How Scottish subscription brands meet ICO and PECR consent rules

What to take away

UK GDPR and PECR consent standards for Scottish subscription brands

Data protection is a reserved matter, so a subscription brand in Glasgow or Aberdeen follows the same UK GDPR and PECR regime as one in Manchester. The Data Protection Act 2018 sets the framework for lawful processing, including consent.

PECR then adds specific rules for email, SMS, cookies and similar technologies. The ICO enforces both from its Scotland office in Edinburgh.

UK GDPR requires that consent be given freely, be specific, informed and unambiguous. A pre-ticked box is not consent. A customer who signs up for a coffee subscription in Leith has not agreed to marketing from your sister gin brand unless you asked separately.

PECR consent rules govern the channel. For email and SMS marketing to individuals, you generally need prior consent, unless the soft opt-in applies. The ICO's guide to PECR covers the rules on electronic marketing, cookies and consent for subscription messaging. Read it before you build a flow.

Consent must be granular. If you sell a monthly box and a weekly newsletter, ask separately. If you use a survey to gather preferences, make sure the tool records consent properly; see survey tools that pass UK consent rules for the operational checks.

Accountability sits with you, not your email platform. You must show what a subscriber agreed to, when, and how. Keep a timestamp, the source, and the exact wording shown. If the ICO asks, a screenshot of a checkbox is not enough on its own.

Pop-up signups at events and markets are common here, so a clipboard email needs the same wording as your checkout form.

Consumer rules on subscription contracts are different: Trading Standards Scotland, hosted by COSLA, coordinates enforcement north of the border.

For recurring billing, consent to charge is separate from consent to market. Direct Debit rules and card scheme rules sit outside PECR, but your privacy notice should still explain what data you use for billing and retention. For more on that split, see subscription commerce data protection.

The soft opt-in and when it covers existing subscribers

The soft opt-in is a narrow exception in PECR. It lets you send electronic marketing to an existing customer without fresh consent, but only if you meet the soft opt-in conditions. The ICO's guidance on direct marketing using electronic mail sets these out. Miss one condition and the exception falls away.

The conditions, in short:

The soft opt-in does not cover third-party lists. If you buy a list of Scottish subscribers, you cannot rely on it. You need consent from those individuals. The same logic applies to SMS, where the ICO expects clear consent in most cases.

A worked example helps. A Dundee meal-kit brand sells a trial box. At checkout, it states that it will email about similar boxes and offers, with an unticked box to refuse. The customer buys. The brand can email similar offers under the soft opt-in, with an unsubscribe link in each message.

If the brand later wants to send SMS about a partner wine club, it needs consent.

Keep the soft opt-in narrow. It is not a permanent right to market. If a subscriber has not opened or clicked for a long period, the ICO may question whether the relationship is still live. Treat engagement as part of your evidence.

Re-permission deadlines and cleaning legacy marketing lists

Re-permission deadlines are the dates by which you either refresh consent or stop marketing. There is no single statutory deadline in PECR that says consent expires after a set number of months.

The deadline is the point at which your consent is no longer valid under UK GDPR, because it is too old, too vague, or the context has changed.

The ICO expects you to be able to demonstrate that consent is still current. If your records show a signup from many years ago with no engagement, you are exposed. The practical answer is to run a re-permission campaign and suppress anyone who does not respond.

A re-permission campaign asks subscribers to confirm they still want to hear from you. It should state what they will receive, how often, and how to say no.

A common sequence for a legacy list: send the request, send one reminder after ten days, then suppress non-responders after 28 days. Those timings are typical, not fixed. Shorten them for lists with no engagement for two years or more. Silence is not consent.

Cleaning legacy lists is not just a legal task. It improves deliverability. Scottish brands that mail dead addresses risk spam complaints, which affect the domain reputation that carries your transactional email too. Billing receipts and password resets should not land in spam because a marketing list was dirty.

Document the clean. Keep a suppression list of people who did not respond or who opted out. Do not delete the suppression record, or you may mail them again by accident. If you use a CRM, make sure the suppression list syncs to every sending platform.

ICO enforcement examples relevant to email, SMS and retargeting

The ICO publishes enforcement action records for marketing compliance risk. These include fines, reprimands and enforcement notices. The pattern matters as much as the names: the ICO acts when consent is absent, when opt-outs are ignored, and when records are poor.

Two PECR penalties show the range. In 2017 the ICO fined Keurboom Communications Ltd £400,000 over automated nuisance calls. In 2019 it fined Flybe Ltd £70,000 for sending marketing emails to customers who had opted out.

In email marketing, the ICO has taken action against organisations that sent millions of messages without valid consent. The common failure is reliance on indirect consent, such as a third-party list or a vague signup. If you cannot show the exact consent wording, you are in the same position.

In SMS, the ICO has acted on nuisance messages and on messages sent after an opt-out. SMS is treated seriously because it is intrusive. If a Scottish brand runs a text campaign to a purchased list, it is a high-risk activity. The soft opt-in rarely saves it.

In retargeting, the ICO's online tracking work has focused on cookies and similar technologies that load before consent. Adtech vendors often set identifiers on page load. If your subscription site runs a pixel before the user chooses, that is a PECR issue, not just a marketing preference.

The ICO has also acted on data broking and on the use of personal data for profiling without a lawful basis. For subscription brands, the lesson is that retargeting lists built from email addresses need a lawful basis and clear information. Do not assume that a customer who bought once has agreed to be tracked across the web.

Enforcement risk is not only fines. The ICO can issue reprimands, which are public and damage trust. It can also require you to change your practices. For a subscription business, a forced change to onboarding can hit conversion. Build consent into the funnel rather than bolting it on.

Cookie and storage access rules for subscription acquisition

PECR covers cookies and similar storage on a user's device. For subscription acquisition, that means your landing pages, checkout, and trial signup flows. You need consent for non-essential cookies and similar technologies before they are set.

Strictly necessary cookies are exempt. These are the ones needed to provide a service the user requested, such as keeping a basket or remembering a login session. Analytics cookies are not strictly necessary, even if you use them to improve the site. Advertising cookies are not strictly necessary.

Consent must be informed. A banner that says "we use cookies" is not enough. You must name the purposes and the parties, and offer a way to accept or reject. Rejecting must be as easy as accepting. A cookie wall that blocks access unless the user accepts is not valid consent.

Audit your tags. A common failure is an advertising pixel that fires on page load, before the consent management platform has recorded a choice. Another is a consent tool that records acceptance but does not block tags until the choice is made. Test in a clean browser.

For subscription brands, the checkout flow is sensitive. If you use a third-party checkout, check who sets cookies and whether your consent banner covers them. You remain accountable for what loads on your site. For a wider review of campaign claims, see subscription commerce advertising rules.

Retargeting and profiling under ICO online tracking guidance

Retargeting relies on identifying users across sites. Under UK GDPR, that is profiling, and it needs a lawful basis. Consent is the most practical basis for advertising cookies and similar identifiers. Legitimate interests can be used in some cases, but you must pass a balancing test and offer an opt-out.

The ICO's online tracking guidance sets out the expectations for retargeting and profiling. It expects transparency about who is tracking, for what purpose, and for how long. It also expects you to respect opt-outs and to avoid tracking children.

For subscription brands, retargeting often uses customer email lists uploaded to ad platforms. That is a form of processing. You need a lawful basis, and you need to tell people in your privacy notice. If you rely on consent, the consent must cover advertising, not just email newsletters.

Profiling can also happen inside your own platform. If you score subscribers by engagement and change what you send them, that is profiling. It may be covered by your existing basis, but you should document it and offer a way to object. The 2025 data protection shake-up is a reminder to review those records before the next audit.

Be careful with special category data. If a subscription relates to health, religion or similar, profiling can create extra risk. A Scottish brand selling religious books or health supplements should not assume standard marketing consent covers inferred data.

Retargeting consent is not a one-off. If a user rejects cookies, do not retarget them through a server-side workaround. If they withdraw consent, suppress them from the audience. Keep the withdrawal record.

A Scotland consent remediation checklist

Scotland's subscription sector is mostly small firms: gin and whisky clubs, meal kits, coffee roasters, outdoor gear hire and software. Most register at Companies House in Edinburgh and run marketing without a dedicated data protection officer, so the checklist below is built for a marketer working with limited legal support.

Work through these in order. Start with the consent map, because everything else depends on knowing where data enters your business. Then fix the wording and the records. Then clean the lists. Then audit cookies and retargeting.

Common questions