Abandoned basket texts: what PECR allows

Somebody picks a teapot and two bags of tea, gets to checkout, types their mobile number, and then the kettle boils or the bus arrives and they never come back. Most shop platforms will happily let you text them an hour later. The question is whether PECR, the Privacy and Electronic Communications Regulations 2003, lets you, and the answer depends on something that happened before they left: what your checkout said when they typed that number in.

Abandoned basket texts are marketing. That much is settled by the ICO's guidance, and it means regulation 22 of PECR applies: consent, or the soft opt-in, and an opt-out in every message. The interesting part is whether a basket on its own can carry the soft opt-in. The ICO has drawn the line between browsing and negotiating a sale, and a half-finished checkout sits close to it.

Is a basket reminder a marketing text?

Yes. The ICO's direct marketing guidance says that "If you want to send a message that actively promotes or encourages people to make use of a particular service, special offer, or upgrade, then it is likely to be direct marketing." A basket reminder exists to get a sale finished. It encourages a purchase the person decided not to make (or forgot to make), and that is promotion, however politely it's worded.

Service messages are the other category, and a basket reminder doesn't fit it. The ICO describes them as messages that "only provide administrative information and do not promote anything", such as confirming an appointment or telling a customer how to get in touch. An order confirmation is a service message because there's an order to confirm. An abandoned basket has no order behind it, so there's nothing administrative left to say.

It isn't solicited marketing either. The ICO's definition is narrow: marketing "is solicited when someone specifically asks you to send a particular message or type of information." A shopper who leaves a basket hasn't asked for a reminder. (A shop that offers a "text me my basket" button is in a different position, because pressing it is a specific request for that one message.)

So the text is unsolicited direct marketing by electronic mail, which PECR defines to include "messages sent using a short message service". Regulation 22(2) says you can't send it to an individual "unless the recipient of the electronic mail has previously notified the sender that he consents", with one exception for businesses, in paragraph (3). That exception is the soft opt-in.

Does a basket count as negotiating a sale?

Regulation 22(3) lets a business send marketing without consent where it "obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient", the marketing is about its "similar products and services only", and the person was given "a simple means of refusing" both when the details were collected and in every message since.

The ICO's guidance on electronic mail marketing explains the middle words. The person doesn't have to buy anything: "It's enough if 'negotiations for the sale' took place. This means that they must actively express an interest in buying your products or services." Its examples of enough: "signing up to a free trial of your product or service, requesting a quote or asking for more details about what you offer". Its example of not enough is someone who "logs into a company's website to browse their range of products". And it adds a test: "You must have some form of express communication from the person and it must involve them buying your products or services."

The guidance has no example of an abandoned basket, so there's no ICO ruling to quote either way. Reading its examples, a shopper who chose particular products, went to checkout and typed in their own mobile number has expressed an interest in buying in a way a browser hasn't, and the number came from them in the course of that. It's a stronger case than a quote request in some ways, since the products and the price were already on the screen. But it's our reading of guidance that doesn't mention baskets, and the safe version of the process works either way, because the next condition is the one a checkout can get wrong without anyone noticing.

Some cases are clear without any reading at all:

• A number collected by a pop-up offering 10% off for signing up is consent territory, and the wording of that pop-up is your consent record.
• Someone who browsed but never typed a number can't be texted, because you don't have one.
• A number from another company, including one in your own group, can't use the soft opt-in. The ICO puts it bluntly: "There is no such thing as a third-party marketing list that is compliant with the soft opt-in."

The opt-out has to come first

This is the condition that trips basket texts up. The ICO says "You must give people a simple way to opt out of your electronic mail marketing when you collect their contact details", and then, more pointedly, "You must offer the opt-out when you collect the contact details. Including an opt-out in an order confirmation email is not sufficient."

Its worked example is a takeaway ordered online. The good version shows a box at the point the mobile number is asked for: "We'd like to send you marketing text messages about our special offers. If you don't want to receive these please tick here." The bad version sends an order confirmation text that tells the customer how to opt out of future marketing, and the ICO's verdict is that "Any further marketing text messages would breach PECR."

For a basket the timing is harsher still, because there may be no later step at all. If the opt-out box sits on the payment page and the shopper left on the page before, they never saw it, and the soft opt-in never started. So the box has to be on the same step as the mobile number field, visible, and not "hidden within your privacy policy" (the ICO's phrase for what doesn't count). Record the answer the moment the field is filled in, with the date and the wording shown.

The data protection side asks for one more thing. The ICO's guidance says that "when you collect someone's details, you must tell them that you intend to send electronic mail marketing." A line beside the field ("We'll text you about your order, and about offers unless you tick the box") does that job and the opt-out's in the same breath.

Similar products, every text, and how many

The soft opt-in only covers "your similar products and services". A reminder about the exact items left in the basket is about as similar as marketing gets, so that condition is the easy one. It doesn't stretch to another company's offer, and it doesn't stretch to a reminder that turns into a general sale announcement.

Every text needs its own way out. The ICO's example of good practice for texts ends "To opt out text STOP to 12345", and its bad practice is a text with no opt-out at all. "Reply STOP to opt out" works when the text comes from a number that can take replies; CaptiFi Connect adds the number to your opt-out list the moment the STOP arrives, and any later send to it is refused.

PECR doesn't say how many reminders you may send or how soon. UK GDPR's fairness principle is the nearest thing to a rule, and the ICO describes fairness as "not doing anything with personal information that people would find unexpected, misleading or detrimental". One reminder is easy to defend. A third one, two days later, about a £6 bag of tea, is the kind of thing people screenshot.

Timing, and when not to send

The busiest stretch is easy to spot. ONS figures put average weekly online retail sales in Great Britain at £3,439.1 million in November 2025, against £2,655.9 million in October, and that's when the most baskets get filled and left.

For a single basket, the hour matters most. A reminder an hour or so after the basket was left reads as helpful; one at ten at night reads as a shop that's watching. Our campaign quiet hours (21:00 to 09:00 London time by default) hold list sends overnight, but a single text sent through the API goes when you send it, so a basket reminder built on the API should set schedule_at for a sensible hour itself. A scheduled text can be cancelled with POST /messages/{id}/cancel while it's still waiting, and the credit comes back. Cancel it the moment the order comes through, or you'll be reminding someone about a basket they've just paid for.

Don't send at all when:

• the shopper ticked the box saying no to marketing texts;
• the number has replied STOP to you before, whatever the box says now;
• the opt-out wasn't on the screen where the number was typed (for example, numbers collected before you fixed the checkout);
• the reminder would carry anything beyond your own similar products.

Writing the text

Short, named, specific and with the way out. For a shop called Fernley Tea:

Fernley Tea: you left Assam 250g and a glass teapot in your basket. It's saved here: example.co.uk/b/7KQ2. Reply STOP to opt out

That's 128 characters, one SMS part. The shop's name comes first, because a link from a sender the reader can't place gives them no reason to tap it. There's no countdown and no "only 2 left" unless it's true; our post on prices in promotional texts covers what the DMCC Act says about urgency claims.

The cost of getting the rest wrong went up this year. Section 115 of the Data (Use and Access) Act 2025 came into force on 5 February 2026, and the ICO's summary says it "brings the enforcement powers under PECR into line with UK GDPR, so that enforcement mechanisms and penalties are the same in most cases". Our post on service text or marketing text has the cases where shops got that line wrong.

Common questions

Do I need consent to send an abandoned cart text?

Not always. An abandoned cart text is marketing, so you need either consent or the soft opt-in, and the soft opt-in only works if the shopper was offered a clear way to refuse marketing texts on the screen where they typed their number. If that box wasn't there, you need consent.

Can I text someone who only browsed my website?

No. The ICO's guidance says browsing a company's website is not enough to count as negotiations for a sale, and without a number the person gave you there is nobody to text anyway.

Does an abandoned basket text need Reply STOP?

Yes. PECR requires a simple, free way to refuse in every marketing message sent under the soft opt-in, and the ICO's example for texts is an instruction to text STOP. The opt-out has to work, so the number it goes to must take replies.

Can I add a discount code to a basket reminder?

Yes, if it's your own offer on your own similar products, and the reminder is already marketing so nothing changes legally. Make sure the discount and any end date are real, because the consumer protection rules on pricing and urgency apply to a text as much as a web page.