Is it legal to rent mobile lists in the UK?

[rabiakhatun785]

Renting mobile lists for marketing purposes in the UK is legal only under very specific and stringent conditions, primarily dictated by the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR). In practice, these conditions make it exceptionally difficult to use rented mobile lists lawfully for direct marketing, especially to individual consumers.

1. The Overriding Principle: Valid Consent or Lawful Basis

The core challenge with rented mobile lists stems from the fundamental requirement under UK GDPR that you must have a lawful basis for processing sri lanka mobile database personal data (which mobile numbers are). For direct marketing via electronic means (calls, texts), the most commonly required lawful basis under PECR is explicit, informed consent. This means:

Specific Consent: The individual must have specifically consented to receive marketing communications from your specific business. Generic consent given to a third-party list provider, covering "any third party" or "selected partners," is almost certainly not sufficient.
Informed Consent: The individual must have been clearly informed, at the point of data collection, about the exact types of marketing they would receive, and crucially, who would be sending it (i.e., your company).
Unambiguous Consent: Consent must be given by a clear, affirmative action, like ticking an unticked opt-in box. Pre-ticked boxes are not valid.

Freely Given: Consent must not be coerced or made a condition of receiving a service.
Even if a list provider assures you their data is "GDPR compliant," the onus of demonstrating valid consent for your specific marketing activities rests squarely on your business. The Information Commissioner's Office (ICO), the UK's data protection authority, has repeatedly warned businesses that simply accepting a third party's assurances is not enough; rigorous due diligence is required.

2. The Strictness of PECR for Mobile Marketing:

PECR specifically imposes very strict rules for unsolicited direct marketing via mobile phones:

Marketing Calls to Individuals: For live marketing calls to individual mobile numbers, you generally need prior consent, or the number must not be registered on the Telephone Preference Service (TPS). For automated marketing calls (recorded messages), explicit consent is always required. It's highly unlikely that a rented list would contain individuals who have given specific consent for automated calls from your business.
Marketing Text Messages (SMS): Sending marketing text messages to individual subscribers always requires prior consent, unless the "soft opt-in" rule applies. The soft opt-in is narrowly defined (existing customer, marketing similar products, clear opt-out at collection and in every message) and is very difficult to apply to individuals on a rented list, as they are not your existing customers.
Given these rules, it's almost impossible to legally acquire a rented list of mobile numbers that would allow for mass marketing calls or texts to individuals in the UK without significant risk of breaching PECR and GDPR.

3. High Risk of Non-Compliance and Penalties:

The ICO takes a very dim view of businesses using poorly sourced marketing lists. The consequences of non-compliance are severe and can include:

Substantial Fines: The ICO has the power to issue fines of up to £17.5 million or 4% of annual global turnover (whichever is higher) for serious breaches of UK GDPR, and significant fines under PECR as well. Numerous companies have faced enforcement action and large fines for unlawful marketing activities stemming from the use of non-compliant rented or purchased lists.