Skip to main content

​
UK PECR and ePrivacy for Marketing Sends and Calls

The Privacy and Electronic Communications Regulations 2003 (PECR) are the UK’s e-privacy regime: a set of rules for electronic direct marketing and communications confidentiality that the ICO enforces alongside UK GDPR. PECR is the layer most operators underrate. UK GDPR asks whether your processing has a lawful basis; PECR separately asks whether the message itself — a marketing call, text, email, or push notification — was one you were allowed to send before you had consent. For marketing, PECR is largely an opt-in regime: consent comes first, and the consent has to be documented. PECR places the duty on the sender, not the platform. Orbit never mandates your UK posture — it gives you the consent posture knobs, the DNC scrub, the suppression layer, and the recording announcement. This page maps each PECR obligation to the Orbit surface you already have so your reviewers can close the gaps deliberately before you send to UK recipients.
This page is documentation, not legal advice — an engineering map of product surfaces, not a legal opinion. PECR carries ICO enforcement and monetary penalties; have counsel review your consent capture, your soft opt-in reasoning, and your TPS posture. Orbit supplies the record-keeping and suppression surfaces — the legal posture is yours.

​
What PECR actually regulates

PECR’s marketing rules (regs 19–24 span calls, texts, and calls to registered corporate numbers) turn on whether a communication is direct marketing — material directed at a particular individual that promotes a service, product, or aim. Under that definition, the channels you run through Orbit read as follows: Transactional traffic — order confirmations, appointment reminders, password resets — is not direct marketing under the definition, but the classification is your determination per send, and it is the first thing an ICO reviewer challenges. When a message carries marketing content alongside the service element, counsel usually treats the whole message as marketing. The soft opt-in. PECR permits marketing email (and SMS, in ICO guidance) to an existing customer without fresh consent when all three hold: you got the contact details during a sale or negotiation, the marketing is for your own similar products, and you gave an opt-out at collection and in every message. The soft opt-in is a defence you substantiate, not a default you assume — if you rely on it, the transaction record and the collection-time opt-out wording are the evidence a reviewer asks for. Automated (recorded/AI) calling has no soft opt-in at all: consent is required every time.

​
Where the existing docs already point

Orbit’s compliance docs reference PECR from two angles; this page unifies them:
  1. Consent Posture policies list “GDPR, UK PECR, Brazil LGPD” together as opt-in regimes — the class of jurisdictions where marketing before consent is a violation regardless of any posture knob. The unknown_marketing_policy default of refuse and the deny_on_missing consent-default value are pitched exactly at this class.
  2. Call Recording Consent places the United Kingdom in the announce_all-recommended tier, citing “UK GDPR + PECR + RIPA” — the three regimes that jointly govern how you may capture a UK call, beside PECR’s say on whether a marketing call may be placed at all.
Neither page duplicates the other, and neither gives PECR its own reference. That is the gap this page fills.

​
Send-time posture for UK marketing

Two org-level policies decide what a contact with no recorded consent may receive. For UK-bound marketing, configure them for the opt-in regime PECR is:
Both knobs are tenant-owned. Orbit does not mandate a UK gate — it enforces the posture you set and fails conservative (refuse) if a policy lookup errors. The full field, audit, and justification semantics are on Consent Posture: The Unknown-Consent Policies; the eventual tenant config below applies them end to end. An explicit opt-out, a suppression entry, or an erasure beats both knobs in every jurisdiction. For per-send hygiene on top of the posture, the marketing-send gate checks consent per contact before dispatch, and the org compliance-health score counts consent coverage — the signal to watch after you tighten, not the permission to widen.

​
TPS and CTPS scrubbing

The Telephone Preference Service (TPS) and its corporate sibling (CTPS) are the UK’s statutory do-not-call registers. PECR reg 21 makes it an offence to place a marketing call to a number registered on either. Scrubbing the UK registers is a tenant-owned obligation — Orbit provides the check surface and the org opt-in; it never mandates the scrub, and a cleared number is still yours to substantiate. Enable the per-org DNC check opt-in (the dnc_sync_enabled setting on your posture map) and scrub UK-bound voice lists before a campaign, scoped to the UK registers with the country=GB filter:
With country=GB, only UK registers (TPS/CTPS) can produce an international match, so an unrelated country’s registry never flags a UK campaign. For a whole list, POST /compliance/dnc/scrub takes up to 500 numbers per call with the same country scoping. The response’s intl_feeds_synced and last_synced_at fields tell you whether the answer is backed by a synced international snapshot or only by your own suppression layer — read both before you treat “clear” as “scrubbed”. The endpoint’s 403 gate, feed wiring, and freshness semantics are on DNC Scrubbing: Sources, Freshness, and the Check Endpoint. Your own STOP replies and suppression entries apply in parallel: a UK recipient who opted out of you is restricted regardless of any register, and for UK-destination traffic a scope-all suppression scope keeps that revocation consistent across SMS, voice, and email.

​
Sender identification and Ofcom-facing registration

UK rules on who a message appears to come from are comms-regulator matters (Ofcom and the ICO) rather than PECR marketing matters — but a UK posture fails on either axis, so check both. The UK row on Country Compliance Requirements carries the current sender-type, registration, and content rules for GB, per channel:
Registration status changes at the regulator — Ofcom numbered among the regulators Orbit’s Sender-ID atlas tracks — so read the live GB row rather than assuming “no registration” from memory. When the row says recommended or required, submit the Sender ID through POST /compliance/sender-id-registrations and track approval over the same surface (full flow). Any KYC documents a registry asks for — identity documents, company proof — are uploaded through Documents & KYC. Voice recruitment into the UK carries the sender-identification axis too: a branded or CLI-owned caller identity is what a TPS-scrubbed campaign still owes the recipient. See Branded Calling.

​
Recording posture for UK calls

The recording-consent jurisdiction matrix places the UK — “UK GDPR + PECR + RIPA, broadly mirrors the EU posture” — in the announce_all-recommended tier. Apply the whole posture: record the calls you mean to record (eligibility_mode), play the announcement to every party (consent_announcement_mode: announce_all), and keep the lawful-basis note in your CRM. The announcement’s text and language are configurable; the UK’s regulatory mix is why the matrix recommends the full-party pair rather than caller-only notification.

​
Worked configuration

A UK consumer-marketing program — SMS and voice, with email for existing customers — reads as this sequence. Each step is a tenant-owned decision Orbit enforces; none is a platform mandate. Step 1 — posture. Keep unknown_marketing_policy: refuse (the default; do not loosen it for UK recipients) and set consent_default_policy: deny_on_missing. Step 2 — consent capture. At acquisition (checkout, form, IVR prompt), write the record the ledger resolves against:
If you rely on the soft opt-in for email, record the transaction reference in your CRM — the ledger carries the channel grant; the collection-time opt-out wording lives on your side. Step 3 — voice scrub. Before a UK voice campaign, bulk-scrub the audience with country=GB and treat a intl_feeds_synced: false response as “own-suppression only”, not as a pass. Step 4 — sender identity. Read the GB row of GET /compliance/country-rules; if it marks registration recommended or required, file the Sender ID through /compliance/sender-id-registrations and wait for approval before the first send. Step 5 — recording. For recorded UK calls, use the announce_all announcement pair the jurisdiction matrix recommends. Step 6 — revocation. Keep one suppression scope decision: route UK opt-outs at scope all so a STOP propagates across SMS, voice, and email, and check the rollback on the compliance-health score as consent coverage rises. The result is a defensible UK posture: marketing reaches only consent-backed contacts, calls avoid registered TPS/CTPS numbers, sender identity is registered where the UK row says it should be, and every decision lands in the audit trail.