Reported incident: HelloFresh, £140,000 fine for 80.9 million unlawful marketing messages

This is a publicly reported regulatory case. The organisation is not, and has not been, one of our clients.

What happened

Grocery Delivery E-Services UK Limited, which trades as HelloFresh, sells meal kits by subscription. Between 23 August 2021 and 23 February 2022 it sent 80,893,013 direct marketing messages: 79,779,279 emails and 1,113,734 text messages.

Customers were signed up to marketing through an opt-in box. According to the ICO's monetary penalty notice, it read: "Yes, I'd like to receive sample gifts (including alcohol) and other offers, competitions and news via email. By ticking this box I confirm I am over 18 years old". The statement did not mention text messages. Customers were also not told that they could keep receiving marketing for up to 24 months after cancelling their subscription.

The ICO began investigating in March 2022 after complaints to the regulator and to the 7726 spam reporting service. The ICO's news release cites 8,729 complaints to 7726, plus 14 complaints to the ICO about texts and three about emails. The penalty notice records 15,221 complaints to 7726 between 27 September 2021 and 23 February 2022, of which HelloFresh considered 8,729 to be valid complaints about marketing. Some people said they were still contacted after asking HelloFresh to stop.

The ICO announced a £140,000 fine on 12 January 2024. The monetary penalty notice is dated 11 January 2024 and offered a 20% reduction, to £112,000, for payment in full by 12 February 2024. In the ICO's news release, Andy Curry, the ICO's Head of Investigations, said: "This marked a clear breach of trust of the public by HelloFresh. Customers weren't told exactly what they'd be opting into, nor was it clear how to opt out."

What the regulator found

• HelloFresh breached regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR) by sending marketing emails and texts without valid consent.
• The opt-in statement referred to email only. It did not tell customers that text messages would be used for marketing.
• Consent to email marketing was bundled with an age confirmation and an offer of free samples. The ICO said the age confirmation statement "was likely to unfairly incentivise customers to agree".
• Customers were not told their details would be used for marketing for up to 24 months after they cancelled. The penalty notice says former customers would not reasonably expect this.
• Some people kept receiving marketing after asking HelloFresh to stop. HelloFresh told the ICO it removed people from its marketing list within 30 days of a request.
• The breach was serious because of its scale: a confirmed 80,893,013 marketing messages over the period.
• The ICO did not consider that HelloFresh deliberately set out to break the law. It found HelloFresh knew or ought reasonably to have known of the risk and failed to take proper care, citing evidence that the company misunderstood how PECR relates to the UK GDPR.

Lessons for small organisations

• Ask for marketing consent for each channel you use. If you plan to send texts as well as emails, say so in the opt-in wording, ideally with a separate tick box for each.
• Keep marketing consent on its own. Do not combine it with an age check, a free offer or acceptance of your terms, because bundled consent is unlikely to be valid.
• Tell people plainly how long you will keep marketing to them, including after they stop being a customer or patient, and stop when that period ends.
• Act on opt-outs quickly and across every channel. Keep a suppression list and check each email or text campaign against it before it goes out.
• Remember that PECR has its own rules for email and text marketing, separate from the UK GDPR. Check your sign-up forms against the ICO's direct marketing guidance and keep a record of what each person agreed to and when.

← All reported incidents