Following updated guidance from the ICO, charities now have greater flexibility to contact supporters via email, text and direct messaging without prior consent, under a revised ‘soft opt-in’ regime.
The change, introduced under the Data (Use and Access) Act 2025, is expected to significantly reshape how charities engage with supporters and deliver fundraising communications.
However, while this represents an important opportunity for the sector, it also introduces new compliance considerations that charities must carefully manage.
What has actually changed
Under the updated rules, charities can now rely on a ‘soft opt-in’ to send direct marketing where individuals have expressed an interest in their work or offered support for their charitable purpose.
This covers email, SMS and direct messaging on social media, and removes the requirement to obtain explicit consent at the point of contact in qualifying situations.
The Information Commissioner’s Office has confirmed the intention is to improve engagement between charities and supporters, while maintaining appropriate safeguards for individuals.
Why this is a significant shift for charities
At face value, the change offers welcome operational flexibility. It reduces reliance on traditional consent mechanisms and allows charities to engage more directly with individuals who have already shown an interest in their work.
However, this does not reduce the compliance burden. Instead, it shifts responsibility onto organisations to ensure the conditions for soft opt-in are correctly met and consistently applied.
That means charities must still be able to demonstrate that the relationship with the individual is valid, that communications remain appropriate, and that opt-out mechanisms are clear and accessible. Transparency and fairness remain central requirements.
The compliance risk charities need to be aware of
While the guidance is designed to provide flexibility, it also creates potential areas of risk if misapplied.
Common challenges include:
- Misinterpreting what constitutes ‘supporter interest’
- Overextending soft opt-in to individuals without a valid relationship
- Inconsistent application across third-party fundraising platforms
- Weak documentation of lawful basis decisions
- Failure to align marketing activity with broader data protection obligations
These issues could expose charities to regulatory scrutiny if not properly managed.
The role of structured support
This is where specialist expertise becomes increasingly important.
At Privacy Helper, we support organisations in interpreting and implementing complex marketing and data protection requirements, ensuring compliance is built into operational processes from the outset.
This includes helping charities:
- Assess whether their supporter data qualifies under the new soft opt-in rules
- Develop compliant marketing governance frameworks
- Align internal processes with ICO expectations
- Reduce regulatory and reputational risk in supporter communications
We also provide practical guidance and compliance frameworks designed to help organisations apply regulatory change in a controlled and defensible way.
If your organisation is reviewing its approach to supporter communications under the new rules, Privacy Helper can support you. Without the right framework in place, organisations risk significant regulatory and reputational exposure. Get in touch today to make sure you are properly compliant.
