On 28 April 2026, the ICO published updated guidance on direct marketing using electronic mail to explain how charities can use the new "charitable purposes soft opt-in", which came into force on 5 February 2026 as part of the Data (Use and Access) Act 2025 (DUAA). Charities looking to adopt this new route to contacting supporters should review the guidance carefully to understand the nuances, including the distinction and interplay between this new opt-in and the existing 'commercial purpose' soft opt-in, and the practical measures the ICO expects to see.

What is the charitable purposes soft opt-in?

The charitable purposes soft opt-in is one of two "soft opt-in" exceptions under the Privacy and Electronic Communications Regulations 2003 (PECR) that allow organisations to send unsolicited electronic mail marketing, including emails, texts and direct messages on social media, to individuals without first obtaining their consent. While the existing products and services soft opt-in is available to all organisations (including charities), the new charitable purposes soft opt-in is available only to charities. 

What does the ICO guidance say?

The guidance makes clear that a charity wishing to send electronic marketing (emails, texts and other electronic messages) about their charitable purposes without obtaining consent must meet all the following requirements: 

• The charity must obtain the recipient's contact details directly from the individual. Contact details collected by a third party, even a closely connected organisation such as a trading subsidiary or a third-party fundraising platform, will not qualify. There is no such thing as a third-party marketing list that is soft opt-in compliant.
• Contact details must have been collected in circumstances where the individual expressed an interest in, or offered or provided support for, the charity's charitable purposes. The ICO gives a range of helpful examples, including donating, volunteering, or actively engaging with a charity's mission. Incidental interactions, such as using free guest wifi at a charity-run café or buying a drink out of convenience, will not qualify.
• The sole purpose of the direct marketing must be to further the charity's own charitable purposes. This includes asking for donations, inviting people to volunteer and sharing information about the charity's programmes and campaigns. Crucially, it does not extend to promoting other organisations, including other charities.
• The charity must provide a clear and simple opportunity for the individual to opt-out both at the point of collection and in every subsequent communication. An opt-out buried in a privacy policy will not be enough. 

An important timing consideration is that the new exemption commenced on 5 February 2026, and a charity may only rely on it where the recipient's contact details were obtained on or after that date. 

What about charities that sell products and services?

Charities that both sell products or services and engage supporters can potentially rely on both the existing commercial purpose and new charitable purpose soft opt-ins. However, the ICO's guidance is clear that, where a charity does so, it must satisfy the conditions of each soft opt-in (as stated above, for the charitable purpose soft opt-in; and similar requirements for the commercial purpose soft opt-in) and offer separate opt-outs for each permission (both when collecting contact details and in every subsequent communication).

On a practical level, the ICO recognises that the conditions of each soft opt-in may be satisfied at the same time, for example someone buying a product or service (qualifying for the commercial purpose soft opt-in) can also be expressing support for the charity's work – but the charity should be satisfied that is the case.

What should charities do now?

For charities that want to take advantage, the following steps are advisable:

• Carefully consider whether it applies. The guidance contains various practical examples, including some nuanced scenarios that will help charities assess whether the soft opt-in is appropriate for their activities.
• Review your data collection processes. Web forms, scripts and digital journeys used to collect contact details will need to be reviewed to ensure they include clear, prominent opt-out mechanisms at the point of collection.
• Build preference management. Where relying on both soft opt-ins, systems should be capable of recording and respecting separate opt-out preferences for products/services marketing and charitable purposes marketing.
• Remember the cut-off date. The soft opt-in can only be used for contact details collected on or after 5 February 2026. Pre-existing supporter lists will still require consent. 

By acting now, charities can adopt the new soft opt‑in with confidence, ensure compliance and build deeper, more resilient supporter relationships – if you work for a charity and need help understanding this new exception, please get in touch.