A family booking form can contain an adult’s email address, a child’s name and information needed to run an activity. That does not make the whole record suitable for an email-marketing list. A careful check before import can give your campaign team a useful audience without bringing unnecessary children’s information along with it.
For UK email marketing, begin with three questions: whose information is this, why was it collected, and what permission supports the proposed message? The answers are more useful than a field labelled “parent”.
Separate the contact from the child’s record
Imagine a charity running family activity sessions. A parent provides an email address for booking confirmations and details about their child’s support needs. Later, a fundraising team wants to send an appeal.
The booking address is not, by itself, evidence that fundraising emails are permitted. Nor does the campaign team necessarily need the child’s name, health information or attendance history to communicate with the adult.
An adult’s inbox does not make every detail in the record adult data. Map the proposed use of each field, not just the address that receives the message. Personal information about a child needs protection even when the email goes to a parent.
Keep operational records separate from the information needed for marketing. A parent’s own, lawfully collected communication preference may be enough for a relevant adult-facing campaign; a detailed family profile may add risk without adding value.
Check the marketing permission separately
UK GDPR governs how you use personal information. PECR adds rules for electronic marketing. Having a UK GDPR lawful basis does not, on its own, give you permission to send an email.
For unsolicited marketing emails to individual subscribers, you need valid consent or must satisfy every condition of an applicable soft opt-in. Individual subscribers include sole traders and some partnerships, so a business context is not an automatic exemption.
The two soft opt-ins have different conditions:
- Products and services: you obtained the details directly during a sale or negotiations for a sale, market your own similar products or services, and offered an opt-out when collecting the details and in every subsequent message.
- Charitable purposes: a qualifying charity obtained the details directly when someone expressed interest in, or offered or provided support for, its charitable purposes. The marketing must solely further those purposes, with an opt-out at collection and in every subsequent message. This route only covers details collected on or after 5 February 2026.
Neither route is blanket permission to market to children or to turn beneficiary records into a fundraising list. Check the actual interaction and safeguards. A service registration is not automatically an expression of charitable support.
Purely administrative emails are different from promotions. Keep booking confirmations and essential service updates focused on their purpose; adding an offer can make a message direct marketing. Our UK GDPR email-marketing checklist covers the wider relationship between data protection and sending permissions.
Do not turn age rules into a blanket requirement
The ICO’s Children’s Code applies to relevant online services, known as information society services, that are likely to be accessed by under-18s. It is not limited to services deliberately aimed at children, but neither does selling a product used by children automatically put every activity of a business within the code.
There is also a specific consent rule. Where an online service is offered directly to a child and relies on consent for processing, a child under 13 needs consent given or authorised by someone with parental responsibility, with reasonable efforts to verify that parental consent. Preventive or counselling services have an exception.
This is not a rule that all processing of under-13s always needs parental consent. Nor does reaching 13 remove the protections children need. Have the person responsible for data protection assess your actual service, lawful basis and audience rather than applying one age threshold to every database.
An adult’s inbox does not make every detail in the record adult data.
Assess the risks before using children’s information
The ICO’s current guidance says that if you plan to use children’s personal information for direct marketing, you must complete a data protection impact assessment, or DPIA. This is a structured check of the intended use, the risks to children and the safeguards needed, not simply a security checklist.
Consider whether the campaign could exploit a child’s limited understanding, reveal sensitive information or encourage decisions against their interests. Where special category data, such as health information, is involved, a separate processing condition is needed as well as a lawful basis.
For services covered by the Children’s Code, profiling options should be off by default unless there is a compelling reason, taking account of the child’s best interests. An available segment is not automatically an appropriate audience.
Collect proportionate evidence, not a second database
Age assurance should reflect the risks and the certainty your service needs. Do not assume every contact must upload identification or provide a full date of birth. Equally, do not assume a simple age declaration is sufficient in every situation.
For in-scope services, the code allows proportionate age assurance or applying its protections to all users. That does not override separate access restrictions or make every service suitable for children.
Limit collection, access and retention to what is necessary. Information gathered to check age should not simply become birthday-offer targeting data. Explain your use of information clearly and in language children can understand where they are the audience.
Make one import pass these checks
Before the next campaign import, ask the campaign owner and data-protection lead to confirm:
- Whose data each field contains and why marketing needs it.
- The UK GDPR lawful basis and the applicable PECR permission route.
- Whether a DPIA, child-specific safeguards or age assurance are required.
- Which fields should stay out of the campaign system, who can access the remainder and when they will be deleted.
- How objections and opt-outs will stop future marketing, including related profiling.
Children have an absolute right to object to direct marketing, just as adults do. Make that right understandable and ensure the process works across connected lists and teams.
If a record cannot pass those checks, hold it out of the campaign until the uncertainty is resolved. A smaller, properly understood audience is a sound starting point. It lets your team concentrate on useful communication rather than discovering the missing permission after the send.
The WizEmail Team
