Understanding ICO Enforcement: Recent Actions and What They Mean for Your Business

The Information Commissioner’s Office — which became the Information Commission’s Office on 30 September 2026 and is still known as the ICO — keeps penalising businesses for the same failing: marketing to people who have asked not to be contacted. In August 2026 it fined Elderly Aids Ltd £190,000 for making 758,053 unsolicited marketing calls to people registered with the Telephone Preference Service (TPS) between May 2024 and February 2025, and issued an enforcement notice ordering the company to stop. The company sold call-blocking devices.

These penalties are issued under the Privacy and Electronic Communications Regulations 2003 (PECR), which sit alongside the UK GDPR and govern marketing calls, texts and emails. Regulation 21 makes it unlawful to make a live marketing call to a number registered with the TPS unless the person has told you they do not object. Regulation 22 requires consent before unsolicited marketing by text or email, with a narrow "soft opt-in" exception for existing customers. In January 2026 the ICO fined Allay Claims Ltd £120,000 for 4,046,947 marketing texts sent in breach of Regulation 22, and ZMLUK Limited £105,000 for 67,772,285 marketing emails sent without valid consent.

Not every 2026 penalty was about marketing: in February the ICO fined Reddit £14.47 million for failing to use children’s personal information lawfully. But the steady stream of enforcement is in marketing — calls to TPS numbers, texts and emails sent on bought-in or bundled "consent", and callers who do not identify themselves. For most small and mid-sized businesses, that is where the real exposure is.

The practical steps are not complicated. Screen every calling list against the TPS and Corporate TPS before a campaign goes out. Keep evidence of consent for every text and email list, including when and how it was collected — the ICO has said that generic or bundled third-party consent and pre-ticked boxes do not count. Make sure every caller gives the company name and a contact number. Honour opt-outs promptly and keep a record that you did. And review all of this regularly, because PECR has been enforced far more often than most businesses realise.

At Privacy Core Services, we support businesses in getting marketing compliance right under both PECR and the UK GDPR. Our outsourced DPO appointments and Article 37 readiness reviews can help your organisation identify compliance gaps and implement effective data protection strategies.