Refer-a-friend and app invites under PECR

If your app or website encourages users to email their friends or contacts, you are probably the instigator of those emails under PECR, and you are responsible for them. For individual subscribers that means you need their consent, which guidance from the ICO (now the Information Commission) says is unlikely to be possible for refer a friend schemes. The compliant pattern is to give the user a personal link or code and let them decide whether, how and in what words to share it. Invites sent by you are only realistic for corporate subscriber addresses.

Sending versus instigating

PECR applies to anyone who sends or instigates electronic mail marketing. ICO guidance on electronic mail marketing, updated on 28 April 2026, says you are likely to be instigating if you encourage, incite, incentivise or ask someone else to send electronic mail containing your direct marketing. You do not need to offer an incentive for this to apply.

The ICO (now the Information Commission, since 30 September 2026) also says in its Plan direct marketing guidance that an instigator can be liable even if it does not send the message itself or does not hold the contact details.

What the ICO says about refer a friend

On refer a friend, tell a friend and viral marketing, ICO guidance is clear on three points:

• if you encourage people to send these messages, you are likely to be instigating them;
• you must not rely on the soft opt-in for these schemes;
• you must obtain valid consent from the recipient, which is unlikely to be possible in practice.

The ICO Guide to PECR goes further and advises against asking users for their friends’ contact details and then messaging them.

Two ICO examples

Not compliant: a retailer automatically creates a marketing email for a customer to send to friends or family. The retailer is the instigator, so the message breaches PECR if the recipients have not consented.

Compliant: a company explains its referral code but does not tell the customer how to share it or suggest that they send emails or texts. It is up to the customer whether and how to take part. The company is then not responsible for those messages under PECR.

How this applies to app invites

Many apps import a user’s address book and offer to invite everyone. If your app prompts the invite, writes the message or sends it, especially in bulk, you are very likely the sender or instigator. An invite promoting your app is very likely direct marketing.

Enforcement shows the regulator looks at who drives the message. In its penalty notice against This Is The Big Deal Ltd, the ICO treated the company as the instigator of emails sent by affiliates, because it supplied the creative and paid per sale. That was positive encouragement, more than merely facilitating.

A compliant invite pattern

1. When a user wants to invite a contact, check the address before anything is sent.
2. Corporate subscriber: you may send an invite that identifies you, explains why the person is receiving it, includes a one click opt-out and is logged against an audit record. Let the user choose each contact. Avoid “invite all”.
3. Anything else (webmail, sole traders, unknown domains, dissolved companies): send nothing from your system. Show the user their personal referral link or code with a share option, and do not prompt them to send emails or texts or pre-write the message.
4. Keep a suppression list and check it on every invite, including domain level opt-outs.

PECR Check is built for step one. A single API call returns a verdict such as CORPORATE_SUBSCRIBER or INDIVIDUAL_SUBSCRIBER, a recommended action and an audit ID, so your app can branch between sending an invite and showing a share link.

Remember UK GDPR

For corporate subscribers, an unsolicited invite to a named employee still involves personal data. You need a lawful basis (usually legitimate interests, with a documented assessment), privacy information and an easy way to object. Low volumes, a clear sender identity and a simple opt-out all help the balance. PECR Check gives you a classification with evidence, not legal advice, so take advice on your own flow.