Charity texting and the new soft opt-in

On 5 February 2026 a line that had sat in the same place since 2003 moved. Regulation 22 of PECR, the rule that stops a business texting or emailing an individual with marketing unless they have consented, grew a new paragraph, 22(3A), and for the first time a charity can text someone about its cause without that person ever having ticked a consent box. The Charity Commission counted 171,539 charities on the register for England and Wales at the end of June 2026, so the change reaches a lot of organisations, most of them run by a handful of volunteers who have at some point wondered whether they can text the people on last year's sponsorship form.

The short answer is now "it depends on when you collected the number, and how". The long answer is the rest of this post, which is about the law itself. The practice (what to send, when, with wording) is in our post on fundraising texts after the 2025 Act.

What regulation 22 said before

Regulation 22(2) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 is the rule behind every marketing text in the UK. A person "shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail" to an individual subscriber unless the recipient has previously told the sender they consent. "Electronic mail" is defined in regulation 2(1), and it is wider than email: "any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient and includes messages sent using a short message service". A text has been electronic mail since the regulations were made.

Until this year the only way round the consent rule was paragraph (3), the soft opt-in everyone in retail knows. Three limbs: the sender got the contact details "in the course of the sale or negotiations for the sale of a product or service", the marketing is for the sender's "similar products and services only", and the recipient was given "a simple means of refusing" when the details were collected and in every message since. A charity that sells Christmas cards through its shop could lean on that for more Christmas cards. A charity asking a donor for a second gift could not, because a donation is not a sale and an appeal is not a similar product. Donations and volunteering had no route at all except consent.

What section 114 inserted

Section 114 of the Data (Use and Access) Act 2025 is headed "Use of electronic mail for direct marketing by charities" and it makes three edits to regulation 22. Subsection (2) adds the words "or (3A)" to paragraph (2), so the consent rule now carries two exceptions instead of one. Subsection (3) inserts the new paragraph (3A). Subsection (4) adds paragraph (5), which says who counts as a charity. None of it was in force at Royal Assent. It was switched on by regulation 2(x) of the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, S.I. 2026/82, from 5 February 2026.

Here is the new paragraph as it reads on legislation.gov.uk:

(3A) A charity may send or instigate the sending of electronic mail for the purposes of direct marketing where (a) the sole purpose of the direct marketing is to further one or more of the charity's charitable purposes; (b) the charity obtained the contact details of the recipient of the electronic mail in the course of the recipient (i) expressing an interest in one or more of the purposes that were the charity's charitable purposes at that time; or (ii) offering or providing support to further one or more of those purposes; and (c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of their contact details for the purposes of direct marketing by the charity, at the time that the details were initially collected, and, where the recipient did not initially refuse the use of the details, at the time of each subsequent communication.

Read it next to paragraph (3) and the shape is the same. Something the person did with you (a sale there, an expression of interest or an offer of support here), a limit on what you may send (similar products there, your own charitable purposes here), and a free, simple way out, offered at collection and again in every message. The word "sole" in limb (a) does more work than it looks. A text that furthers the charity's purposes and also plugs the trading arm's tea towels fails the test on its face.

Paragraph (5) decides who is in. A "charity" is one as defined in section 1(1) of the Charities Act 2011, or section 1(1) of the Charities Act (Northern Ireland) 2008, or "a body entered in the Scottish Charity Register" that still meets the charity test in section 7 of the Charities and Trustee Investment (Scotland) Act 2005. A community interest company, a social enterprise, a sports club, a campaign group that never registered: none of them qualifies. They keep the consent rule and the old soft opt-in, the same as any other business.

How the ICO reads it

The ICO's guidance on direct marketing by electronic mail now covers what it calls the charitable purposes soft opt-in, and it breaks paragraph (3A) into six conditions where the paragraph has three. You are a charity in the legal sense. You obtained the contact details yourself, directly from the person. The person expressed an interest in your purposes or offered or provided support to them (one or both). The sole purpose of the marketing is to further your charitable purposes. You offered an opt-out when you collected the details. And you give people the chance to opt out in every subsequent message.

Then comes the rule that will catch most charities out in year one. The soft opt-in commenced on 5 February 2026 and, in the ICO's reading, you may only use it for contact details obtained on or after that date. Its own example is a 2025 donor whose number cannot be texted under 22(3A), but who can be asked again in 2026, with a clear opt-out on the form, and then can be. Nothing reaches back into the old database: everything collected before February stays on consent.

The ICO's examples of "interest" and "support" repay a careful read, because the edges are where the trouble will be. Someone who fills in a wildlife charity's online form asking for updates on its endangered species work has expressed an interest. Someone who typed an email address into the guest wifi at the charity's café has not. Giving money or goods counts as support, and so does volunteering, with running a fundraising stall as the example. Buying something usually sits under the products and services soft opt-in in paragraph (3), with a carve-out: memberships, sponsorships, raffles and paid fundraising events may count as support where the buyer clearly understands them as supporting the charity's purposes. Incidental purchases, where the buyer is acting as an ordinary consumer, do not.

Three doors are shut outright. There is, in the ICO's words, "no such thing as a third-party list that is 'soft opt-in compliant'", so a bought or rented list never qualifies (our post on bought-in lists covers why that was already true for consent). Details collected by a closely connected organisation such as a trading subsidiary do not count, because the interaction has to be with the charity itself. And details collected by a third-party fundraising platform and passed to the charity do not count either; that is the ICO's own bad example, and it will sting, because a great deal of sponsorship money arrives through exactly that route.

On the opt-out the ICO is specific. It should be as simple as replying to the message or clicking a clear unsubscribe link, and people should not have to create an account, log in or phone someone to stop the texts. For a text, telling recipients to send a stop message to a number is fine, provided it costs nothing beyond the normal cost of a text. Whichever route the charity relies on, the person keeps an absolute right under data protection law to object to direct marketing.

How many charities this reaches

The Charity Commission's quarterly casework data gives the scale for England and Wales. The register held 170,827 charities at the end of June 2025 and 171,539 a year later, after four quarters in which the Commission registered between 1,090 and 1,301 charities a quarter and removed between 790 and 1,206. Its live sector overview page, read on 17 October 2026, showed 171,926 main charities and 13,751 linked ones, 185,677 in all, with 921,614 trustees and 6,692,998 volunteers behind them. North of the border, OSCR's sector overview for April to June 2026 put 24,946 charities on the Scottish Charity Register. Both registers are inside paragraph (5), and between them they carry a little over 196,000 entries, before you count Northern Ireland.

Registrations and removals run at roughly a thousand each a quarter, so the total drifts by a few hundred either way and the register barely moved across the year the soft opt-in arrived.

The money explains why the sector pushed for the change. Among the charities on the England and Wales register with an income over £500,000, the Commission's overview records £30,549,146,031 in donations and legacies in the latest annual returns, against £8,298,715,658 spent raising funds. Until February, a text to a past donor asking for the next gift needed a ticked box first.

The Fundraising Regulator's code sits on top

PECR is the law. The Code of Fundraising Practice is the standard the Fundraising Regulator holds charities to, and the new edition came into effect on 1 November 2025, three months before the soft opt-in. It applies to all charitable institutions and third-party fundraisers in the UK. Section 8, "Fundraising communications and advertising", carries the standards a texting charity will meet. Under 8.4.1 you must not send fundraising communications to people who have indicated they do not want them, and you must check the Fundraising Preference Service and the mailing and telephone preference services. Under 8.4.3 you "must use a simple opt-out message for people to tell you if they don't want to receive messages from you", and that includes a way to opt out by replying to a mobile message. Under 8.4.4 you must be able to justify how often you contact people about fundraising, and 8.4.5 asks for consent statements that are clear.

The code adds a layer on top of 22(3A). The law says a free, simple refusal in every message; the code says the refusal must work by reply and the frequency has to be defensible. Standard 8.3.1 bans fundraising calls after 9pm unless the person asked for one. It says nothing of the kind about texts, though a charity that wants to keep its complaints down will behave as if it did.

What a charity should do before the first text

Start with the date. Split the supporter list into numbers collected before 5 February 2026 and numbers collected on or after it. The first group needs consent or nothing; the second may qualify under 22(3A), one record at a time. Keep the evidence beside each number: the form, the event, the stall, the date, and the exact wording of the opt-out shown when the number was taken. If no opt-out was offered at collection, the number does not qualify, however keen the donor.

Write the opt-out the way the ICO and the code both want it: by reply. "Reply STOP to opt out" at the end of every message does that in five words. A reply of STOP to a CaptiFi Connect number opts the person out automatically, as do STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT and OPTOUT, and campaigns carry "Reply STOP to opt out" by default; our guide to STOP replies explains what happens to the number afterwards.

Then check the message against limb (a). "Riverside Hospice: thank you for sponsoring Dan in May. Our winter appeal opens on Mon 2 Nov. Reply STOP to opt out" furthers the hospice's purposes and nothing else. Add a line about the shop's Christmas range and it no longer does. Keep the trading arm on its own consent, and keep anything collected through a fundraising platform or a subsidiary out of the 22(3A) pile altogether.

One last thing did not change. The definition of direct marketing in regulation 2(1), "the communication (by whatever means) of advertising or marketing material which is directed to particular individuals", is as it was, so a text that asks for money or volunteers is still marketing. The penalties did change: the ICO's summary of the 2025 Act says PECR enforcement is brought into line with UK GDPR in most cases, through Schedule 13 of the Act. A charity that gets 22(3A) wrong in 2026 faces a larger fine than one that got consent wrong in 2024.