Short answer: the Information Commissioner's Office (ICO) says the Data (Use and Access) Act 2025 (DUAA) introduces a soft opt-in for charities. It lets a charity send electronic mail marketing to people whose details it collects when they support, or express an interest in, its work, unless they object. Consent, an easy opt-out and good records still matter.
This article sticks to what the ICO has published. The exact conditions matter, so use it as a briefing and check the guidance itself before you change a process. It is not legal advice.
What is a soft opt-in?
The ICO's PECR guidance describes the "soft opt-in" as the rule that lets you email or text your own existing customers without specific consent. In outline, it applies when someone has bought, or negotiated to buy, a similar product or service from you, and you gave them a simple way to opt out both when you first collected their details and in every message you have sent.
The ICO also says this rule does not apply to prospective customers or new contacts, for example people on bought-in lists. And it says it does not apply to non-commercial promotions such as charity fundraising or political campaigning.
That last point is what the DUAA changes for charities.
What the ICO says the DUAA changes
In its overview of what the DUAA means for organisations, the ICO says the Act amends, but does not replace, the UK GDPR, the Data Protection Act 2018 and PECR. Among the changes that make things easier for organisations, it lists a soft opt-in for charities: a charity can send electronic mail marketing to people whose personal information it collects when they support, or express an interest in, its work, unless they object.
The ICO says the changes are being phased in between June 2025 and June 2026, and points to its updated guidance on direct marketing using electronic mail. Check the current position on the ICO site before you rely on it.
Customer soft opt-in compared with charity soft opt-in
|
Customer soft opt-in (PECR) |
Charity soft opt-in (DUAA, per ICO) |
| Who it covers |
Existing customers who bought or negotiated to buy |
People who support, or express an interest in, the charity's work |
| Typical trigger |
A purchase or sales negotiation |
A donation, sign-up, enquiry or other expression of interest |
| Opt-out |
Simple opt-out when details are collected and in every message |
Applies unless the person objects |
| Not covered |
Prospects, bought-in lists, non-commercial promotions |
Check the ICO guidance for the detailed conditions |
What the ICO overview does not say
The overview does not state that every existing supporter record qualifies. It also does not say you can stop recording how and when someone joined, or ignore an objection. A careful reading is that the soft opt-in gives you another lawful route for people who showed interest, while PECR's standard rules still apply:
- do not disguise or conceal who you are,
- provide a valid contact address for opting out,
- act promptly on unsubscribes,
- keep a do-not-contact list and screen against it.
Permission is not the same as a welcome
Being allowed to email someone does not mean they want a monthly appeal. Charity lists are often made of people who gave once, attended an event or signed a petition. If you widen who receives your emails, watch these measures:
- Unsubscribe and complaint rates. A larger, colder audience usually produces more of both. Compare with your own baseline.
- Click and donation rate. Appeals sent to the whole list dilute averages. Segment before comparing.
- Deliverability. Gmail and Yahoo set spam-complaint thresholds for bulk senders. See the bulk sender requirements.
- Supporter lifetime. A donor who wanted impact updates may leave if every email is an ask. See subscriber lifespan.
A supporter-list audit in seven steps
- Tag every supporter by source. Donation, event, petition, volunteer sign-up, newsletter form, import.
- Record what they were told. For each source, note the wording shown at collection and whether an opt-out was offered.
- Unify objections. Make sure unsubscribes and objections from every system feed one suppression list.
- Segment before sending. Start with explicit opt-ins and recent supporters. Widen carefully and measure.
- Separate appeals from updates. Offer different streams, such as impact news, events and fundraising.
- Add preference options. Let people choose topics and frequency. See zero-party data and preference centres.
- Confirm with your data protection lead. Check your lawful basis, privacy notice and records match what you actually do.
How to measure the effect fairly
If you change who you email, compare like with like. For each segment, track per 1,000 delivered emails:
- clicks,
- unsubscribes,
- donations.
The click-through rate calculator and the email ROI calculator apply the same formulas each time, which makes segment comparisons consistent. Our email marketing for charities guide covers campaign types and metrics in more depth.
Key takeaways
- The ICO says the DUAA adds a soft opt-in for charities, covering people who support or show interest in their work, unless they object.
- It differs from the customer soft opt-in, which the ICO says excludes charity fundraising.
- You still need a simple opt-out, honest sender identity and a suppression list.
- Measure unsubscribes and complaints as you widen your audience, not just donations.
Sources
This article is general information, not legal advice.
Related articles
