Quick answer: The charity soft opt-in lets a charity send marketing emails and texts to people without their consent, as long as it collected their details directly when they showed interest in, or offered support to, its charitable purposes, and offered a simple opt-out then and in every message. It started on 5 February 2026.
For years, small charities could only email or text supporters about fundraising if those supporters had ticked a consent box. The Data (Use and Access) Act 2025 changed that by adding a new “charitable purpose soft opt-in” to the Privacy and Electronic Communications Regulations (PECR). This guide explains the charity soft opt-in in plain English, using the ICO’s guidance on how to comply with the PECR electronic mail marketing rules, read on 22 October 2026.
What is the charity soft opt-in?
It is a lawful way for a charity to send electronic marketing to individuals without asking for consent first, provided strict conditions are met. Until 2026, the only soft opt-in was for organisations marketing their own products and services to existing customers. That rarely fitted a charity asking for donations, so most charities relied on consent.
The ICO’s summary of the PECR changes in the Data (Use and Access) Act 2025 describes it as “a new soft opt-in rule for charities”. The ICO’s guidance says it commenced on 5 February 2026.
Who can use the charity soft opt-in?
Only charities can use it. PECR relies on the legal definition of a charity in each UK nation, so you must meet that definition. In practice, that means:
- Your charity, not a connected organisation. A trading subsidiary cannot use it, even if its profits go to the charity.
- Details you collected yourself. Contact details bought, swapped or received from a third party do not qualify.
- Details collected on or after 5 February 2026. The rule does not reach back to older supporter lists.
What conditions do you need to meet?
You need to meet every condition, every time. Based on the ICO’s guidance, a charity can rely on the soft opt-in only when:
- the person gave you their details directly, for example on your website, at an event or when donating;
- at that moment they expressed an interest in your charitable purposes, or offered or gave support to further them. Donating and volunteering count as support;
- you gave them a simple way to opt out when you collected their details. The ICO says an opt-out hidden in a privacy notice, or offered only in an order confirmation, is not enough;
- you give them a chance to opt out in every message after that. Unsubscribe links should be clear, and people should not have to create or log into an account to use them.
If any one of these is missing for a contact, you need consent to send them electronic marketing.
What messages can a charity send under it?
The sole purpose of the message must be to further your own charitable purposes. The ICO gives examples such as:
- asking for donations;
- asking for volunteers;
- sharing updates about your work and mission.
You cannot use it to promote other organisations, including other charities, partners or sponsors. The ICO also asks charities to take particular care when marketing to people who may be vulnerable or at risk of harm.
How do you set it up properly in a small charity?
Most of the work is in how you collect details, not in the emails themselves. A practical order for a small team:
- Update every collection point. Add a clear, unticked “I don’t want to hear from you” option next to the email or mobile field on donation forms, volunteer forms and event sign-ups.
- Record the source and date. For each new contact, keep where and when you collected their details, what they were supporting and whether they opted out. That record is your evidence if anyone asks.
- Keep pre-2026 contacts separate. Tag anyone collected before 5 February 2026 so they stay under consent rules.
- Check every template has an unsubscribe link that works in one click, and act on opt-outs promptly.
- Make sure your emails arrive. Supporters cannot respond to messages that land in spam. Our guide to DMARC in plain English explains how to protect your domain, and our free email security check shows where you stand.
For how this fits with the rest of PECR, including phone calls, cookies and the ordinary soft opt-in, read PECR explained for charities, dental practices and care providers.
What else changed for PECR in 2026?
The same Act changed how PECR is enforced. The ICO’s summary says the changes bring enforcement powers under PECR into line with UK GDPR, so penalties and enforcement mechanisms are the same in most cases. For a small charity, that is a good reason to get the basics right now rather than later. If you are also working through wider requirements, our guide to DSPT and Cyber Essentials for charities covers the security side.
FAQs
Does the charity soft opt-in cover text messages?
Yes. PECR treats emails and text messages as electronic mail, so the same conditions apply to both. Phone calls and post follow different rules, which our PECR guide explains.
Can our charity shop or trading subsidiary use it?
No. Only the charity itself can rely on it, and the details must be collected directly by the charity. A trading subsidiary can still use the ordinary soft opt-in for its own products and services if it meets those separate conditions.
Can we use it for supporters who signed up before February 2026?
No. The ICO says it only applies to contact details collected on or after 5 February 2026. For older contacts, rely on the consent you already hold, or another valid basis.
Does a purchase from our shop count as support?
Usually not. The ICO’s guidance says a purchase that is merely transactional, incidental or made for convenience generally does not count. A donation or volunteering does.
How we can help
Unavoidably Secure helps small charities check the technical side of supporter communications: whether your domain is protected against impersonation, whether your emails are set up to reach inboxes, and where supporter data might be exposed. We give you a plain-English list of what to fix first. We do not certify, accredit or guarantee compliance.
This article is general information, not legal advice. Facts were checked against the ICO’s electronic mail marketing guidance and its summary of the Data (Use and Access) Act 2025 on 22 October 2026. If you are unsure whether the soft opt-in applies to a particular contact, ask for consent instead, or browse the blog for related guides.
Is your charity’s email set up properly?
Book a free external audit. We will review your website, email security and supporter data basics, and give you a plain-English list of what to fix first.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day.