Is it legal to text your old leads in the UK? (2026)

Most of the businesses that hand us an old database have never asked whether they're allowed to text it. They assume that because someone once enquired, the number is fair game. Sometimes it is. Often it isn't, and the difference is written down in a regulation most marketing teams have never read. This article explains the rules as we apply them. It isn't legal advice. It's what we check before we send a single message on a client's behalf.

Can you text old leads at all?

Under the Privacy and Electronic Communications Regulations (PECR), a marketing text is "electronic mail", the same category as a marketing email. You can send one to an individual only if you have their consent, or if you can meet every condition of the soft opt-in. There is no third route. "They gave us their number" is not a route. "It's in our privacy policy" is not a route.

What counts as consent to text someone?

The ICO's guidance on electronic mail marketing is specific: consent has to cover the channel. A tick box that says "yes to marketing" does not cover texts, because some people want your emails and not your messages. Consent also has to name your organisation, and it has to be separate from accepting terms of service or a privacy policy. If a customer's only "agreement" is a line in your privacy notice saying that using the service opts them in, you do not have consent.

That's the first thing we look for, and it's where most old lists fall down. Not because the business did anything wrong at the time, but because the form was built to collect a phone number for a quote, not to ask permission to market by text.

What is the soft opt-in, and does it cover old leads?

Most old lead databases that can be texted lawfully qualify this way, not through consent. The soft opt-in has five parts, and every one has to be true:

1. You collected the number yourself, directly from the person. A list bought from a third party or a lead generator never qualifies.
2. You collected it during a sale, or during negotiations for a sale. An enquiry for a mortgage quote or a property valuation counts as negotiations.
3. The message is about your own similar products or services.
4. You gave the person a clear chance to refuse marketing when you collected the number.
5. Every message you send gives them a simple way to opt out.

The soft opt-in belongs to the business that collected the number. A supplier like us can send on your behalf, but we can't use your soft opt-in to market anything else, and you can't lend it to anyone.

What changed in February 2026?

Until this year the maximum fine for breaking the PECR marketing rules was £500,000. On 5 February 2026 the Data (Use and Access) Act 2025 brought the ICO's new enforcement powers into force, and the ceiling is now £17.5 million or 4% of worldwide annual turnover, the same as UK GDPR. The ICO can also compel witnesses to attend interviews and require technical reports. For a business running a reactivation campaign, the practical change is that "a text campaign isn't worth a fine" is no longer a safe assumption.

What do we check before a campaign runs?

1. Where every number came from

We ask for evidence, not a description: a screenshot of the form the numbers were entered on, the link to the privacy policy that was live at the time, and the CRM export with its consent fields. We're looking for one of two things: a consent request that names texts, or a form that collected the number as part of an enquiry or sale. Bought or scraped numbers come off the list before anything else happens.

2. Whether an opt-out was offered at the time

The soft opt-in fails if the person wasn't given a chance to refuse when the number was collected. This is usually a line under the form. If it isn't there, the soft opt-in doesn't apply, and the list needs consent instead.

3. Whether the offer is similar

A mortgage broker texting old mortgage enquiries about a remortgage is fine. The same broker texting them about a partner's insurance product isn't.

4. How old the list is

PECR doesn't set an expiry date, but consent and expectation both fade. Our working rule is that a list up to 12 to 18 months old is usable, depending on the industry and how the person last heard from you. At around two years we say no.

5. That existing opt-outs are suppressed before the first send

Anyone who has already told you to stop is removed before the file reaches us, and we check the export's consent and opt-out fields before anything is scheduled.

What happens when a list fails the check?

It happens, and it isn't a reason to quietly send anyway. We've turned down several prospective clients' text campaigns because their sign-up wording didn't cover texts. In those cases the same wording did name email, so the campaign ran by email instead, on consent that actually existed. The alternative was not running it. If a list can't be texted lawfully, we'd rather tell you before you spend anything.

What happens when someone replies STOP?

A STOP reply is an opt-out, and PECR requires it to be honoured. In our system the number is suppressed the moment the reply arrives, before any follow-up can go. It appears on the dashboard both you and we can see, alongside replies like "not interested", so nothing sits hidden in a supplier's inbox. One thing to be clear about: we don't currently write the opt-out back into your own CRM automatically. Your team adds it from the dashboard, and that matters, because the opt-out applies to anything you send from your own tools too, not just our campaign.

Who is liable if it goes wrong?

Both of you. The ICO's guidance makes the sender and the instigator responsible for compliance, so the supplier that sends the message and the business that asked for it are both in the frame. A reactivation supplier that doesn't ask about consent is a risk to you, not a convenience.

What should you do before you hand over a list?

Export the fields, not just the numbers: the date each record was collected, its source, any consent flags and any opt-out markers. Find the form the numbers came from and screenshot its wording. Pull your suppression list. If you can't find one of those, say so; it changes the plan, not the relationship. Then use the revenue estimator to see what a lawful list is likely to be worth before anyone quotes you, and read how a database reactivation campaign actually runs.

Related service: Database reactivation service