Marketing consent is a person's voluntary, informed agreement to receive marketing communications or to allow specified marketing-related processing of their personal data. In a data-protection context, consent is more demanding than merely providing contact details, becoming a customer, creating an account, or failing to object. Under the UK GDPR standard, consent must be freely given, specific, informed and unambiguous and must involve a clear affirmative action.
For electronic direct marketing to individuals, the UK Privacy and Electronic Communications Regulations (PECR) generally require consent unless a relevant exception, such as the products-and-services soft opt-in, applies. Marketing consent can cover activities such as promotional email, SMS marketing, push notifications or particular forms of personalised marketing, but the scope needs to be sufficiently clear. A person consenting to one communication channel does not automatically consent to every other channel.
Valid consent requires genuine choice. A business should not make marketing consent a condition of obtaining a service where the marketing is unnecessary for providing that service, because doing so can undermine the requirement that consent be freely given. Consent requests should be presented clearly rather than hidden in lengthy terms and conditions or privacy notices. A pre-ticked box, silence, inactivity or a default setting does not demonstrate the positive action required for valid consent.
The person should be able to understand who is requesting consent, what marketing they will receive, through which channels, and how they can withdraw their permission. The ICO specifically recommends keeping records showing what the person consented to, when the consent was obtained and how it was obtained, because an organisation needs to be able to demonstrate that its consent is valid.
Marketing consent is distinct from other legal bases for processing personal data. Under UK data-protection law, consent is one possible lawful basis for processing, alongside bases such as contract, legal obligation and legitimate interests. For some electronic marketing activities, however, PECR can impose a consent requirement independently of the UK GDPR. Where PECR requires consent to send electronic marketing, consent will generally also be the appropriate UK GDPR lawful basis for the related processing.
Where PECR does not require consent, such as certain forms of business-to-business electronic marketing, an organisation may in some circumstances consider legitimate interests instead, subject to the applicable requirements. Consequently, saying that a business has a "legitimate interest in marketing" does not automatically permit it to send every type of marketing message. The applicable communications rules and the nature of the recipient must first be considered.
Consent should be sufficiently specific to the marketing activity. For example, a person might separately choose to receive email newsletters but not promotional text messages. The ICO states that consent for one type of communication does not necessarily cover another; consent for marketing calls does not automatically cover text messages, and consent requests should identify the relevant communication method. Specificity also matters when multiple organisations are involved. Consent obtained by a third party is not automatically transferable to another marketer.
Where an organisation relies on consent obtained indirectly, it should be able to establish that the consent specifically identified the organisation and covered the intended communication method and marketing activity. Generic wording such as agreement to receive marketing from "selected partners" can therefore create significant uncertainty about whether a particular organisation has valid permission.
Marketing consent is not necessarily permanent. People can withdraw consent, and withdrawal must be capable of being exercised without unreasonable difficulty. For electronic marketing, every relevant message should provide a straightforward means of opting out or unsubscribing, where applicable. The ICO states that people can change their minds at any time and that organisations must stop relying on withdrawn consent for unsolicited electronic mail marketing.
Withdrawal should also be reflected promptly in marketing systems so that the person is not accidentally re-added to campaigns through another list, CRM import or automated workflow. A robust consent system therefore needs not only an acquisition mechanism but also a reliable suppression mechanism. Suppression records can be important because deleting every trace of a person's marketing preference can make it harder to ensure that an organisation does not inadvertently contact them again.
Consent records are an important operational component of compliant marketing. A useful record can identify the person or relevant identifier, date and time of consent, wording shown at the point of collection, organisation or organisations named, communication channels covered, source or collection mechanism, and subsequent withdrawal or preference changes. The purpose is not merely administrative: the organisation may need to demonstrate that the permission was obtained legitimately.
This becomes particularly important when using marketing automation, CRM platforms, lead-generation forms, competitions, downloadable resources or externally sourced databases. A database containing an email address does not by itself demonstrate consent. Similarly, a historical customer relationship does not automatically establish consent for every future marketing purpose. The evidence should correspond to the actual scope of the processing and communication undertaken.
The UK's PECR rules also recognise a limited "soft opt-in" for certain electronic marketing to existing or prospective customers, but this is not equivalent to unrestricted consent. For the products-and-services soft opt-in, the organisation must have obtained the individual's contact details directly during a sale or negotiation of a sale, must market only similar products or services, must have provided an opportunity to opt out when collecting the details, and must provide an opportunity to opt out in every subsequent communication.
The ICO expressly states that this exception does not make bought-in marketing lists compliant and cannot simply be applied to contacts obtained from another organisation. As of 2026, UK PECR also contains a newer charitable-purpose soft opt-in introduced by the Data (Use and Access) Act 2025, subject to its own conditions. These exceptions should therefore be analysed separately from genuine consent rather than described as another form of opt-in permission.
Common misconceptions include treating a public email address as marketing consent, assuming that a customer automatically agrees to promotional messages, interpreting an unticked box as consent, or believing that a privacy policy containing a vague marketing statement is sufficient. The ICO states that publicly available contact details do not by themselves establish consent to direct marketing. Marketing consent is also different from accepting terms and conditions, agreeing to receive transactional messages, or providing contact information for fulfilment.
Transactional communications necessary to administer an order can have a different legal character from promotional messages. In practice, effective consent management therefore requires clear purpose definition, appropriate wording, affirmative choice, evidence of the decision, channel-specific preferences, straightforward withdrawal and reliable suppression across marketing systems. The underlying principle is that marketing permission should represent an informed choice by the recipient rather than an assumption created by a business's data-collection process.
