> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # UK PECR and ePrivacy for Marketing Sends and Calls > Meet the United Kingdom's Privacy and Electronic Communications Regulations — the direct-marketing rules that sit beside UK GDPR — across SMS, voice, email, and push, mapped to the consent posture, DNC scrub, and announcement surfaces Orbit already gives you. # UK PECR and ePrivacy for Marketing Sends and Calls The Privacy and Electronic Communications Regulations 2003 (PECR) are the UK's e-privacy regime: a set of rules for **electronic direct marketing** and communications confidentiality that the ICO enforces **alongside** UK GDPR. PECR is the layer most operators underrate. UK GDPR asks whether your processing has a lawful basis; PECR separately asks whether the **message itself** — a marketing call, text, email, or push notification — was one you were allowed to send before you had consent. For marketing, PECR is largely an **opt-in** regime: consent comes first, and the consent has to be documented. PECR places the duty on the sender, not the platform. Orbit never mandates your UK posture — it gives you the consent posture knobs, the DNC scrub, the suppression layer, and the recording announcement. This page maps each PECR obligation to the Orbit surface you already have so your reviewers can close the gaps deliberately before you send to UK recipients. This page is documentation, not legal advice — an engineering map of product surfaces, not a legal opinion. PECR carries ICO enforcement and monetary penalties; have counsel review your consent capture, your soft opt-in reasoning, and your TPS posture. Orbit supplies the record-keeping and suppression surfaces — the legal posture is yours. *** ## What PECR actually regulates PECR's marketing rules (regs 19–24 span calls, texts, and calls to registered corporate numbers) turn on whether a communication is **direct marketing** — material directed at a particular individual that promotes a service, product, or aim. Under that definition, the channels you run through Orbit read as follows: | Channel | PECR posture for direct marketing | Orbit surface for the consent evidence | | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | **SMS / MMS to UK mobiles** | Prior consent required for unsolicited marketing texts (subject to the soft-opt-in exception — below) | [Consent API](/compliance/consent-management) — a recorded, timestamped `opted_in` per `(contact, channel)` pair | | **Live marketing calls to UK numbers** | You must not call a number registered on the TPS (individuals) or CTPS (corporates) | [DNC scrub with `country=GB`](/compliance/dnc-scrub) — the per-jurisdiction filter that scopes a check to UK registers | | **Automated calling** (recorded marketing messages, AI agents) | Consent required — there is no soft-opt-in path for automated calling | Consent API + the [recording-consent announcement](/compliance/recording-consent) (`announce_all`) | | **Email** | Prior consent, with a soft-opt-in exception for existing customers | Consent API; suppression on every click via [Opt-Out & Suppression](/compliance/opt-out-suppression) | | **Push notifications** (browser/app, marketing) | Treated as electronic direct marketing — consent first | App-side consent captured or bridged into the Consent API | Transactional traffic — order confirmations, appointment reminders, password resets — is not direct marketing under the definition, but the classification is **your** determination per send, and it is the first thing an ICO reviewer challenges. When a message carries marketing content alongside the service element, counsel usually treats the whole message as marketing. **The soft opt-in.** PECR permits marketing email (and SMS, in ICO guidance) to an existing customer without fresh consent when all three hold: you got the contact details **during a sale or negotiation**, the marketing is for your **own similar products**, and you gave an opt-out at collection **and in every message**. The soft opt-in is a defence you substantiate, not a default you assume — if you rely on it, the transaction record and the collection-time opt-out wording are the evidence a reviewer asks for. Automated (recorded/AI) calling has **no soft opt-in at all**: consent is required every time. *** ## Where the existing docs already point Orbit's compliance docs reference PECR from two angles; this page unifies them: 1. **[Consent Posture policies](/compliance/consent-default-policy)** list "GDPR, UK PECR, Brazil LGPD" together as opt-in regimes — the class of jurisdictions where marketing before consent is a violation regardless of any posture knob. The `unknown_marketing_policy` default of `refuse` and the `deny_on_missing` consent-default value are pitched exactly at this class. 2. **[Call Recording Consent](/compliance/recording-consent)** places the United Kingdom in the `announce_all`-recommended tier, citing "UK GDPR + PECR + RIPA" — the three regimes that jointly govern how you may capture a UK call, beside PECR's say on whether a marketing call may be placed at all. Neither page duplicates the other, and neither gives PECR its own reference. That is the gap this page fills. *** ## Send-time posture for UK marketing Two org-level policies decide what a contact with no recorded consent may receive. For UK-bound marketing, configure them for the opt-in regime PECR is: | Policy | UK-marketing posture | Effect | | --------------------------------------------------------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Unknown marketing policy** (`unknown_marketing_policy`) | Keep the `refuse` **default** | A contact whose consent state is `unknown` receives no marketing — the posture PECR's opt-in model assumes. Loosening to `allow_with_logging` is a documented, owner-gated decision; for UK opt-in recipients there is no lawful widening to justify it | | **Consent default policy** (`consent_default_policy`) | `deny_on_missing` | A data subject with **no consent ledger row** does not fan out to CDP destinations or subscription checks — the GDPR Art 7 posture PECR sits beside | ```bash theme={null} curl -X PATCH https://api.orbit.devotel.io/api/v1/settings/compliance/consent-default-policy \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "consent_default_policy": "deny_on_missing" }' ``` Both knobs are tenant-owned. Orbit does not mandate a UK gate — it enforces the posture you set and fails conservative (`refuse`) if a policy lookup errors. The full field, audit, and justification semantics are on [Consent Posture: The Unknown-Consent Policies](/compliance/consent-default-policy); the [eventual tenant config](#worked-configuration) below applies them end to end. An explicit opt-out, a suppression entry, or an erasure beats both knobs in every jurisdiction. For per-send hygiene on top of the posture, the marketing-send gate checks consent per contact before dispatch, and the org [compliance-health score](/compliance/compliance-health) counts consent coverage — the signal to watch after you tighten, not the permission to widen. *** ## TPS and CTPS scrubbing The **Telephone Preference Service** (TPS) and its corporate sibling (**CTPS**) are the UK's statutory do-not-call registers. PECR reg 21 makes it an offence to place a marketing call to a number registered on either. Scrubbing the UK registers is a **tenant-owned obligation** — Orbit provides the check surface and the org opt-in; it never mandates the scrub, and a cleared number is still yours to substantiate. Enable the per-org DNC check opt-in (the `dnc_sync_enabled` setting on your [posture map](/compliance/posture-overview)) and scrub UK-bound voice lists before a campaign, scoped to the UK registers with the `country=GB` filter: ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/compliance/dnc/check?phone=%2B442071838750&country=GB" \ -H "Authorization: Bearer $ORBIT_API_KEY" ``` With `country=GB`, only UK registers (TPS/CTPS) can produce an international match, so an unrelated country's registry never flags a UK campaign. For a whole list, `POST /compliance/dnc/scrub` takes up to 500 numbers per call with the same `country` scoping. The response's `intl_feeds_synced` and `last_synced_at` fields tell you whether the answer is backed by a synced international snapshot or only by your own suppression layer — read both before you treat "clear" as "scrubbed". The endpoint's 403 gate, feed wiring, and freshness semantics are on [DNC Scrubbing: Sources, Freshness, and the Check Endpoint](/compliance/dnc-scrub). Your own STOP replies and suppression entries apply in parallel: a UK recipient who opted out of **you** is restricted regardless of any register, and for UK-destination traffic a scope-`all` suppression scope keeps that revocation consistent across SMS, voice, and email. *** ## Sender identification and Ofcom-facing registration UK rules on **who a message appears to come from** are comms-regulator matters (Ofcom and the ICO) rather than PECR marketing matters — but a UK posture fails on either axis, so check both. The UK row on [Country Compliance Requirements](/compliance/country-requirements) carries the current sender-type, registration, and content rules for `GB`, per channel: ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=sms®ion=EU" \ -H "Authorization: Bearer $ORBIT_API_KEY" ``` Registration status changes at the regulator — Ofcom numbered among the regulators Orbit's Sender-ID atlas tracks — so read the live `GB` row rather than assuming "no registration" from memory. When the row says `recommended` or `required`, submit the Sender ID through `POST /compliance/sender-id-registrations` and track approval over the same surface ([full flow](/compliance/sender-id-registration)). Any KYC documents a registry asks for — identity documents, company proof — are uploaded through [Documents & KYC](/compliance/documents-kyc). Voice recruitment into the UK carries the sender-identification axis too: a branded or CLI-owned caller identity is what a TPS-scrubbed campaign still owes the recipient. See [Branded Calling](/compliance/branded-calling). *** ## Recording posture for UK calls The [recording-consent jurisdiction matrix](/compliance/recording-consent#jurisdiction-matrix) places the UK — "UK GDPR + PECR + RIPA, broadly mirrors the EU posture" — in the `announce_all`-recommended tier. Apply the whole posture: record the calls you mean to record (`eligibility_mode`), play the announcement to every party (`consent_announcement_mode: announce_all`), and keep the lawful-basis note in your CRM. The announcement's text and language are configurable; the UK's regulatory mix is why the matrix recommends the full-party pair rather than caller-only notification. *** ## Worked configuration A UK consumer-marketing program — SMS and voice, with email for existing customers — reads as this sequence. Each step is a tenant-owned decision Orbit enforces; none is a platform mandate. **Step 1 — posture.** Keep `unknown_marketing_policy: refuse` (the default; do not loosen it for UK recipients) and set `consent_default_policy: deny_on_missing`. **Step 2 — consent capture.** At acquisition (checkout, form, IVR prompt), write the record the ledger resolves against: ```bash theme={null} curl -X POST https://api.orbit.devotel.io/api/v1/compliance/consent \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "identifier": "+447700900312", "channel": "sms", "state": "opted_in", "source": "checkout-form", "scope": "sms" }' ``` If you rely on the soft opt-in for email, record the transaction reference in your CRM — the ledger carries the channel grant; the collection-time opt-out wording lives on your side. **Step 3 — voice scrub.** Before a UK voice campaign, bulk-scrub the audience with `country=GB` and treat a `intl_feeds_synced: false` response as "own-suppression only", not as a pass. **Step 4 — sender identity.** Read the `GB` row of `GET /compliance/country-rules`; if it marks registration `recommended` or `required`, file the Sender ID through `/compliance/sender-id-registrations` and wait for approval before the first send. **Step 5 — recording.** For recorded UK calls, use the `announce_all` announcement pair the jurisdiction matrix recommends. **Step 6 — revocation.** Keep one suppression scope decision: route UK opt-outs at scope `all` so a STOP propagates across SMS, voice, and email, and check the rollback on the [compliance-health score](/compliance/compliance-health) as consent coverage rises. The result is a defensible UK posture: marketing reaches only consent-backed contacts, calls avoid registered TPS/CTPS numbers, sender identity is registered where the UK row says it should be, and every decision lands in the audit trail. *** ## Related references * [Assembling a GDPR Posture End to End](/compliance/gdpr-posture-guide) — the sister-regime walkthrough PECR sits beside. * [Consent Posture: The Unknown-Consent Policies](/compliance/consent-default-policy) — the two knobs this page configures for UK recipients. * [Call Recording Consent](/compliance/recording-consent) — the UK `announce_all` recommendation in the jurisdiction matrix. * [DNC Scrubbing](/compliance/dnc-scrub) — the TPS/CTPS check mechanics and the `country=GB` filter. * [CASL (Canada)](/compliance/casl-canada-anti-spam) — the other opt-in regime page; the structure of consent-tier documentation parallels this one. * [US CAN-SPAM](/compliance/can-spam) — the opt-out counterpart. * [Restricted Industries](/compliance/restricted-industries) — content restrictions that apply on top of PECR posture (gambling, financial promotions, and the other gated verticals). * [Country Compliance Requirements](/compliance/country-requirements) — the live `GB` sender row. * [Sender-ID Registration](/compliance/sender-id-registration) and [Documents & KYC](/compliance/documents-kyc) — the registration and document-upload surfaces. * [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) — scope-`all` routing for UK revocations.