UK Cold Calling Laws in 2026: PECR, GDPR, TPS and What They Actually Require

1. TPS + CTPS screening before any marketing call.
2. Explicit consent for pre-recorded and AI-voice calls (live human calls have lighter rules).
3. Clear identification + opt-out on every call.
4. Auditable consent + suppression records for ICO investigations.

The Telephone Preference Service covers individuals, including sole traders and unincorporated partnerships in most cases. The Corporate TPS covers registered companies, LLPs and public bodies. They are separate registers and screening one does not cover the other.

The practical rule is that you must not make unsolicited marketing calls to a number on either register unless that specific person or organisation has told you they are happy to be called. Someone else's consent does not transfer. A list vendor telling you the data is “TPS-screened and opted in” is a claim about their relationship, not yours.

Screening is not a one-off. Registrations are added continuously, so a list scrubbed three months ago is not a scrubbed list today. Build re-screening into the process rather than treating it as an import-time step.

This is the distinction that decides how much consent you need.

A live human agent making a marketing call is governed by the TPS/CTPS regime described above — screen the register, respect objections, identify yourself.

Automated calls that play a recorded message require something stricter: specific prior consent from that person to receive automated marketing calls. Screening against TPS is not sufficient, and there is no soft opt-in shortcut here.

AI voice agents are the live question in 2026. The ICO's direct-marketing guidance treats a call where a machine, not a person, delivers the message as an automated call. If your AI agent conducts the conversation autonomously, plan on needing explicit prior consent rather than assuming it inherits the lighter live-agent rules. If you are deploying AI voice for outbound in the UK, this is the point to take advice rather than infer.

You must present a valid, dialable caller ID on marketing calls. Withholding the number, or presenting one that cannot be called back, is a direct breach and one Ofcom has pursued.

That has consequences for the “local presence” feature sold by several US dialling platforms, which shows the recipient a number matching their area code to lift answer rates. In the UK the number you present must be genuinely yours and genuinely reachable. Rotating through a pool of local-looking numbers that do not connect back to you is not a grey area — it is the thing the CLI rules exist to stop.

Dialling from a real SIM sidesteps this entirely: the number you present is a number you hold, and it rings when someone calls it back. That is not a compliance feature so much as a consequence of not putting a virtual number in the middle.

PECR enforcement historically sat under a separate, much lower cap than GDPR. The Data (Use and Access) Act 2025 changed that, bringing PECR penalties into line with UK GDPR levels — meaning the ceiling is now expressed as a percentage of global turnover rather than a fixed low maximum.

In practice the ICO's published enforcement against nuisance-call operators has typically been well below any ceiling, and has often been accompanied by enforcement notices requiring changes to practice. For most businesses the realistic risk is an enforcement notice, reputational damage and the operational cost of rebuilding a compliant process — not a headline fine.

Verify the current penalty ceilings and the commencement position of the Data (Use and Access) Act against ICO guidance before relying on specific figures.