PECR (UK)

What it is

The Privacy and Electronic Communications Regulations 2003 sit alongside UK GDPR and govern marketing by phone, text and email. Regulation 19 covers "automated calling systems": calls that play a recorded message or otherwise run without a human on the line. As the ICO's guidance reads, direct marketing by automated call requires the specific prior consent of the recipient, and the call must identify the sender and give a contact address. Live human marketing calls fall under the softer Regulation 21 (screen against the Telephone Preference Service, honour objections). The ICO treats a conversational AI voice call as automated, so a voice agent making marketing calls is on the stricter track.

The Data (Use and Access) Act 2025 raised the fine ceiling for PECR breaches to the UK GDPR level.

Why it matters when buying

The distinction changes the business model of outbound. Screening against the Telephone Preference Service is not enough for an agent; a documented, specific consent is needed for each number before a marketing call. Service calls (appointment reminders, delivery updates) are not direct marketing, but the line is judged on content, and UK GDPR transparency and recording duties still apply. Inbound agents are largely outside Regulation 19. This page is informational and not legal advice.

What to ask

Ask how the platform records consent per number and blocks marketing calls without it. Ask how the agent identifies the business and gives a contact address at the start. Ask how it distinguishes a service message from marketing content when the script drifts. Ask how objections and "do not call again" requests are captured and honoured.