How ICO enforcement shapes UK lead generation consent records

What to take away

What ICO enforcement notices reveal about consent records in lead generation

The Information Commissioner's Office publishes its enforcement action in public, and the pattern across direct marketing cases is consistent. Firms are not usually caught by a single bad call. They are caught because they cannot produce the consent behind thousands of calls.

An ICO enforcement notice is a legal instruction to stop a practice or fix it within a set period. Read a batch of them and the same failure appears: no evidence of consent, or evidence that does not match what the person was told.

The published register is the best free training material a compliance lead has, because it shows what the regulator actually asks for.

What the notices ask for in practice

When the ICO investigates a lead generator, it asks for the data behind a sample of records. Not a policy. Not a screenshot of a form. The actual consent event for named individuals, tied to the number that was called or the address that was mailed.

If the trail runs from your CRM back to a third-party list with no wording attached, the case is effectively over.

Why the record, not the intention, decides the case

Most lead generators believe consent was obtained. The regulator does not test belief. It tests whether a reasonable person, reading your records, could see what the consumer agreed to.

This is why the ICO consent standard focuses on unambiguous indication, specific purposes and the ability to withdraw. If your record cannot show all three for a given lead, you are relying on an argument rather than evidence.

Where UK lead networks get caught out

Three recurring failures appear in the published register, and the cases named below show each one.

Each of these is a records problem before it is a marketing problem. Fixing the record fixes the exposure. For a wider view of how these duties sit alongside sector rules, see this guide to lead network data protection.

The commercial cost of a thin record

Reprimands, enforcement notices and monetary penalties may be issued by the ICO. It can also require you to delete data. For a lead network, deletion of a list is a direct write-off of inventory.

The figures are set out in law. Under UK GDPR, the higher tier reaches £17.5 million or 4% of total annual worldwide turnover, whichever is higher. Since the Data (Use and Access) Act 2025 took effect in February 2026, PECR penalties can reach the same £17.5 million or 4% ceiling. The old cap was £500,000.

There is a second cost. Buyers of leads, particularly in financial services and claims, increasingly audit their suppliers. A network that cannot answer a consent query in a day loses the contract before the regulator ever calls.

How PECR and UK GDPR split the duties for calls, texts and emails

Two regimes apply at once, and they do different jobs. PECR controls the channel. UK GDPR controls the data and the lawful basis. Confusing the two is where most compliance programmes drift.

PECR sits alongside the Data Protection Act 2018 and covers electronic marketing to individuals. The ICO's guide to the Privacy and Electronic Communications Regulations sets out how the rules apply to each channel and when the soft opt-in is available.

UK GDPR then asks a separate question: on what basis are you processing this person's data at all? Consent is one answer. Legitimate interests is another, and the choice changes what you must record.

Calls, texts and emails are not one channel

The table matters commercially. A lead captured for email cannot be called unless the call consent was captured too. Many networks hold one flag where they need four.

Where legitimate interests still fits

Consent is not the only route. Legitimate interests can support some processing, but it is a harder argument for cold electronic marketing to individuals. It also requires a balancing test you must be able to produce.

Example: a network keeps a suppression list of people who have asked not to be contacted again. The purpose is to stop contact, not to start it. The interest is the person's as much as the network's, and there is no less intrusive way to screen a list. On balance, the person's rights do not override it.

The same test fails for cold calls to a bought list.

For bought lists, the choice between the two routes is usually the whole case. This comparison of legitimate interest vs consent sets out where each route holds.

The soft opt-in and why it rarely saves a lead network

The soft opt-in lets you email or text existing customers about similar products, if you gave an opt-out at collection and on every message. It requires a sale or negotiations towards a sale.

A purchased lead is not an existing customer. Networks that rely on the soft opt-in for bought data are usually relying on something that does not apply. The ICO's guidance on consent is the reference point for what valid consent looks like.

The consent record fields ICO expects a UK lead network to hold

A consent record is not a checkbox in a database. It is a reconstructable event. If an investigator picks a phone number, you should be able to show the path from the person to the call.

The list below is the practical minimum for a UK network. It is written so that a colleague who has never seen the campaign could follow it.

The core fields

The table below shows a completed record for a single lead, with the value a reviewer would expect to see.

Wording, brands and purposes

The wording is the evidence. Store the exact sentence the person saw, including any brand names and any statement about third parties. Compare the two versions below.

Purposes should map to channels. Consent to receive a quote is not consent to receive calls about unrelated services. If your form bundles purposes, split them and record which were accepted.

Retention and withdrawal

Keep consent evidence for as long as you rely on it, plus a margin for complaints. If a person withdraws, record the withdrawal with the same care as the original consent.

No rule fixes the number, so pick one you can defend. A common default is 24 months from the last marketing contact, reviewed each year. Many networks keep withdrawal and suppression records for six years, matching the limitation period for contract claims in England under the Limitation Act 1980.

Continuing to call after a withdrawal is one of the fastest routes to a complaint and an enforcement notice. The record should make the stop visible.

A worked example

A Manchester network captures a quote request for boiler cover. The record holds the form wording, the timestamp, the source URL, and the two brands named on the page. The person ticks a separate box for calls.

Six months later the network sells the lead to a third brand not named on the form. The record shows no consent for that brand. The call should not happen, and the record is what proves it.

This is also where contract records that define a lead matter, because the sale terms should bar reuse the consent does not cover.

Accountability, DPIAs and breach reporting when consent evidence fails

Accountability is the duty to be able to demonstrate compliance, not just to comply. It is the reason the ICO asks for records rather than assurances. The ICO's guide to accountability and governance treats documentation as part of the obligation itself.

For a lead network, accountability shows up in three places: a DPIA before new processing, records of processing, and a breach route that works at 2am.

When a DPIA is required

A data protection impact assessment is required where processing is likely to result in high risk. Large-scale profiling, matching and the sale of personal data to many buyers usually meet that threshold.

A DPIA is also useful commercially. It forces you to name the lawful basis, the retention period and the recipients before you build the campaign. Retrospective DPIAs are weaker evidence and weaker products.

Records of processing

Your record of processing activities should name the categories of data, the purposes, the recipients, the retention periods and the security measures. For a network, the recipients list changes often, so it needs an owner and a review date.

If your record of processing and your consent record disagree, an investigator will notice. Keep them in one system where possible.

Breach reporting

A personal data breach that risks people's rights must be reported to the ICO within 72 hours of you becoming aware. Consent records are themselves personal data, so losing a consent database is a reportable event.

Have a named person, a template and a decision log. The clock starts when you become aware, not when you finish investigating.

The internal audit that finds gaps first

Run a monthly sample. Take 50 leads, pick five at random, and try to reconstruct consent from the record alone. If you cannot, you have found the gap before the regulator does.

Track the failure rate. A rising rate usually means a new source or a new partner has joined without the same standards.

Reading recent ICO enforcement action as a lead generation checklist

The ICO's published register is a free, current map of what gets firms caught. Read it as a sector-specific checklist rather than general reading. The ICO's enforcement action page lists notices, reprimands and penalties as they are issued.

What the pattern shows

Across direct marketing cases, the recurring findings are the same: calls made without valid consent, consent that did not cover the named brand, and no effective way to honour objections. The channel changes. The evidential gap does not.

For lead networks, the lesson is that a list is only as good as the record behind it. Volume is not a defence. If anything, scale increases the expectation of documented controls.

A checklist drawn from enforcement outcomes

Turning a notice into a control

Take one published case and map it to your own process. If the finding was calls without consent, test whether your call flag is genuinely separate from your email flag.

If the finding was an inability to honour objections, test your suppression list end to end. Controls that exist only on paper fail the same way records do.

Three cases to read in full

Join the Triboo Limited was fined £130,000 under PECR in April 2023. The ICO found that lead generation and hosted direct marketing formed a large part of its business. It sent 107 million emails to 437,324 people in a year, and three of its sites asked only for agreement to "marketing activity". That consent was not specific or informed.

Monetise Media Limited was fined £125,000 in December 2022, cut to £85,000 on appeal to the First-tier Tribunal. Between July 2020 and July 2021 it sent 3,506,157 marketing emails and texts without valid consent. The messages went out through affiliate marketers, one of the risk scenarios every network should plan for, and the tribunal still held the company responsible.

AFK Letters Co Ltd was fined £90,000 in April 2025 for 95,277 unsolicited calls. Its third-party data supplier's consent statements did not name AFK, and AFK could not produce consent records for several calls. All three cases turn on the same point: what people were told, and what you can prove they were told, decides the outcome.

Where bought leads and data broker services change the consent test

Buying leads does not transfer responsibility. It transfers risk. When you use data broker marketing services, you become the controller for the marketing you do, and you must be able to show the consent behind it.

The ICO's guidance for organisations using the marketing services of data brokers is direct about this: check the consent, and do not assume the broker's assurances are enough.

The due diligence that actually protects you

Before buying, ask for the consent wording, the source, the date and the purposes for a sample of records. Ask how the broker handles withdrawals and how quickly it tells you about them.

Ask what happens if a person complains. If the answer is vague, the list is a liability with a price tag. For how this plays out across a whole network, see this piece on spotting low-quality leads.

Contract clauses that shift evidence, not liability

Clauses should require the broker to provide consent records on request, notify you of withdrawals, and indemnify you for failures it caused.

Set a service level for evidence delivery. A clause with no timescale is not a control.

When a bought list should be rejected

Reject any list where the broker will not show original wording. Reject lists where consent names no brands you can identify. Reject lists sourced from unclear competitions or prize draws.

Rejecting a list is cheaper than defending a complaint. It also protects the buyer relationships that keep the network trading.

Building a consent record that survives an ICO enquiry

The test is simple to state. A stranger should be able to pick one lead and see, without help, who consented, to what, when, and how to stop. Build backwards from that.

Step by step

Keep the record readable

Store wording as text, not as an image of a form. Images cannot be searched, compared or produced quickly under pressure.

Version your forms. When wording changes, the old version should remain attached to the leads captured under it. Otherwise a later change rewrites history you may need.

Governance that holds after launch

Name an owner for consent records. Give them authority to stop a campaign when evidence is missing. Review supplier contracts annually and after any enforcement news in your sector.

Your obligations also sit inside a wider rulebook covering financial promotions, advertising claims and company reporting. A practical summary of UK regulations for a lead network shows how these pieces fit together.

The one question to keep asking

If the ICO asked for the consent behind this lead tomorrow, could you produce it by lunchtime? If the answer is no, the fix is a records project, not a legal argument.

Producing it by lunchtime means one extract, not a project. One page per lead: the wording, the timestamp, the source URL, the brands, the purposes and any withdrawal. If those six items come out of a single query, the record works. If they come from three systems and an email chain, it does not.

Ask the question monthly, on a fresh sample of five. The answer should not change as the network grows.

Common questions