How PECR consent rules change referral emails for UK loyalty schemes

What to take away

How PECR treats friend-get-friend referral invites

PECR governs electronic mail marketing in the UK. A referral invite sent to a friend is direct marketing unless it is purely personal and unrelated to your business. If your loyalty scheme asks a member to forward an offer to a friend, that email is marketing by your organisation. The friend's consent is normally needed before you send it.

The rules here are PECR, the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended, and the UK GDPR, which has applied since 1 January 2021. The ICO pages linked in this article are its current guidance pages.

The Guide to Privacy and Electronic Communications Regulations | ICO explains that consent must be freely given, specific and informed. For referral invites, that means the friend must know who is contacting them and why.

Some schemes try to rely on the member's consent to cover the friend. That does not work. The member can consent to receive your marketing, but cannot consent on the friend's behalf. The friend is a separate data subject with their own rights under UK GDPR.

The same rules apply whether the invite goes by email or SMS. PECR covers both channels. If your referral marketing software sends a text message to a friend, you need the same lawful basis as for email.

There is a narrow exception for purely personal or household communications. A member sharing a link through their own email client, with no automated send from your systems, may fall outside PECR. But once your platform triggers the message, it is your marketing.

Loyalty schemes often run friend-get-friend promotions where both parties get a reward. The reward does not change the legal position. The friend is still receiving marketing, and you still need a lawful basis to contact them.

Before you build a referral flow, check UK marketing regulations to confirm which channels and consent standards apply to your scheme. That step prevents costly rebuilds later.

Consent wording that survives ICO scrutiny

The Consent | ICO guidance sets out what valid consent looks like. It must be unambiguous, involve a clear affirmative action, and be separate from other terms and conditions. Pre-ticked boxes and opt-out wording do not count.

For referral emails, the friend's consent usually comes through the member. Your platform should capture the friend's details only after the friend has actively agreed to receive the invite. A common pattern is a landing page where the friend enters their own email and ticks a box.

Your consent wording should name your organisation, state that the friend will receive a referral invite, and explain what happens next. Avoid vague phrases like "we may contact you about offers". The friend must understand the specific purpose.

Here is an example of wording that meets the standard:

"Yes, I agree to receive a referral invite by email from [Your Loyalty Scheme] about this offer. I understand my email will be used to send this invite and to track whether I join the scheme."

That wording is specific, names the sender, and describes the purpose. It also covers the tracking that referral software typically performs. The friend can withdraw consent at any time, and every invite must include a clear way to do so.

It should be no harder to take back consent than it was to give it. If the friend can opt in with one click, they should be able to opt out with one click. Your referral marketing software should log the withdrawal and suppress future sends.

Keep the wording you used at the point of consent. If you change it later, the old consent may not cover the new purpose. For a loyalty scheme, that means versioning your opt-in text and linking each friend record to the version they saw.

When you review your data protection position, check consent, disclosure and ad claims together. Referral emails often sit alongside prize draws and member offers, and the same standards apply across all of them.

Where soft opt-in stops for referral marketing software

Soft opt-in is a limited exception in PECR. It lets you email people whose details you obtained in the course of a sale or negotiations for a sale, about similar products, if you offered an opt-out at the time and in every message.

The Guidance on direct marketing using electronic mail | ICO explains the conditions. The recipient must be an existing customer or someone who negotiated with you. The message must be about similar goods or services. And you must have given a simple way to refuse at collection and in each message.

Soft opt-in limits become clear when you apply them to referral invites. A friend who has never bought from you and never negotiated with you is not covered. There is no prior relationship to build on.

Some marketers argue that the member's purchase extends to the friend. The ICO does not accept that reading; the exception is personal to the recipient.

If the friend is already your customer, soft opt-in may apply, but only if the referral offer is similar to what they bought. A general loyalty invite may qualify. A radically different product may not. Document your reasoning for each case.

Soft opt-in also requires an opt-out at the point of collection. If your member collected the friend's email without offering a refusal, soft opt-in fails. That is common in referral flows where the member types the friend's address into a form.

The safest approach for referral marketing software is to treat every friend as a new contact who needs consent.

ICO enforcement examples and what they signal

The ICO publishes its Enforcement action | ICO on its website. The cases show a consistent pattern: organisations that send direct marketing without valid consent face fines, reprimands and enforcement notices. Referral-style messages are not exempt.

In 2020 the ICO fined Sky Betting and Gaming £1.2 million over marketing emails sent without valid consent. The ICO found that the consent the company relied on was not specific or informed. For referral schemes, the lesson is that borrowed or inferred consent does not meet the standard.

In 2022 the ICO fined We Buy Any Car £200,000 over marketing emails sent without valid consent. The signal is the same: consent rules are enforced, not theoretical.

The ICO has also acted against organisations that failed to honour opt-outs. If a friend asks not to receive further invites, continuing to send them is a breach. Your referral platform must suppress those addresses across all campaigns.

These examples matter for loyalty managers because referral programmes often scale quickly. A flow that works for a hundred members can generate thousands of emails. The ICO looks at the system, not just individual sends, when deciding whether to act.

Enforcement also considers whether the organisation had a lawful basis and whether it can evidence consent. Poor records make it harder to defend a complaint. Good records can reduce the risk of escalation.

For anyone weighing the rules and ethics of loyalty marketing, the enforcement record shows that consent is the foundation. Referral rewards do not override it.

Referral flows when the friend has no prior relationship

Most friend-get-friend referrals start with a friend who has no prior relationship with your brand. That is the normal case, and it is the one that needs the most care. Your flow should be built around obtaining the friend's consent before any marketing email is sent.

A compliant flow usually works like this:

Step 2 is sometimes called a double opt-in. It gives you a clear record that the friend agreed. It also reduces the risk that a member enters someone's address without permission.

The timing matters. Send the confirmation request immediately, while the referral is fresh, and let the confirmation link expire. A typical window is 24 to 72 hours, though some schemes allow seven days. If the link expires, the friend can ask for a new one, but you must not send the referral invite until they confirm.

If the friend never confirms, send nothing further. Mark the referral as unconfirmed, and delete the friend's address or keep it only for a short suppression period.

Do not add an unconfirmed friend to your marketing list, and do not treat silence as consent. Tie the member's reward to a confirmed join, not to the referral attempt.

If your flow sends the referral invite immediately after the member submits the friend's address, you are relying on the member's action as consent. That is risky. The friend has not taken any affirmative step, and the ICO is unlikely to accept the member's submission as the friend's consent.

SMS referrals follow the same logic. A text message to a friend is direct marketing under PECR. You need the friend's consent before sending it, and you need to identify your organisation in the message.

The ICO's Direct marketing guidance | ICO underpins these communication rules. It confirms that identifying the sender and offering a clear opt-out are part of lawful direct marketing, whether the message is an offer or a referral invite.

Some schemes use a shareable link that the member posts publicly. That can fall outside PECR if the member shares it themselves and your systems do not send anything to a named individual. But if the friend clicks the link and enters their details, your subsequent emails are marketing and need consent.

Record-keeping and evidence for consent audits

The ICO expects organisations to be able to demonstrate consent. If a friend complains, you may need to show when and how they agreed, what they were told, and what they received. Without records, you cannot do that.

Your referral marketing software should log the consent event for every friend. That includes the date and time, the source of the referral, the exact wording shown, and the method of consent. A timestamp alone is not enough.

Use this checklist to test your records before an audit:

If any box is unticked, fix it before you scale the programme. Audits often follow a single complaint, and a weak record can turn a minor issue into an enforcement matter.

You should also keep evidence of your lawful basis assessment. That includes why you chose consent over soft opt-in, and how you concluded that the friend had no prior relationship. A short written note is enough if it is dated and specific.

Retention matters too. Do not keep friend data longer than needed. If the friend does not join the scheme, delete their details after a reasonable period unless they have consented to further contact. Document that period in your retention schedule.

Your platform should also support subject access requests. If a friend asks what data you hold, you need to provide it promptly. Referral records are part of that response.

Common questions