UK nuisance-call and spam-text statistics: official annual PECR penalties, call and text concerns, dated enforcement cases and Ofcom research on suspicious messages.

PECR regulates electronic marketing and works alongside data protection law. This page distinguishes the ICO’s financial-year enforcement and complaint totals from individual campaigns and Ofcom consumer research. These sources measure different aspects of unwanted contact and should not be added together.

Key facts and figures

  • £1.445 million in PECR monetary penalties was recorded by the ICO in 2025/26, across all PECR cases rather than calls alone.
  • £17.5 million or 4% of worldwide annual turnover, whichever is higher, is the higher PECR penalty maximum from 5 February 2026. The fixed sterling cap was previously £500,000.
  • 10 PECR monetary penalty notices were recorded in the ICO’s 2025/26 annual report.
  • 48,395 concerns about telesales calls and texts were submitted through the ICO’s online reporting tool in 2025/26.
  • 40% of UK mobile users reported a suspicious mobile message in the previous three months in Ofcom’s February 2026 survey.
  • 4,046,947 marketing texts earned Allay Claims Ltd a £120,000 PECR fine in January 2026, generating over 46,000 spam reports.
  • 67.7 million marketing emails sent without valid consent led to a £105,000 fine for ZMLUK Ltd in January 2026.
  • 100 million suspicious messages were estimated to have been reported through 7726 in a year in Ofcom’s October 2025 release.

Checked on 15 October 2026. Annual ICO figures cover April 2025–March 2026; individual penalties and Ofcom surveys have their own dates. A complaint, a message and a monetary penalty are different units.

How much has the ICO fined companies for nuisance calls and spam texts?

The ICO’s 2025/26 annual report records ten PECR monetary penalty notices totalling £1,445,000. This is a financial-year total across PECR enforcement, not a cumulative total of nuisance-call fines. Individual notices below illustrate the conduct penalised and should not be treated as the complete annual list.

The same annual report records ten PECR enforcement notices. Enforcement notices and monetary penalty notices are different actions and may concern the same organisation. PECR rules and the UK GDPR can both apply to a marketing campaign, so these are related legal regimes rather than mutually exclusive kinds of incident.

What is the maximum fine for breaching PECR in the UK?

From 5 February 2026, the maximum PECR monetary penalty is £17.5 million or 4% of total worldwide annual turnover, whichever is higher, following commencement of the relevant Data (Use and Access) Act provisions. The previous fixed maximum was £500,000. Transitional rules and the dates of the conduct matter when interpreting individual notices.

A statutory maximum is not a standard fine. The ICO considers the circumstances and applicable law in each case. For example, the Energy Prices Direct notice dated 30 March 2026 concerns calls made in 2024–25 and applies the earlier penalty framework; its issue date alone does not identify the applicable cap.

What are some recent PECR fines?

These selected notices and announcements show the scale and type of unlawful marketing. Dates distinguish the Energy Prices Direct notice from public announcements; the table is not a ranking or an exhaustive list of the latest enforcement action.

FineOrganisationNotice / announcementWhat happened
£160,000Energy Prices Direct Ltd30 March 2026 notice704,501 calls to numbers registered with TPS or CTPS for more than 28 days, between 23 January 2024 and 23 January 2025.
£240,000Outsource Strategies LtdAnnounced April 20241,346,503 unwanted marketing calls to TPS-registered "do not call" numbers.
£120,000Allay Claims LtdJanuary 20264,046,947 marketing texts, generating more than 46,000 complaints via the 7726 service.
£105,000ZMLUK Ltd (formerly Zuru Media)January 202667,772,285 marketing emails without valid consent; announced alongside the separate £120,000 Allay fine.
£140,000HelloFreshAnnounced January 202479,779,279 emails and 1,113,734 texts sent between 23 August 2021 and 23 February 2022 without valid consent.
£100,000Dr Telemarketing LtdAnnounced April 2024Separate £100,000 fine announced alongside Outsource Strategies; the two fines totalled £340,000.

Campaign volumes can be substantial: ZMLUK’s case involved nearly 68 million emails, while HelloFresh’s involved almost 80 million emails and 1.1 million texts. These are messages sent, not necessarily distinct recipients. A fine is determined by more than the number of messages alone.

Do TPS-registered numbers still get marketing calls?

Yes. The two fines announced in April 2024 concerned almost 1.43 million unwanted calls, including 1,346,503 by Outsource Strategies. For most live marketing calls, callers must screen against TPS or CTPS and their own suppression lists. Registration can take 28 days to become effective; specific permission can allow calls despite registration, while some sectors have stricter rules.

TPS registration is free and can reduce unsolicited live marketing calls. It does not guarantee that all unwanted or fraudulent calls will stop. Do not infer that an overseas or spoofed call is automatically outside every UK rule: jurisdiction and enforcement depend on the circumstances. Suspicious messages and call numbers can also be reported to the mobile network through 7726.

How many nuisance-call complaints does the ICO receive each year?

The ICO recorded 48,395 concerns about telesales calls and texts through its online reporting tool in 2025/26, compared with 49,494 in 2024/25. This combined measure is not a calls-only total or a count of all unwanted contacts received by the public.

The annual report separately records 24,710 concerns about unsolicited marketing emails in 2025/26. Reports reflect what people notice and choose to submit, and one campaign can generate many reports. They do not measure unique victims or prove the number of unlawful campaigns.

How big is the spam-text and marketing-email problem?

The ZMLUK case involved 67,772,285 emails and a £105,000 fine. Allay Claims received a separate £120,000 fine for 4,046,947 texts sent between February 2023 and February 2024; more than 46,000 spam reports were recorded for that campaign. Both fines were announced in January 2026.

HelloFresh’s £140,000 fine was announced in January 2024 for messages sent in 2021–22, with 8,729 reports through 7726. PECR normally requires consent for marketing electronic mail to individual subscribers, subject to specific products-and-services or charitable-purpose soft opt-in conditions. Corporate subscribers have different rules; data protection obligations may also apply.

How common are scam calls and texts in the UK?

Ofcom’s February 2026 survey found that 40% of UK mobile users had received at least one suspicious SMS, RCS or iMessage in the previous three months. Its October 2025 release separately estimated about 100 million messages reported through 7726 over a year. Survey respondents and network reports are different measures and should not be compared as counts of victims.

Suspicious communications, fraud and unlawful marketing overlap but are not interchangeable. Ofcom’s consumer research measures reported experiences, while the ICO figures concern its regulatory work. Neither series supplies a complete count of scams or proves that every suspicious message breached PECR.

Frequently asked questions

How much has the ICO fined companies for nuisance calls and spam texts?

The ICO recorded ten PECR monetary penalty notices totalling £1.445 million in 2025/26. This covers PECR enforcement generally, not calls alone. Selected individual cases include Energy Prices Direct, Allay Claims and ZMLUK, with notice or announcement dates given in the table.

What is the maximum fine for breaching PECR in the UK?

The maximum is £17.5 million or 4% of total worldwide annual turnover, whichever is higher, from 5 February 2026. The applicable framework for an individual case also depends on the conduct dates and transitional rules.

How many nuisance-call complaints does the ICO receive each year?

The ICO’s online reporting tool received 48,395 concerns about telesales calls and texts in 2025/26, compared with 49,494 the year before. This combined category is not a calls-only total or a count of unique victims.

Do TPS-registered numbers still get marketing calls?

Yes. TPS registration can reduce unsolicited live marketing calls but cannot guarantee that they stop. It is free; registration can take 28 days to become effective. Organisations must also respect direct objections, and some types of marketing call have stricter consent rules.

What is the difference between PECR fines and UK GDPR fines?

PECR regulates matters including electronic marketing and cookies. The UK GDPR governs processing of personal data, including security and lawful use. Both may apply to the same campaign, and the ICO reports different types of regulatory action separately.

What is the 7726 spam-reporting service?

7726 is a free reporting service available through most UK mobile networks for suspicious texts and call numbers. Reports help networks investigate and block abuse. Ofcom’s October 2025 release estimated about 100 million messages reported over a year; that is a report count, not a count of unique victims.

Sources & references

Marketing by phone, text and email is only lawful if your team understands consent, the TPS and PECR. Train them in UK data protection and stay off the ICO's enforcement list.

Explore the GDPR & Data Protection Course →
Mark McShane
Mark McShane
Health & Safety Training Specialist, Online CPD Academy

Mark writes about data protection, GDPR compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.