Emailing past customers about new products: the ICO's soft opt-in rule for an online shop, with a 3,000-address list sorted

A shop has a new range coming and 3,000 addresses in its customer export. The owner would like to send one launch email to the lot. Whether that is allowed depends on how each address got on the list, and the export rarely says.

What the ICO says

The ICO's guidance on electronic mail marketing (part of its Guide to the Privacy and Electronic Communications Regulations, PECR) sets out the position for emails to individuals. Marketing needs the person's consent unless the soft opt-in applies. The soft opt-in covers someone who:

• is an existing customer who bought, or discussed buying, a similar product or service from you in the past; and
• was given a simple way to opt out both when the details were first collected and in every message sent since.

The ICO says the soft opt-in does not apply to prospective customers or new contacts, such as people on a bought-in list. It also does not cover non-commercial promotions, which the page gives as charity fundraising or political campaigning.

Two further points matter to a small shop. Sole traders and some partnerships are treated as individuals, so a craft buyer who runs a one-person business gets the same protection as a private customer. A company, a Scottish partnership, an LLP or a government body can be emailed, and the ICO recommends keeping a do-not-email list for those that object. The page also states that it is under review because of the Data (Use and Access) Act, so check the ICO's current text before a large send. It shows no date and gives no fine levels, and this guide gives none.

Sorting the list: a worked example

Take the 3,000 addresses and group them by source:

The mailable total is 1,850 + 600 = 2,450, which is 81.7% of 3,000. The remaining 550 addresses, or 18.3%, are held back. A launch email to all 3,000 would put more than one address in six outside the rule, on the ICO's description.

Two checks sit behind the first row. The shop must be able to show that the opt-out was offered at checkout, so a screenshot of the checkout page with its date is worth keeping. And "similar" is judged on the product bought: a customer who bought a candle is a fair target for another candle, while an unrelated line is a question to settle before sending.

What to put in the file

1. A source field on every address: checkout, consent box, prize draw, bought-in, other.
2. The date of collection, and the wording shown at that point.
3. An unsubscribe link in every message, which also feeds a suppression list.
4. A do-not-email list for company addresses that object.

Order confirmations and delivery notices are a separate matter, covered in our guide to the order confirmation email. How long the list itself can be kept is in the guide on how long a shop must keep order records and customer data, and asking for reviews has its own rules in the review request guide.

Overlyft builds AI staff who join the shop team and look after the customer list: they tag each address with its source and collection date, hold back anything that lacks a basis for marketing, and draft the launch email for the owner to approve. A person signs off the send, and the owner's time goes on the products.

This is general information, not legal advice. Check the ICO's current guidance before sending marketing.