Checked on 5 November 2026 against the ICO’s guidance on direct marketing by electronic mail and PECR regulation 23. The ICO doesn’t write specifically for authors, so applying it to reader magnets and swaps is our reading. This is general information, not legal advice.
Quick Answer: To email UK readers about your books you need their consent, or the “soft opt-in” if they gave you their address while buying from you or asking to buy. Consent must be clear and specific, with no pre-ticked boxes. Every email must say who it’s from and give a way to unsubscribe. Don’t buy lists. The law applies to you, not your email platform, even with a small list.
The two laws
- PECR (the Privacy and Electronic Communications Regulations) sets the rules for marketing by email.
- UK GDPR sets the rules for handling personal information, which includes names and email addresses.
The ICO regulates both. Size doesn’t exempt you. PECR “applies to anyone who sends or instigates the sending of direct marketing by electronic mail”. A newsletter telling readers about your book is marketing.
When you can email someone
| Who | Can you email them? | Why |
|---|---|---|
| Asked to join your list, with clear wording | Yes | Consent |
| Bought directly from your website, and was offered an opt-out at the time | Yes, about your similar books | Soft opt-in |
| Asked you about buying your book | Probably yes, about your similar books, with an opt-out | Soft opt-in |
| Bought your book on Amazon | Not because of that sale | You didn’t collect their details |
| Gave you a card at an event | Only if they agreed to emails | Consent |
| Came from a bought list | Almost never | See below |
| Another author’s subscriber | No, not from your own list | Consent doesn’t transfer |
What real consent looks like
From the ICO’s guidance, you must:
- give people a free choice, kept separate from other things such as terms and conditions;
- make clear the consent covers your email marketing, and give your name;
- use a positive action: “you must not use pre-ticked opt-in boxes, silence or inactivity”;
- keep a record of who consented, when and how. Most email platforms store this for you, but check.
Sign-up wording can be this simple:
Join [Author name]'s newsletter. I'll email you about new books, offers and news, about once a month. Unsubscribe at any time. Privacy notice: [link]Reader magnets: can you swap a free book for an email?
This is the question most authors have, and the ICO has no page on it. Here is what it does say.
On incentives, the ICO’s view on valid consent is that “it may still be possible to incentivise consent to some extent”, and it gives a loyalty scheme with money-off vouchers as an example. But “you must be careful not to cross the line and unfairly penalise those who refuse consent”.
On conditions, it says consent is unlikely to be valid if you make agreeing to marketing a necessary condition for buying your product.
Our reading: a free story offered for joining a newsletter looks like an incentive, not a penalty, since nobody loses anything by saying no. Say plainly on the form that they’re joining your newsletter, not just getting a download. Don’t hide it, and don’t take the address for one thing and use it for another. For the practical side, see reader magnets.
The cautious option is a separate, unticked box for the newsletter, and the free book either way. Fewer people will join, but it’s the cleanest consent.
The soft opt-in
You can email without consent only if all of these are true:
- You obtained the address directly from the person.
- You did so while selling, or negotiating to sell, a product or service. The ICO says the person doesn’t need to buy, but must “actively express an interest in buying”. Browsing isn’t enough.
- You only market your own similar products and services.
- You gave them a chance to opt out when you collected their address.
- You give them a chance to opt out in every email.
So if you sell direct, tick the opt-out at checkout. It doesn’t cover promoting someone else’s book, and it never covers a list collected by someone else: “There is no such thing as a third-party marketing list that is compliant with the soft opt-in.”
Bought lists and newsletter swaps
Bought lists. The people on it must have validly consented to marketing from you. “If the consent doesn’t name you” or doesn’t cover the method, “it is not valid”. A list of “book lovers” won’t have that, so don’t buy one.
Swaps and promos. When another author mentions your book to their own list, they send it to people who agreed to hear from them. Check two things. Your partner’s sign-up should cover recommendations. And the ICO says if you ask another organisation to send your marketing, you “may still be responsible under PECR as the instigator”. Never swap the subscriber addresses themselves. See newsletter swaps.
Bookshops and bloggers. You can email a corporate subscriber, such as a limited company’s address, without consent. The ICO says the consent rules still cover individual subscribers, “this includes sole traders and ordinary partnerships”. Many book bloggers fall into that group. A personal pitch is still marketing if it promotes your book, so keep it relevant, and honour any request to stop.
What every email needs
PECR regulation 23 bans marketing email where your identity is “disguised or concealed”, or where there’s no “valid address” for asking you to stop.
- Send under your real author or business name.
- Include a working unsubscribe link in every email.
- When someone opts out, stop. The ICO says people can change their mind at any time.
In our reading, a pen name is fine for marketing, as long as your privacy notice says who is actually responsible.
Your platform doesn’t do this for you
The ICO says using a bulk-email platform “does not normally make that service responsible… You remain responsible for complying with PECR.” The platform gives you the tools. The choices are yours. Compare them in our newsletter platform comparison.
Under UK GDPR you also need to:
- Publish a privacy notice that says who you are, what you collect, why, how long you keep it and who handles it. A page on your author website will do.
- Have a contract with your email platform. The ICO says this is needed when another organisation handles personal information for you. It’s normally part of the platform’s terms, so check.
- Handle complaints. Under the Data (Use and Access) Act 2025, the ICO says you must help people make data protection complaints, acknowledge them within 30 days and respond without undue delay. A contact address is a start.
- Remove people when they ask.
Readers outside the UK may have their own rules. Lists with many EU readers are worth extra care.
Do authors have to pay the ICO fee?
The ICO says “organisations (including sole traders) that use personal information need to pay a data protection fee, unless they are exempt”. GOV.UK says the fee is £52 or £78 for most organisations.
The regulations do have an exemption. Processing “for the purposes of advertising, marketing and public relations in respect of the data controller’s business, activity, goods or services” counts as exempt processing, as does keeping accounts and records of sales. You owe nothing only if all your processing is exempt.
So an author who only runs their own book newsletter and keeps accounts may be exempt. Coaching clients, editing for others or holding other people’s data could change that. Don’t guess: the ICO’s self-assessment takes about 10 minutes.
Frequently asked questions
Does GDPR apply to a small author newsletter?
Yes. PECR applies to anyone who sends direct marketing by email, and there’s no minimum list size.
Can I add people who bought my book on Amazon?
If you don’t have their address from them, no. The soft opt-in only applies to details you collected directly from the person, during a sale or negotiation.
Can I email my friends and family about my book?
Personal messages to people you know are not the same as a mailing list. But don’t add them to a marketing list unless they’ve agreed.
Do I need double opt-in?
The ICO’s guidance doesn’t require it. It does ask you to be able to show who consented, when and how. Double opt-in is a useful way to show it, and helps keep typos and fake addresses off your list.
Can I use a list from my old job or another business?
Not unless those people agreed to hear from you about your books. Consent is specific, and a list built for something else won’t normally cover it.
Do I have to pay the ICO to run a newsletter?
Perhaps not, as marketing your own business is exempt processing. It depends on everything else you do with personal data, so use the ICO’s self-assessment.
