Marketing consent and leads

What makes marketing consent valid, why passing a lead to another company needs a consent of its own, and how the UK rules in PECR deal with it.

Markmatix editorial teamUpdated 3 November 20266 min

Form · separate consents

  • Publisher marketingunticked box
  • Passing to banks and lendersunticked box
  • Passing to insurersunticked box
  • Recipientslist one click away
  • Pre-ticked boxesnone

one consent per purpose

Example: how we are designing it, with made-up data.

In short Under the GDPR, consent must be freely given, specific, informed and unambiguous, and you must be able to prove it. Passing a lead to another company is a separate purpose: it needs a separate consent that tells people who will get their data. In the UK, PECR regulation 22 requires consent for marketing emails and texts to individuals. The soft opt-in only covers your own similar products, so it never covers a lead you pass on.

Article 4(11) of the GDPR defines consent as a "freely given, specific, informed and unambiguous indication" of someone's wishes, given by a statement or a clear affirmative action. Article 6(1)(a) makes it a lawful basis only for "one or more specific purposes".

Article 7 adds four conditions:

  • you must be able to demonstrate that the person consented (Article 7(1));
  • if the request sits in a form that covers other matters, it must be clearly distinguishable, in clear and plain language (Article 7(2));
  • people can withdraw at any time, and withdrawing must be as easy as giving consent (Article 7(3));
  • consent is unlikely to be free if a service is conditional on consent that the service does not need (Article 7(4)).

Recital 32 settles the question of tick boxes: silence, pre-ticked boxes or inactivity do not count as consent. The UK GDPR keeps the same definition, and the ICO notes that PECR takes its standard of consent from it.

Passing a lead on is a separate purpose

The EDPB's Guidelines 05/2020 on consent are the clearest EU text on this. Where processing has several purposes, each needs its own consent (paragraph 44). In Example 7, a retailer asks in a single request for consent to email its customers and to share their details with group companies. The EDPB says that consent is not valid. A specific consent is needed to send contact details to commercial partners. It is valid for each partner whose identity was given to the person at the time of collection.

Paragraph 65 goes further. Where other controllers want to rely on the consent you collected, "these organisations should all be named". Processors acting for you do not need to be named in the consent request, although they still belong in your privacy information.

National authorities do not all read this the same way. The Italian authority, the Garante, works with categories of recipient, and has said people must at least be able to choose category by category (decision no. 114 of 27 February 2025). The EDPB and the ICO expect names. If you collect leads in more than one country, the stricter reading is the safer one: name the recipients and add a partner only after fresh consent.

Under Article 7(1) the burden of proof is yours. The GDPR does not say how to meet it, but the EDPB does (paragraphs 104 to 108). You must be able to show how, when and on what information consent was given. Online, that can mean keeping data about the session in which consent was given, a record of the consent workflow at the time, and a copy of the text people saw. Pointing to a correctly configured website is not enough. Keep the proof while the processing lasts, and afterwards only as long as a legal obligation or a possible legal claim requires (paragraph 107). Don't collect more data than you need to prove it.

For each consent, record:

  • the date and time;
  • the exact wording shown, with its version;
  • each purpose accepted or refused;
  • the recipients named at that moment;
  • the page and form used;
  • every withdrawal, as a new entry that leaves the earlier one in place.

The UK: PECR regulation 22

Regulation 22 of the Privacy and Electronic Communications Regulations 2003 covers unsolicited direct marketing by electronic mail, which includes email and text messages, to individual subscribers. You must not send or instigate such messages unless the recipient has told the sender they consent "for the time being".

The ICO's guidance on direct marketing using electronic mail, updated on 28 April 2026, sets out what this means in practice:

  • the consent request must make clear that it covers your marketing messages and give your name;
  • consent should be asked for each channel separately, for example email and texts;
  • consent is not transferable: it covers the address or number the person gave you;
  • if you ask another organisation to send your marketing, you are likely to be instigating it, and both of you are responsible;
  • unsolicited marketing to corporate subscribers does not need consent, but sole traders and ordinary partnerships count as individuals, and you must always identify yourself and give a way to opt out.

People also have an absolute right to object to direct marketing under data protection law (Article 21(2) and (3) of the GDPR; the ICO describes the same right under the UK GDPR). Keep a suppression list.

The soft opt-in does not travel

Regulation 22(3) lets you email without consent only if you obtained the contact details while selling, or negotiating to sell, a product or service. You may then market only your own similar products and services. People must get a simple, free way to refuse when you collect their details and in every later message.

The ICO is blunt about third parties. You must obtain the details directly from the person, and "there is no such thing as a third-party marketing list that is compliant with the soft opt-in".

Since 5 February 2026 there is a second soft opt-in, for charities only (regulation 22(3A), added by section 114 of the Data (Use and Access) Act 2025). It too covers only the charity's own charitable purposes, not other organisations.

Buying and selling leads: what the ICO expects

If you buy a list, the ICO says you must check that the consent:

  • named your organisation, not just "trusted partners" or similar;
  • clearly covered the channel you plan to use;
  • was freely given, specific, informed and unambiguous;
  • is recorded, so you can show who consented, when and how.

If it did not name you, it is not valid for you. The ICO's direct marketing guidance adds due diligence: who compiled the data, where it came from, what people were told, when, and whether objections are passed on. Accepting a seller's assurances is not enough.

The buyer must also give its own privacy information, including the source of the data, within a month and at the latest at the first communication (Article 14 of the GDPR and UK GDPR). For a publisher this means buyers will ask for the exact wording, the timestamp and proof that their name was on the form.

If you sell leads into the United States, a different regime applies, built around the Telephone Consumer Protection Act. It works differently and is outside this guide.

How we are designing Markmatix for this

Markmatix is in development: what follows describes the design, not a feature you can use today. The consent record will add a new entry for every consent or withdrawal, with the purpose, the exact wording and its fingerprint, the version, the date, the page and the form. Purposes will stay separate: the publisher's own marketing, profiling, passing data to third parties by recipient or category, and measuring opens and clicks. During lead distribution the platform will block a transfer to any recipient the consent does not cover, and withdrawals will be passed on to partners who received the lead. You can follow progress through the waitlist.

Sources

  • Regulation (EU) 2016/679 (General Data Protection Regulation), 27 April 2016: Articles 4(11), 6(1)(a), 7, 14 and 21; recital 32. EUR-Lex
  • The Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426), regulation 22, as amended from 5 February 2026. legislation.gov.uk
  • Data (Use and Access) Act 2025 (c. 18), section 114 (charitable purposes soft opt-in). legislation.gov.uk
  • ICO, Guidance on direct marketing using electronic mail, "How do we comply with the PECR electronic mail marketing rules?", latest update 28 April 2026. ico.org.uk
  • ICO, Direct marketing guidance, "Collect information and generate leads", latest update 28 April 2026. ico.org.uk
  • EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1, adopted 4 May 2020: paragraphs 44-45, 65, 104-108. edpb.europa.eu
  • Garante per la protezione dei dati personali (Italy), decision no. 114 of 27 February 2025, doc. web no. 10114967. garanteprivacy.it

This guide explains the rules in general and is not legal advice: for your case, ask a lawyer.

Common questions

Does the soft opt-in let me share or sell leads?

No. Under PECR regulation 22(3) it covers only your own similar products and services, and only contact details you collected yourself. The ICO says no third-party list can be soft opt-in compliant.

Is "our trusted partners" enough in a consent request?

No. The ICO says consent on a bought-in list must have named the buyer's organisation, not just "trusted partners" or similar. The EDPB says every controller relying on the consent should be named.

Do I need separate consent for email and text messages?

The ICO recommends asking for each type separately, because some people want one and not the other. Consent also covers only the address or number the person gave you.

Do I need consent to email business addresses in the UK?

Not for unsolicited marketing to corporate subscribers under PECR. Sole traders and ordinary partnerships count as individuals, though, and data protection law still applies to named people's details.

How long should I keep proof of consent?

For as long as you rely on it. Afterwards, the EDPB says, only as long as you need it for a legal obligation or to deal with legal claims (Guidelines 05/2020, paragraph 107).

Save me a seat:

We will email you a link: you are only signed up after you open it and press "I confirm". The data controller is Redbit S.r.l.s., Viale della Grande Muraglia 494, 00144 Rome, Italy. We use your email and, if you give them, your name and website only to send you news about the Markmatix launch and the early access invitation, with your consent. You can withdraw it at any time. privacy notice.