Bought-in lists: why they fail the PECR test

Picture a prize draw website. You put in your name, date of birth, address and phone number for a chance at the prize, and the only way to press the button is to tick a box agreeing to the terms and to "marketing communications from our partners". The privacy policy, if you ever open it, lists 174 organisations who count as partners. One of them, by the time the ICO looked, was a PPI tax refund firm called Quick Tax Claims Limited, which had never heard of you and which you had never heard of, and which sent 7,863,547 texts in three months of 2023 on the strength of boxes like that one. The ICO fined it £120,000 in October 2024.

That one case is a decent guide to the whole subject. A bought-in list arrives with a promise that everyone on it "opted in". The question PECR asks is narrower than that, and it's the narrowness that catches people.

What PECR asks of the sender

Regulation 22 of the Privacy and Electronic Communications Regulations is short. A marketing text (the regulation says "electronic mail", which covers texts) can't go to an individual subscriber unless "the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender". The words that matter are "notified the sender". A competition site isn't the sender, and neither is a broker or a "partner". You are. There's a soft opt-in exception in paragraph (3) for your own customers, which I'll come back to, and since 5 February 2026 a charity version in paragraph (3A), and that's the whole regulation.

The ICO's guide to PECR turns that into a test. Its page on using marketing lists says bought-in lists can be used for texts, emails or recorded calls only with "very specific consent", and that "Generic consent covering any third party will not be enough." Its electronic mail guidance spells out what you have to check on a list before you send a single message: that the consent named your organisation (a line about trusted partners or similar won't do), that it clearly covered the method you're using, that it was freely given, specific, informed and unambiguous, and that it's "recorded so you can demonstrate who consented, when and how". Then the plain conclusion: "If the consent doesn't name you or does not cover the method you intend to use, then it is not valid."

So the test is whether the person who ticked the box could have known they were agreeing to hear from you, by text. If they couldn't, because you weren't named or weren't trading yet or were one entry in a list of 174, the broker's promise is worth nothing, and the ICO treats the sender as the one who broke the rules.

Why "partners" wording fails

The Quick Tax Claims notice is useful because the ICO went through the company's three suppliers one at a time and explained why each failed. The names are redacted, but the reasoning isn't.

The first supplier ran a competition site. Entrants had to tick a box agreeing to the terms and to marketing from partners "via email, phone, text or post", and the ICO found there was "no clear way for the site users to opt-out of receiving marketing communications if they wanted to enter any of the competitions". That kills "freely given" on its own. The ICO added a second problem: 85% of the consents had been collected before 26 September 2022, and Quick Tax Claims was incorporated that month, so for most of the records the company didn't exist when the box was ticked. "It was not possible for users to give informed consent to a company before it was incorporated." The notice also counts 251 companies in that site's list of recipients, each with its own privacy policy. Nobody reads 251 privacy policies.

The second supplier was another competition site, with an extra checkbox for partner marketing by "email, phone, SMS or post". Entrants couldn't submit without ticking it, and the opt-out only appeared after the details had gone in. Not freely given, the ICO said, and the leads "could not be used by QTC to send direct marketing". That site supplied the data for 39,483 of the people who complained.

The third was a site offering deals on insurance and utilities. To get an insurance quote you had to accept terms that let the site share your details with "included but not limited to" 57 named companies. Quick Tax Claims was one of the 57. The ICO's view was that "it would be unreasonable to expect site users to read through all of the 57 privacy policies to understand what will happen with their information", and it noticed two more mismatches that are worth remembering. The registration form said partners might contact you by telephone; Quick Tax Claims texted. And the site was about insurance; Quick Tax Claims does tax refunds, so nobody filling in an insurance form "would expect to receive marketing from them".

Freely given, specific, informed: each supplier failed at least one of those, and a tick box with the word "partners" in it was the common thread. The company had invoices and due diligence forms for its suppliers, and it still lost, because paperwork from the broker doesn't change what the person on the website was told.

What the other cases have in common

Quick Tax Claims sent the most texts of a run of cases where the data was bought, and the ICO's reasoning barely changes from one to the next.

LADH Limited, a financial services company, was fined £50,000 in January 2024 for 31,329 texts delivered between 14 March and 30 April 2022. Its director told the ICO he "had been verbally reassured that he was receiving 'opt-in data' and went ahead to send the SMS messages", and that he "had not received anything in writing to confirm" it. The notice lists what he should have had: a written contract with the supplier, the actual opt-in records before sending, and some due diligence of his own. The ICO's line, which it repeats in later notices almost word for word, was that "It is not acceptable to rely on assurances given by third party suppliers without undertaking proper due diligence."

National Debt Advice Limited got an enforcement notice and a £30,000 fine in October 2024 for 129,902 texts between April and August 2023. It had bought "loan decline data", so its debt advice texts went to people who'd recently been refused a loan. The enforcement notice puts it in one sentence: the company "purchased data from a third party supplier but failed to conduct appropriate checks that valid consent had been obtained". It then quotes the ICO's own guidance back at the company: "You should be very careful when relying on consent obtained indirectly (consent originally given to a third party). You must make checks to ensure that the consent is valid and specifically identifies you."

KRA Consultancy Ltd, fined £300,000 in June 2026 for 5,575,715 texts over three years, is the extreme end. Loan decline data again, bought from a contact saved in the director's phone under a name ending in "Data", who offered 50,000 records for £2,000, and when a broker complained the data was three years old the director's reply (it's in the notice, with the swearing) was that he didn't care how old it was as long as it made money. The ICO found the breach deliberate. But even there, the negligence finding leans on the same guidance: organisations "acquiring and utilising marketing lists from a third party must undertake rigorous checks to satisfy themselves that the personal data was obtained fairly and lawfully, and that they have the necessary specific and recent consent".

The principle doesn't move across the four cases. The buyer is the sender, the sender is responsible, and "they told me it was opted in" didn't work in any of them. The broader pattern in the ICO's text fines, bought data or not, is in what the ICO's text marketing fines tell you.

The soft opt-in won't rescue a bought list

People sometimes reach for the exception in regulation 22(3) at this point. It lets you text existing customers about your own similar products without consent, provided you gave them a chance to refuse when you collected the details and in every message since. The first condition is that you obtained the contact details "in the course of the sale or negotiations for the sale of a product or service" to that person. A broker's spreadsheet is not a sale.

The ICO doesn't leave this to inference. Its electronic mail marketing guide says the soft opt-in "does not apply to prospective customers or new contacts (eg from bought-in lists)". Its compliance guidance says you "must collect the contact details directly from the person you want to send the marketing to" and "must not use the soft opt-ins to send unsolicited electronic mail marketing to people on a bought-in marketing list". So a bought list has exactly one lawful route for texting, which is consent that names you, and we've just seen how rarely a list carries it. (The soft opt-in rules for your own customers are in our marketing rules guide.)

If someone offers you a list

The ICO updated its direct marketing guidance in April 2026, and the section on collecting information and generating leads is the current word on buying data. Its position is that "you must undertake proportionate checks and due diligence before you get the information" and that "It is not enough to simply accept a third party's assurances". The questions it tells you to put to a seller are worth copying out as they stand: who compiled the information, and was it the seller or someone else; how was it collected, in what context and by what method; what privacy information people were given at the time; what records of consent exist; and what evidence there is that the data has been checked against suppression lists, if the seller claims that. You also have to be able to show your own lawful basis for using it.

Put those questions to a typical list seller and the answers tend to end the conversation. The records, when they turn up, are a competition site's tick box, a date, and a privacy policy with your name buried somewhere in it, or not in it at all because the list is older than your company, and none of that is consent to a text from you.

For a small business the practical conclusion is dull and cheap. Build the list yourself. Put a keyword on the counter, the receipt and the website ("Text OFFERS to 07xxx xxx xxx for our deals, max 2 a month, reply STOP to opt out"), keep the date, the number and the wording of each opt-in, and send only to those people. Our guide to SMS marketing rules in the UK has the wording and the records to keep. A short list of people who texted a keyword to your number is worth more than a long bought one, and it won't bring the ICO to your door.

CaptiFi Connect's keywords give you that opt-in on a UK mobile number with an automatic reply, and STOP replies are handled for you. Quick Tax Claims had invoices and due diligence forms for all three of its suppliers. The ICO read the tick boxes instead, and the fine was £120,000.