Changes to charity marketing ahead: What is the soft opt-in?

According to the Data & Marketing Association, an amendment to the regulations around direct marketing – the amendment proposed in the DUAA to the Privacy and Electronic Communications Regulations 2003 (“PECR”) – could result in an increase in donations to UK charities of over £250 million per year.

What is the proposed change, when will it be introduced, and what, practically, should charities consider and implement in order to take advantage of the proposed change?

PECR requires all organisations sending direct marketing communications electronically (either by text or email) to obtain an individual’s consent to send them such communications.

The exemption to this general requirement for consent exists for companies in the form of the ‘soft opt-in’ exemption which enables companies to send individuals marketing emails or texts if they had previously (i) sold them goods or services or (ii) negotiated the sale of goods or services. These marketing emails or texts can only be sent if:

• The company gave the individual a simple means of opting out of receiving marketing information at the time their details were first collected (and in every subsequent marketing communication); and
• The marketing communications relate to similar goods or services to the ones which were originally sold/negotiated for sale.

This soft opt-in exemption was exclusively available to organisations which sold goods or services and was therefore not available to most charities (other than those charities selling goods or services directly to individuals). Charities needed to have valid consent before any marketing emails were sent to individuals with whom they had engaged through fundraising or other activities.

The DUAA will introduce an additional provision in PECR to enable charities to use a modified form of the existing soft opt-in. Charities will now be able to send electronic communications without first obtaining explicit consent if:

• The sole purpose of the communication is to further the charity’s purposes;
• The charity obtained the contact details of the individual through the individual’s:
  • Expression of an interest in one or more of the charity’s purposes; or
  • Offering or providing support to the furthering of one or more of these purposes; and
• The charity gives the individual a simple means of refusing the use of their contact details for marketing purposes at the time they were collected.

The DUAA received Royal Assent on 19 June, but the proposed changes have not yet come into force and will be phased in between June 2025 and June 2026.

The changes are unquestionably a positive for the charity sector. Fundraising teams will undoubtedly have breathed a sigh of relief at the fact that obtaining consent is no longer the only option when it comes to sending electronic communications. However, the changes are not designed to open the floodgates and allow charities to send market communications without any consideration as to the privacy rights of individuals.

Charities will need to consider:

1. Legitimate interest assessments. If a charity is processing personal data for marketing purposes then, under the UK GDPR, it must have a lawful basis for doing so. If charities decide to rely on the soft opt-in they will no longer be relying on consent as the lawful basis and will need to identify another lawful basis to process the personal data. The most appropriate basis is likely to be that the processing is necessary for the legitimate interests of the charity. It is best practice to undertake a legitimate interest assessment to assess the purpose of the processing, its necessity, and how the charity balances the aims of its marketing campaign against individuals’ personal rights to privacy. Charities should exercise caution if relying on the soft opt-in and consider their communications strategies carefully to ensure that their marketing activities do not inadvertently cause harm or upset to those individuals who may receive the marketing communications.
2. A lawful basis is a lawful basis. Under the UK GDPR it is not possible to ‘switch’ between two lawful bases so charities will not be able to rely on the soft opt-in to send marketing communications to individuals where they have previously relied on consent (unless the individual expresses a further interest in the charity’s purposes/offers support to the furthering or these purposes and the soft opt-in requirements are met). Charities will, therefore, need to ensure they have systems in place to keep track of those individuals which are marketed to using consent as the lawful basis and those individuals which are marketed to on the basis of the soft opt-in, with ‘legitimate interests’ as the lawful basis.
3. Updating privacy notices and including options for opting out. If choosing to rely on the soft opt-in charities will need to:

(a) update their privacy notices to reflect the lawful bases which are relied upon to send individuals marketing communications; and

(b) ensure that opt-out statements are included wherever individuals provide their contact details and an unsubscribe link is included in all subsequent marketing communications, with clear records kept of all those who have opted out or unsubscribed.