How to build an email list legally in the UK, and what to do with the contacts you already have

This post explains the rules as we understand them, with links to the regulator’s guidance. It is not legal advice.

Most people who come to an email platform already have contacts: past customers, leads from the website, people met at events, a spreadsheet from years ago. The question is rarely “how do I send an email”. It is “which of these people am I actually allowed to email?”

The short version: in the UK you can email people marketing if they asked to hear from you, if they are customers who were given a chance to say no, or if they are business contacts at companies. Everyone else, you have to invite, not email.

This guide goes through each kind of contact, what to check before you add them to a list, and how to grow a list that is yours to email. For the law itself in more depth, see UK email marketing rules in 2026.

The one rule behind all of this

UK marketing email is governed by the Privacy and Electronic Communications Regulations (PECR), alongside the UK GDPR. The Information Commissioner’s Office says you “must not send marketing emails or texts to individuals without specific consent”, with one exception for existing customers, usually called the soft opt-in. Different rules apply to business contacts at companies.

Turning off double opt-in, or skipping a confirmation email, does not change any of this. It removes a step. It does not give you permission.

Your contacts, one group at a time

People who signed up

If someone filled in your signup form, ticked an opt-in box, or subscribed on another email platform you are moving from, you can email them.

Before you import: keep the record of how and when they signed up. The ICO asks you to keep “a record of the consent (eg who, when, how)”. If you are moving from another platform, export the opt-in dates and sources with the list.

Customers who bought from you

You can email people who bought, or were negotiating to buy, from you about your similar products without separate consent, but only if:

• you got their details from them while they were buying;
• you gave them a clear chance to opt out at that point. The ICO is specific: “including an opt-out in an order confirmation email is not sufficient”;
• every email you send lets them opt out.

Browsing your website is not enough.

Before you import: check that your checkout or order form gave customers the chance to say no to marketing. If it did not, these customers cannot be emailed marketing until they opt in.

Leads and enquiries

Someone who filled in a contact form, asked for a quote, or found you through search has not agreed to marketing email. You can reply to their enquiry: that is a conversation, not marketing. You cannot add them to your newsletter.

You cannot email them to ask, either. The ICO lists “contacting people to ask them for consent to direct marketing” as direct marketing in itself. Its example is a hotel emailing past guests to ask whether they would like offers: still marketing, even with no offer in it.

What to do instead: ask for permission where you already meet them. Add an opt-in box to your enquiry form, or a signup form on the pages they land on.

Business contacts

You can email marketing to people at limited companies, LLPs and public bodies without consent: the ICO says “you can email or text any corporate body”. You must still say who you are, include a way to opt out, and stop when asked.

But sole traders and some partnerships count as individuals, so the rules above apply to them.

Bought, rented or scraped lists

These are only usable if every person on the list agreed to marketing from you, by name. Consent given to “selected third parties” or “trusted partners” does not count, the soft opt-in never applies, and you must satisfy yourself “the details were collected fairly”. In practice, most bought lists fail this.

Addresses found on websites or social profiles are not free to use just because they are public.

Before you import: a checklist

1. Split your contacts by where they came from: sign-ups, customers, enquiries, business contacts, bought lists.
2. Keep the groups you are allowed to email, with your evidence: dates, and the form or checkout they used.
3. Leave the rest out. Do not email them to ask.
4. Import your past unsubscribes too, marked as unsubscribed, so they are never emailed by mistake.
5. Tag each batch by source (for example customers-2025), so you can show where every contact came from later.

In SendBeam, every import asks where its contacts came from. Sign-ups, customers and business contacts import with that answer recorded on each contact; leads, bought lists and “not sure” are refused, with these alternatives instead. See where the contacts came from.

Growing a list that is yours to email

• A signup form where people already are: your homepage, your blog posts, the footer. Create one and add it to your site.
• A reason to join: a guide, a checklist, a discount, early access. Say what they will get and how often.
• An opt-in box at checkout and on enquiry forms, unticked and separate from your terms. Pre-ticked boxes do not count as consent.
• Double opt-in where it helps: it proves the address is real and that the person asked. See double opt-in.

Every marketing email, whoever it goes to

• Say clearly who you are.
• Include a working unsubscribe link, and act on it.
• Keep a do-not-email list, and check new imports against it.

The ICO notes that its guidance on these rules is under review following the Data (Use and Access) Act 2025; the points above are as it stood when this post was written.