Direct marketing and online tracking can engage both data-protection law and PECR. Choose the route by the channel, technology, consent position and purpose.
Key points
- You can object to processing for direct marketing at any time and the organisation must stop that marketing processing.
- Electronic mail marketing and live or automated calls have channel-specific PECR rules.
- Cookies and similar storage or access technologies may require consent unless an exception applies.
- The DUAA changed some PECR rules and exceptions, but did not create a free-for-all for tracking.
- A suppression list may legitimately retain minimal data to honour an opt-out.
Marketing objections
An Article 21 objection to direct marketing is absolute for that purpose, including related profiling. Say which contact details and brands are covered. Asking to erase everything can be counterproductive if a minimal suppression record is needed to prevent future marketing.
Email, text and calls
PECR applies additional rules depending on the channel and recipient. Consent, the limited existing-customer “soft opt-in”, caller identification and preference services may be relevant. A privacy notice or pre-ticked box is not automatically valid consent.
Cookies and tracking
Look beyond the label “cookie”: pixels, local storage, device fingerprinting and similar technologies can involve storing or accessing information on equipment. Ask what technology operates, its purpose, whether an exception applies and how refusal or withdrawal works.
Evidence
Keep the message, full sender details, date, number, screenshots of the consent interface, cookie banner choices and any preference-centre confirmation. For repeated contact, record each event rather than forwarding an unstructured inbox.
Build the record
Turn the concern into answerable questions
- Identify the exact personal data or processing activity.
- Record dates, systems, people and any decision or disclosure affected.
- Choose the right legal tool for the outcome you need.
- Ask for a reasoned answer and a specific corrective action.
- Keep the request, acknowledgement, evidence and final response together.
If several rights are involved, number them separately. A request for access, a request to correct data and a complaint about previous handling can run alongside one another, but they have different legal tests and may have different deadlines.
Worked examples
| What happened | The data-protection question | Likely next route |
|---|---|---|
| Promotional email after opt-out | Object, preserve proof and complain under the marketing route. | Organisation complaint and ICO |
| Analytics loads before any choice | Record a clean-browser test and ask which PECR exception is relied on. | Transparency and complaint |
| Company keeps email on suppression list | That limited retention may be necessary to respect the objection. | Erasure and objection |
Useful wording
“I object to processing of my personal data for direct marketing, including related profiling. Stop marketing to [details] and place the minimum information necessary on a suppression list. For the tracking identified, explain the technology, purpose, consent or exception relied on, and withdrawal mechanism.”
Keep the request focused on the data or processing activity. Ask the organisation to identify its position and the corrective action it will take. Keep a copy and proof of delivery.
Official sources
Check the rules behind this guide
These are official or primary sources. Check the current text before relying on a formal deadline, procedure or court route.