What the ICO's text marketing fines tell you

On 23 June 2026 the ICO announced a £300,000 fine for KRA Consultancy, a debt advice firm in Manchester. The penalty notice puts the count at 5,575,715 marketing texts between 24 April 2022 and 29 May 2025, none of them with the consent the law asks for, and more than 60,000 complaints to the 7726 spam reporting service. Some of those texts came from a sender name of DEMAND and told the person an enforcement agent would attend within 48 hours to remove their goods "as per Court Order". There was no court order, only a debt firm that wanted its paperwork back.

It's the largest of the eight penalties for marketing texts I could find on the ICO's site since the end of 2022, a run that starts with Monetise Media in December that year. I've read the ICO's page for every one of them, and the KRA notice in full (32 pages). Different companies, different trades, and the same two or three failures over and over. If you text customers, the notices are the cheapest training you'll ever get.

The eight cases

In date order, with the figures as the ICO published them.

Two things are plain before you get into any detail. The three most recent penalties are the three largest. And the fine has nothing to do with a price per text: LADH sent a bit over 31,000 messages across six weeks and was fined £50,000, while Quick Tax Claims sent 7.86 million in a month and was fined £120,000. What the ICO weighs is whether the breach was deliberate or careless, what harm it did, and how the company behaved once it was caught. The ceiling is still £500,000 for these PECR cases. The KRA notice cites section 55A of the Data Protection Act 1998 and the 2010 regulations that set that maximum.

The rule underneath all eight

The rule is regulation 22 of PECR, the Privacy and Electronic Communications (EC Directive) Regulations 2003. Its second paragraph is the whole law of marketing texts in one sentence:

a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender.

"Electronic mail" covers texts, and two words in that sentence matter more than people expect. "Instigate" is one. ESL paid a third party to press send and was fined £200,000 for the texts the third party sent. The KRA notice uses the same word, finding the messages were "sent by or sent at the instigation of KRA". Hiring someone else to do the sending doesn't move the liability an inch.

The other is "previously". Consent comes first, then the text. Regulation 22(3) gives one exception, the soft opt-in, and it's narrow: you got the number "in the course of the sale or negotiations for the sale of a product or service", the marketing is for "similar products and services only", and the person was given "a simple means of refusing" when the number was collected and again in every message. None of the eight could have used it, because none of them were texting their own customers. They were texting lists.

Consent you can't show

The notices never argue about whether consent was needed. They argue about whether it existed, and the answer kept being no, in ways that read like a checklist of shortcuts.

LADH told the ICO it had "received a verbal assurance" from the company it bought the data from that the people on it had agreed to be contacted. There was no written confirmation. That assurance was the whole case, and it was worth nothing. Quick Tax Claims bought its 7.86 million numbers from suppliers that, in the ICO's words, "did not obtain valid consent". National Debt Advice's 129,902 texts went out with no valid consent at all.

At ESL, the ICO found a Skype exchange in which ESL asked the sender what opt-in it was relying on, and got the answer that "strictly speaking" it "doesn't exist yet". At KRA, a data broker complained that the list being used was three years old. The notice records the director's reply: he didn't care how old it was "as long as it's making money".

HelloFresh is the case worth reading twice, because HelloFresh did have an opt-in. The ICO's problem was with what it said. The statement sat inside an age confirmation, it was bundled with other things, it never mentioned text messages, and it didn't say marketing would carry on for 24 months after a customer cancelled. Consent under PECR has to be "specific" and "informed", and a tick that doesn't mention texts isn't consent to texts. That cost £140,000 for 1,113,734 texts and 79,779,279 emails over seven months, and the ICO also found the company had kept contacting some people after they'd asked it to stop.

Nobody could say stop

Regulation 23 is the other rule in these notices. It bans marketing by electronic mail "where the identity of the person on whose behalf the communication has been sent has been disguised or concealed" or "where a valid address to which the recipient of the communication may send a request that such communications cease has not been provided". Hide who you are, or leave out a way to stop, and you've broken it whatever the consent position.

The complaint data makes the point. Of the 66,793 complaints about Quick Tax Claims, 93% said there was no opt-out option. Most of LADH's texts had no opt-out either. KRA's did carry an opt-out link, a bit.ly address that led to an unsubscribe page on a site whose account had been set up with a kraconsultancy.co.uk email address, which sits oddly next to the "generic trading names" and "anonymous websites" the notice lists among its aggravating features. ESL used unregistered SIM cards to hide who was sending. Chand gave false company names when people rang back. The KRA notice finds regulation 23 breached by "the taking of steps to conceal their identity".

Then there's DEMAND. The notice reproduces two texts sent under that name. The first: "You have failed to contact us. This matter has escalated and an Enforcement agent will attend within 7 days to remove your goods as per Court Order." The second gave 48 hours. The director called them "coaching" messages. The ICO's finding is that they were used "to pressurise people who had made online enquiries into returning their paperwork", and it lists them as an aggravating feature that "caused substantial distress to recipients who were already vulnerable".

How the ICO finds out

Every one of these cases started with people forwarding texts to 7726. The KRA notice is explicit about it: "The Commissioner is provided with access to the data on complaints made to the 7726 service and uses this data to identify breaches of PECR." The counts are in the notices and the announcements: 8,729 complaints to 7726 about HelloFresh, over 4,000 about National Debt Advice, 66,793 about Quick Tax Claims, 37,977 about ESL, 19,138 about Chand and over 60,000 about KRA.

Once the complaints point somewhere, the ICO goes and looks. In July 2024 it executed a search warrant at two addresses connected to the KRA investigation and seized "an active SIM farm and over 200 SIM cards", along with phones and laptops. The Skype and WhatsApp messages quoted above came off those devices. The ESL announcement describes an affiliate with 459 telephone numbers "capable of sending up to 546,000 texts a day". That's how the volumes in the table happen, a rack of SIMs on consumer contracts sending flat out, and it's also why they get caught, because every SIM is a trail.

How a company behaves afterwards shows up in the fine. KRA's aggravating features include lying to officers during the warrant, hiding a phone, promising to get in touch and never doing so, and resuming the texts afterwards, which brought fresh 7726 complaints in September and October 2025. Under "mitigating features" the notice has a single bullet: "The Commissioner has found no evidence of any mitigating factors."

What this means if you text customers

Read the eight cases together and the lesson is short. Nobody was fined for texting their own customers something those customers had agreed to. The fines were for texting strangers, for consent nobody could produce, and for making it hard to say stop. So the practical side is short too.

Keep a record for every number you market to: when consent was given, what the wording said, and where it was given (the form, the till, the booking page). If you can't produce that record, assume the ICO will treat the number the way it treated LADH's verbal assurance. Don't buy lists. Every bought list in these notices turned out to carry no usable consent, and the buyer paid the fine, never the seller. If you rely on the soft opt-in, keep to its three conditions: your own customers, similar products, and an opt-out at collection and in every text. Put your name at the front of every message and a way to stop at the end. "Reply STOP to opt out" is the usual form, and when someone sends STOP, stop that day. Send under a sender name that's yours and is registered, so nobody mistakes you for the next DEMAND. And if an agency or a platform does the sending for you, remember "instigate": your name goes on the notice.

CaptiFi Connect was built around the same list. Every sender name is reviewed before it can be used, with a check against the MEF SenderID Protection Registry, STOP and its variants opt a number out automatically, and campaigns carry "Reply STOP to opt out" unless you take it off. For the rules in full, with consent wording that stands up, there's our guide to SMS marketing rules in the UK.

The quote the ICO chose for the KRA announcement came from Andy Curry, its Head of Investigations: "People in financial difficulty deserve support, not exploitation." On the HelloFresh case, two and a half years earlier, the same man had said the ICO "will take clear and decisive action where we find the law has not been followed". The HelloFresh fine was £140,000. KRA's was more than double.