Guides · Freebies · Consent
Nan used my email for a baby club — is that valid marketing consent?
What consent does PECR require for a marketing email?
The ICO's PECR page on electronic mail marketing is blunt: you must not send marketing emails or texts to individuals without specific consent, unless the limited soft opt-in for your own previous customers applies. Soft opt-in is only for someone who bought, or negotiated to buy, a similar product or service from that sender, and who was given a simple opt-out when the details were collected and in every later message.
The ICO also says soft opt-in does not apply to prospective customers or new contacts (for example bought-in lists). A grandparent handing over a daughter's inbox is a new contact from the club's point of view, not a customer who just bought nappies from that club.
ICO PECR guidance advises organisations against asking people to hand over friends' and family's contact details for electronic mail marketing, because they cannot be sure those people agreed.
Can nan validly consent on my behalf?
UK GDPR consent is "any freely given, specific, informed and unambiguous indication of the data subject's wishes". The ICO's "what is valid consent?" page says a third party may indicate consent on an individual's behalf, but the organisation must be able to demonstrate that the third party had authority to do so. "In practice, it is likely to be difficult in most cases to verify that a third party has the authority to provide consent."
The same page says you must still show the individual was fully informed and that consent was freely given. The usual example the ICO gives is someone with legal authority to decide for a person who lacks capacity — not a relative claiming a free pack.
Swipe sideways for the full table
| ICO test | What the ICO publishes | Typical nan-used-my-email facts |
|---|---|---|
| Who consented | The data subject, or a third party with demonstrable authority | Nan typed the address; mum may never have seen the tick |
| Specific and informed | Name the controller and any third-party controllers; say what will be sent | A pack form often bundles club mail and "trusted partners" |
| Clear affirmative action | No pre-ticked boxes, silence or inactivity | Mum's inbox appearing on a form she did not submit is not her tick |
| Soft opt-in (PECR) | Own previous customer, similar product, opt-out offered at collection | The inbox owner did not buy from that club |
| Evidence | Who, when, how, and what they were told | The club's record is usually nan's device and nan's name |
When does the ICO say consent is invalid?
The ICO lists situations where you do not have valid consent. Several match a family signup: doubts over whether someone consented; the individual does not realise they consented; no clear records; no genuine free choice; consent bundled with other terms; pre-ticked boxes; the organisation was not specifically named; people cannot easily withdraw.
If the club cannot show your affirmative action, PECR consent for email to you is the weak point — even if nan was happy to tick everything to unlock a pack. The ICO's public spam-email page still allows organisations to email when you opted in, or when soft opt-in applies. Family attribution is not either of those.
What should I do if the consent looks invalid?
This page stops at validity. A full, club-by-club opt-out walkthrough is a different job. The short pointer from the ICO's public pages is: tell the organisation to stop, using the contact details in its privacy notice if there is no unsubscribe link, and consider an ICO complaint if marketing email continues.
- Reply to the sender that you did not consent and that a relative used your address; object to direct marketing.
- Ask which lawful basis they are using for your inbox — consent or soft opt-in — and who they recorded as the person who ticked the box.
- If they rely on consent, the ICO says withdrawal must be as easy as giving it; they must stop that processing.
In shortPECR looks at the recipient. Nan typing your email is not, on its own, your specific consent, and soft opt-in does not cover a family-supplied inbox. Object to the sender. Step-by-step unsubscribes for each club sit on a separate page.
Questions parents ask
- Does it matter that I later opened the welcome email?
- Opening a message is not the same as a clear opt-in. The ICO says consent needs an unambiguous affirmative action, and that failure to opt out is not consent. Read what you click if the email itself asks you to confirm preferences.
- Can the club use soft opt-in because nan collected a pack?
- Soft opt-in is for the sender's own previous customer who bought or negotiated a similar product and was offered an opt-out. The ICO says it does not cover new contacts or bought-in lists. Nan's pack does not make your inbox that customer.
- Is a partner email different from the club's own email?
- Each sender needs its own PECR permission. ICO consent guidance says third-party controllers must be named. A tick that said "trusted partners" without naming the sender is a weak record of specific consent for that partner's email.
- Where are the unsubscribe steps?
- On the ICO public page: use the unsubscribe link, or the privacy-notice contact if there is no link, then consider a complaint if they continue. Club-by-club buttons are a separate how-to, not this consent article.
Sources
Official pages first. If this page and the official page disagree, the official page wins.
- ICO — What is valid consent? (third party on someone's behalf) — checked 10 September 2026
- ICO — Electronic mail marketing (PECR regulation 22 and soft opt-in) — checked 10 September 2026
- ICO — I keep receiving marketing emails and I want them to stop — checked 10 September 2026
This is information, not a guarantee of any payment, and not medical, legal or product-safety advice for your home. Prices and rules change; figures carry the date they were checked. Recall status comes from official records only — a product we cannot find is not a safety all-clear. Tell us if we got a fact wrong.