Marketing and the ‘soft opt-in’ – are you getting it right?

The ICO has recently issued a £10,000 fine to a pizza company for sending ‘nuisance marketing messages’ to its customers.

Papa Johns claimed it was relying on the exemption to consent, known as the ‘soft opt-in’, but it was found to have not abided by the rules of this exemption.

So, what is the ‘soft opt-in’ and how can you use it, within its limitations, and not fall foul of the rules? What did Papa John’s get wrong?

What is the soft-opt-in?

The laws governing electronic marketing are covered in the UK’s Privacy and Electronic Communications Regulations (PECR) and these govern email, SMS and telemarketing.

Under PECR you need to have consent to send electronic marketing messages (e.g. email or SMS) to what are termed ‘individual subscribers’. These are people who personally subscribe to their email/SMS service provider (this is often referred to as B2C marketing).

But you don’t always legally need consent…

There’s an exemption under PECR for electronic marketing to existing customers. This is commonly known as the ‘soft opt-in’. An annoyingly ambiguous term as it permits the use of an ‘opt-out’ mechanism!

When relying on the ‘soft opt-in’ you need to be careful to make sure you follow the rules about when this exemption applies, which can be summarised as:

• The contact details are collected during the course of a sale, or negotiations for a sale, of a product or service;
• An opportunity to refuse or opt-out of the marketing is given at the point of collection, and in every subsequent communication;
• You only send marketing about your own similar products and services; AND
• You provide the ability to opt-out in every communication

For more information see PECR Regulation 22 and the ICO’s Guide to PECR.

It’s worth noting the rules on consent and the soft opt-in under PECR do not apply to ‘corporate subscribers’. A corporate subscriber is where the organisation (as opposed to the individual) has subscribed to the email/SMS service. (Commonly referred to as B2B marketing).

To quote the ICO on this, here’s an extract the draft Direct Marketing Code of Practice:

“The PECR rules on marketing by electronic mail (e.g. email and text messages) do not apply to corporate subscribers. This means you can send B2B direct marketing emails or texts to any corporate body. However, you must still say who you are and give a valid address for the recipients to unsubscribe from your emails.”

You do however need to be mindful sole traders and some partnerships fall under the definition of ‘individual subscribers’, so would fall under the consent / soft opt-in rules for B2C marketing.

What did Papa John’s get wrong?

The ICO says it received 15 complaints from Papa John’s customers about the unwanted marketing they were receiving by text and email. The Regulator points out, ‘the complaints noted the distress and annoyance the messages were causing’.

Subsequent ICO investigations found the pizza company sent more than 168,000 messages to its customers without valid consent.

Papa John’s claimed it was relying on the ‘soft opt in’ exemption in order to send these marketing messages. But the ICO ruled they were unable to rely on this exemption for customers who’d placed orders over the telephone, as people had not been given the opportunity to opt-out at this point. The ICO also makes the point that customers were not provided with a privacy notice.

Andy Curry, ICO Head of Investigations said:

“The law is clear and simple. When relying on the ‘soft opt in’ exemption companies must give customers a clear chance to opt-out of their marketing when they collect the customers details. Papa John’s telephone customers were not given the opportunity to refuse marketing at the point of contact, which has led to this fine.

“We will continue to take action against companies who may be gaining unfair advantage over those companies that adhere to the law and comply with electronic marketing law”.

The message is clear, you need to tell people you’d like to send them marketing and give them an opportunity to object when you collect customers’ details in order to rely on the ‘soft opt-in’. You can read more from the ICO about this case here.

This latest fine comes hot on the heels of action against another company for falling foul of PECR. A case which focused on the often fine line between a service message and a marketing one. I wrote about this here; Are your service message actually direct marketing?

Both these fines act as warnings to organisations, and provide a good opportunity to review practices and check you aren’t taken any unnecessary risks.