Rules and ethics
Part of Legitimate interest vs consent for bought leads: what UK law says
Legitimate interest vs consent for bought leads: what UK law says
Bought leads under UK GDPR and PECR turn on consent, legitimate interests and the channel used. This explains ICO direct marketing rules for B2B and B2C campaigns.
What to take away
- For bought leads in the UK, the legitimate interest vs consent choice is set by PECR and the recipient type, not by the seller's preference.
- Consent is the default for email and SMS to individual subscribers, which includes most sole traders and many partnerships.
- The ICO says you can email or text any corporate body, meaning a company, Scottish partnership, limited liability partnership or government body, per the ICO email marketing guide.
- Legitimate interests can cover B2B email to corporate subscribers, but only with a documented three-part test and a working opt-out.
- A bought list does not transfer the seller's lawful basis. The buyer must evidence the original consent or assessment.
- This article is general guidance, not legal advice. Individual cases need a qualified adviser.
The two legal routes, and why the channel decides
UK GDPR Article 6 lists consent and legitimate interests as separate lawful bases, and the text is on legislation.gov.uk.
Which lawful basis for bought leads?
Is the recipient a corporate subscriber?
B2B email: legitimate interests can apply
B2C email or SMS: consent normally required
PECR adds channel-specific rules for electronic marketing. The ICO direct marketing guidance explains those rules for email, SMS and live calls.
The recipient type decides the route. A corporate subscriber includes a limited company, an LLP and a public body. An individual subscriber includes a sole trader and most partnerships. That split is easy to miss on a bought list.
For B2C email or SMS, consent is normally required. For B2B email to a corporate subscriber, legitimate interests can apply. Live calls follow a separate TPS and consent regime.
Consent for B2C bought leads
Consent under UK GDPR must be freely given, specific, informed and unambiguous. The seller must name the organisations or categories that will market to the person. A generic "third parties" statement does not meet that test. Pre-ticked boxes and bundled terms also fail.
Consent audit trail for bought B2C leads
- Exact consent wording
- Source page
- Collection date
- Opt-in record
- Article 14 privacy notice within one month
- Soft opt-insale, similar products, opt-out given
For bought data, the buyer needs the exact consent wording, the source page, the collection date and the opt-in record. Without that audit trail, purchased data compliance is hard to prove. Before buying, map the data route to the lawful basis, as covered in this guide to lead network data protection.
Where leads were not collected directly from the person, Article 14 requires privacy information within one month, unless an exemption applies.
Soft opt-in is narrow. It applies where details were obtained in a sale or negotiations, the marketing is about similar products, and the person was given a simple opt-out at collection and in every message. A third-party bought list rarely satisfies those conditions.
The test is not about whether the person might be interested. It is about the basis on which the seller first collected the data and what the buyer can prove. A high open rate does not repair a missing consent record.
| Recipient and channel | Main rule | Practical bought lead check |
|---|---|---|
| B2C email or SMS | Consent, unless narrow soft opt-in | Can the seller show the exact opt-in wording? |
| B2B email to corporate subscriber | Legitimate interests possible | Is there a three-part assessment and opt-out? |
| Sole trader email or SMS | Treated as individual subscriber | Consent needed unless soft opt-in applies |
| Live marketing call | TPS screening and consent rules | Is the number TPS checked and suppressed? |
Legitimate interests for B2B bought leads
Legitimate interests is not a free pass. The ICO expects a three-part test: identify the purpose, show the processing is necessary, and balance it against the individual's rights.
A bought B2B list still needs provenance, relevance and a suppression file. If the list has no source detail, the balancing test becomes guesswork.
Buyers should also test the B2B lead marketplace fees and cancellation terms before sharing suppression data. A contract that hides the data route is a red flag.
Record the assessment before the first send. Include the list source, the audience, the message content and the opt-out method.
A three-step check before buying
- Ask for the lawful basis in writing, with the consent wording or legitimate interests assessment for the exact list.
- Match the recipient type to the channel, separating corporate subscribers from individual subscribers such as sole traders.
- Run a small live test, record opt-outs and stop if the source cannot show the point of collection.
Document the decision. If the seller cannot answer, do not buy. A small test will not cure a missing lawful basis.
Common questions
Can I buy B2C email leads with legitimate interests?
No. PECR requires consent for electronic mail to individual subscribers, unless the narrow soft opt-in applies. A bought list rarely meets that test.
Does B2B mean consent is never needed?
No. Corporate subscribers can be emailed under legitimate interests. But sole traders and some partnerships count as individual subscribers, so consent is still needed for them.
What evidence should a buyer keep?
Keep the source URL, the exact consent wording or balancing test, the collection date, the privacy notice version and the suppression list. Store the audit trail with the lead record.
Who enforces UK direct marketing rules?
The ICO enforces PECR and UK GDPR, and can issue fines, enforcement notices and reprimands. The Data Protection Act 2018 supplements the UK GDPR. Individual cases need a qualified adviser.
