Is Cold Email Legal in the UK? PECR Explained

Yes, to most businesses. PECR treats limited companies, LLPs and public bodies as corporate subscribers, so B2B email is lawful without prior consent, provided you identify yourself and offer an opt-out in every message. Sole traders are not corporate subscribers, and they need consent first.

The United Kingdom is one of the more permissive markets in Europe for B2B outbound, which makes the exception the thing worth getting right. Most UK compliance failures we see are not about the rule. They are about the list.

Is cold email legal in the UK?

For corporate subscribers, yes, without prior consent. The Privacy and Electronic Communications Regulations govern unsolicited electronic marketing in the UK, and they distinguish between two kinds of recipient. Individual subscribers are protected by a consent requirement. Corporate subscribers are not.

That distinction is doing all the work, and it is drawn on legal form rather than on the address or the job title.

Corporate subscriber

• Limited companies
• Limited liability partnerships
• Public bodies

These may be emailed without prior consent. The message still has to identify you and carry a working opt-out.

Individual subscriber

• Sole traders
• Most unincorporated partnerships

These require consent before you send, in the same way a consumer would. A sole trader's business address is still an individual subscriber's address.

Why sole traders are the trap

Nothing about a sole trader's email address announces itself. hello@ at a trading name looks exactly like hello@ at a limited company, and a job title of "Owner" appears on both. A list built by scraping role and domain will contain both, and the sender will not know which is which.

This matters more in some sectors than others. Trades, consultancies, small agencies and independent professional practices carry a high proportion of sole traders. If your ideal customer profile skews small, the exception is not an edge case in your list. It may be a third of it.

How to filter them out in practice

The fix belongs at list build rather than at send, because at send you are guessing. Three signals, in order of reliability:

1. Companies House registration. The authoritative source. A match gives you the legal form directly, and non-matches are the records to hold back.
2. Legal suffix in the trading name. Ltd, Limited, LLP and PLC are strong positive signals. Their absence is weaker evidence than their presence, so treat it as a prompt to check rather than a verdict.
3. Employee count and site signals. A one-person operation with no registered entity is the profile most likely to be an individual subscriber. Useful as a flag, not as proof.

We exclude sole traders from UK sending outright rather than attempting a judgement call per record. The cost is a smaller list. The alternative is a list where you cannot say, record by record, whether you were permitted to send.

PECR or UK GDPR: which one applies?

Both, governing different things. Teams that satisfy one and assume the other is handled are the ones who get caught out.

A UK list of limited companies only, with no lawful basis documented for the data itself, is PECR-compliant and still exposed. The two tests are independent, and a complaint can arrive on either.

What a compliant UK cold email contains

1. Your identity, plainly. The real company name, not a trading alias invented for the campaign, and a contact address.
2. A working opt-out. It must function on the first attempt and be honoured promptly. An unsubscribe that requires a reply to an unmonitored inbox is not an opt-out.
3. Accurate headers. The sender name and subject line should not misrepresent who is writing or why.

None of this is expensive. All of it is checked first when a complaint is made.

The opt-out is an operational commitment, not a link

The regulation cares whether removal actually happens, which makes suppression a process rather than a footer. Three failure modes are worth designing against:

• Suppression that does not span campaigns. Someone opts out of one sequence and receives the next. To the recipient this is the same complaint twice.
• Suppression held per mailbox. If you rotate sending domains, an opt-out recorded on one and not the others will fail at exactly the moment it is being tested.
• Replies that nobody reads. A plain "take me off your list" in a reply is a valid request. If the reply address is unmonitored, you have received it and not acted.

The test a regulator applies is whether removal happened, not whether a link existed. Keep suppression in one place that every campaign and every sending domain reads from, and the three failures above stop being possible rather than being caught by review.

Public bodies are in scope, and they matter here

Councils, NHS trusts, schools and universities are corporate subscribers, so the same permission applies. For anyone selling facilities, cleaning or maintenance services this is the most valuable part of the UK position, because those organisations hold large recurring contracts and publish named contacts.

Two practical caveats. Many run formal procurement, so a cold email is a route to the right conversation rather than to a contract, and the useful outcome is being told where the tender process lives. And published inboxes are often monitored by teams rather than individuals, which changes what a reply means. Judge the segment on conversations started, not on reply rate.

Does the soft opt-in help?

Sometimes, and not for the people most senders want to reach. PECR allows marketing to an individual subscriber without prior consent where you obtained their details in the course of a sale or negotiations for a sale, the marketing concerns your own similar products or services, and they were given a simple chance to refuse at collection and in every message since.

Read those conditions closely, because each one narrows it:

• It needs an existing commercial relationship. A prospect you have never dealt with is outside it. This is an exemption for marketing to your own customers and live negotiations, not a route into cold outreach.
• It is limited to similar products or services. Using a cleaning contract relationship to market an unrelated service does not qualify.
• The refusal opportunity has to have existed at collection. You cannot add it retrospectively to a list that was built without it.

So the soft opt-in is genuinely useful for reactivating lapsed customers and for following up live negotiations. It does not convert a cold sole trader list into a sendable one, which is the use most people are hoping for when they ask about it.

How we run the UK

We send email and LinkedIn into the UK, and we exclude sole traders at the list stage. That is one of fifteen market positions we publish in our market checker, alongside the named legal basis for each.

Publishing it is deliberate. A buyer evaluating outbound providers can check our position in thirty seconds without a call, and a provider who will not state one in writing has told you something useful. The same reasoning shapes how our outbound programmes are scoped, and it is why we decline seven European markets outright rather than sending into them carefully.

For UK operators in facilities and commercial services, the corporate subscriber rule is usually favourable: the buyers worth reaching sit inside incorporated companies and public bodies, which are exactly the recipients PECR permits. We cover that buyer in more detail in our work on lead generation for commercial cleaning and facility services.

Not legal advice. Where your situation is borderline we will say so and recommend you take advice first.