Can grandparents tick marketing consent on a baby club for mum?

What does the ICO say about someone else ticking consent?

UK GDPR consent is "any freely given, specific, informed and unambiguous indication of the data subject's wishes". On what is valid consent, the ICO adds that a third party can act on someone's behalf to indicate consent — but the organisation must be able to demonstrate that the third party had authority to do so, and that the individual was fully informed and the consent was freely given.

The same page says that in practice it is likely to be difficult in most cases to verify that authority. The ICO's example of when this is most likely to be appropriate is where the individual lacks capacity and someone has specific legal authority (for example a power of attorney). A nan filling a baby-club form because mum is at work is not that situation.

MayTally is mapping ICO wording onto a club form. This is not legal advice and it does not decide whether any one tick is valid.

Do marketing emails need the recipient's own opt-in?

Yes, for electronic mail. The ICO's PECR electronic mail marketing page says organisations must not send marketing emails or texts to individuals without specific consent, unless a narrow 'soft opt-in' for their own previous customers applies. Soft opt-in does not cover a new baby-club sign-up.

That page also advises against asking people to hand over friends' or family contact details for electronic mail marketing, because the sender cannot be sure those people agreed. Putting nan's email on mum's club form, or the other way round, is the same shape of problem: PECR looks at the inbox that receives the message.

How should a grandparent handle the marketing boxes?

1. 1
   Stop at the consent screen Do not treat the partner and email ticks as part of 'joining'. Emma's Diary's pack page and Fair Data Notice separate club membership from partner offers. The ICO says consent should be unbundled from other terms wherever possible.
2. 2
   Leave the ticks for the person named on the account If the account is mum's, mum needs to see the wording. The ICO's test is objective: did that individual take a clear affirmative action after being informed? Nan guessing 'she would want samples' is not that action.
3. 3
   Do not substitute a relative's email to 'make the form work' PECR is about the recipient. An inbox that belongs to nan is nan's marketing address. The ICO advises organisations against harvesting family contact details for electronic mail.
4. 4
   Record what was actually agreed If mum later asks nan to tick a named box after reading the privacy text, that is closer to the 'authority plus informed' test the ICO describes. A vague 'just sign me up' is the case the ICO says is hard to demonstrate.

What do the clubs assume about who is ticking?

Emma's Diary's gift-pack journey (checked 10 September 2026) speaks to the person joining: it asks questions to personalise the experience, then offers ticks for samples and for trusted-partner offers by post and email. The data FAQs point members to a Preference Centre in their own Profile. None of that copy describes a grandparent acting as an agent.

If nan is only helping with the keyboard, the informed choice still has to be mum's. If nan is joining a club in her own name, the ticks are hers — and they need to match her own data, not a copied due date. That is a different question from ticking for someone else.

In shortIn short: ICO wording allows a third party to indicate consent only with authority, and only if the person was informed. PECR still needs the recipient's own opt-in. A grandparent should not treat mum's marketing boxes as a favour to tick on the way to the till.