their details while showing interest in, or supporting, the charity’s purposes. Those people must also have been offered a way to refuse.

This is not the business soft opt-in with a new name. The business version needs the details to have come from a sale, or talks about a sale. The charity version does not need a sale.

Someone who expressed an interest in your purposes, or offered or gave support, can qualify. That is broader. But the charity version adds a condition the business one lacks: the sole purpose of the message must be to further your charitable purposes.

The ICO’s own page still says the opposite

Check the ICO’s Guide to PECR today and you will read that charities have no soft opt-in. Its page on electronic mail marketing says, verbatim:

“The soft opt-in rule means you may be able to email or text your own customers, but it does not apply to prospective customers or new contacts (eg from bought-in lists). It also does not apply to non-commercial promotions (eg charity fundraising or political campaigning).”

That sentence was right until 4 February 2026. From 5 February it is the opposite of the law. Regulation 22(3A) is the authority, and the statute wins.

To be fair to the ICO, the page carries a banner. It says, verbatim, “Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.” So the ICO has flagged the page as a whole. It has not corrected this sentence.

The ICO has also published final guidance on the new rule, which the section on your existing list draws on. So the regulator knows the law changed. One older page has not caught up.

This was the position when this guide last read the ICO page, on 7 August 2026. When the ICO corrects it, this section will go. Re-check the page each quarter, and trust the statute over any guidance page that predates February 2026.

Three traps inside the provision

“Charities can now email supporters” is the headline that travels. The conditions decide whether a given message is lawful. Each one has a trap:

1. Purposes “at that time”. The person must have shown interest in, or support for, the purposes that were your charitable purposes when you collected the details. If your objects have since changed or widened, interest in the old purposes does not carry over to the new ones. The chain breaks.
2. The sole purpose. The message must exist only to further your charitable purposes. A mailing that also pushes your trading subsidiary’s shop offer is arguably outside the provision — for the whole mailing, not just the offer.
3. A refusal offered at collection. A simple, free way to say no must have been offered when you first collected the details, and again in every message since. A sign-up form that never offered it cannot be fixed after the event.

Your existing list: not yet, but not never

The first question is whether you can now email everyone you already hold. The ICO answered it in final guidance of 28 April 2026, after a consultation that drew more than 140 responses. Its wording, verbatim: “the charitable purposes soft opt-in commenced on 5 February 2026. You must only use it if you obtained the recipient’s contact details on or after this date.”

So details collected before 5 February 2026 do not qualify on their own. For those contacts, it is consent or nothing — for now.

But existing supporters are not shut out for ever. This is the part most people miss. The soft opt-in can cover a supporter who, after that date:

• interacts with you again
• is shown the soft opt-in wording with a way to refuse
• does not refuse

The ICO’s own example: someone donated in 2025 without giving consent, donated again in April 2026, saw the wording and did not opt out. The charity may write to them.

What counts is the quality of the new interaction, not the date the relationship began. Every donation, event sign-up and volunteer form from now on is a chance to bring a legacy contact across properly.

Texts and direct messages count too

PECR’s “electronic mail” is not just email. Regulation 2(1) defines it, verbatim, as “any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient and includes messages sent using a short message service.”

The ICO reads that to include texts, picture and video messages, voicemails and direct messages on social media. So the soft opt-in reaches your SMS and Instagram campaigns. And where the soft opt-in does not apply, the consent rule reaches them too. “PECR is about email” is how charities get texts wrong.

Phone calls did not change

The 2026 change was to electronic mail only. There is no charity version of the soft opt-in for live marketing calls. PECR regulation 21 is unchanged, and the Telephone Preference Service rules are intact.

You must not make an unsolicited marketing call to a number listed on the TPS, or to anyone who has told you not to call. There is no email or text equivalent of the TPS.

The result is an odd one. A charity now has more freedom to email a supporter than to ring one. A follow-up call to a supporter you may lawfully email is a separate question, with a separate answer.

Build the record, then the form

The deliverable is a system, not a policy. Two parts:

• A record for every contact — how and when you got the details, and what they were interested in or supported. The record also shows whether a refusal was offered at that moment, and every refusal since.
• A sign-up form that offers refusal at the point of collection — a simple, free way to say no, on the form itself.

Without the record, you cannot show that any of the three conditions was met. The date of collection matters twice over: for “at that time”, and for the 5 February 2026 line.

This sits alongside your fundraising obligations, not instead of them. The Code of Fundraising Practice and the Fundraising Preference Service are covered in register with the Fundraising Regulator and adopt the Code. Who in the charity owns this record belongs in your data protection policy. The refusal offered on the form also has to appear in the notice; the step to write your privacy notice covers that sentence.

Next: Someone has asked for their data. What now?

Common mistake: checking the ICO website and concluding charities have no soft opt-in

The ICO’s own PECR guidance page still says the soft opt-in does not apply to charity fundraising. That was correct until February 2026 and is now the opposite of the law: PECR regulation 22(3A) gives charities their own soft opt-in. The ICO has flagged the page as under review but has not corrected the sentence. Rely on the statute, and re-check the page each quarter.

Common mistake: applying the charity soft opt-in to the whole legacy supporter list

The list is the reason the change matters, so it is tempting to use it at once. The ICO’s final guidance says the soft opt-in may be used only where the details were collected on or after 5 February 2026. But existing supporters are not excluded for ever. One who interacts again after that date, sees the soft opt-in wording and does not refuse can be covered.

Common mistake: reading regulation 22(3A) as a general permission

The three conditions are where the risk sits. Interest must have been in the purposes as they were at that time, so changed objects break the chain. The message’s sole purpose must be charitable, so a trading offer in the same mailing is arguably outside it. And a free refusal must have been offered at collection and in every message since.

Common mistake: getting the channel boundary wrong in both directions

The word “mail” misleads one way, and a permission granted for one channel is assumed for all. Electronic mail includes SMS and social media direct messages. So the soft opt-in reaches texts and DMs, and so does the consent rule where the soft opt-in does not apply. Live marketing calls are unchanged, with no charity carve-out and the TPS rules intact.

Worked example

Saltmarsh Trust wants to email its whole supporter list. Most of it was collected before the change. Its trading subsidiary also asks to put a shop offer in the same mailing.

The fundraiser tests each contact against the three conditions. Contacts collected before 5 February 2026 are held back. For them it is consent or nothing, until they re-engage and are shown the wording with a way to refuse.

Contacts collected since are checked for two things. The first is whether a refusal was offered on the form. The second is whether the charity’s objects were the same then as now.

The shop offer comes out. It would break the sole-purpose condition for the whole mailing, so it goes separately, on the business soft opt-in or on consent. The same rules govern the SMS reminder Saltmarsh plans to send. The telephone follow-up it was also considering is a different regime: the TPS register is checked first.

The outcome:

• a preference record per contact, showing how and when the details were collected and whether a refusal was offered
• a sign-up form that offers refusal at collection
• legacy contacts held back until they re-engage
• the subsidiary’s offer sent on its own footing
• a note in the file dated against the ICO page