Car finance mis-selling claims: ICO taskforce warns firms over nuisance marketing

The Information Commissioner’s Office (ICO) protects data privacy and ensures public bodies are open and transparent.

On 30th July 2026, the ICO announced that they are working alongside the Financial Conduct Authority (FCA), the Advertising Standards Authority (ASA) and the Solicitors Regulation Authority (SRA) in relation to suspected nuisance marketing linked to car finance mis-selling claims.

On the 28th July 2026, search warrants obtained by the ICO targeted residential and business premises linked to five companies across Bolton, Burnley, Liverpool, London and Swansea. These companies are believed to have sent 170 million text messages to members of the public between September 2025 and May 2026.

The ICO believes the calls may be unwanted, aggressive and may cause serious harm, resulting in a loss of trust from the public.

PECR responsibilities

The ICO is urging companies in the claims management sector to ensure they are complying with Privacy and Electronic Communications Regulations (PECR). PECR sits alongside the Data Protection Act and UK GDPR, giving specific privacy rights in relation to electronic communications.

PECR applies to you if you provide a public electronic communications network or service, but even if you are not, PECR will apply to you if you:

• market by phone, email, text or fax;
• use cookies or a similar technology on your website; or
• compile a telephone directory (or a similar public directory)

Service providers have the primary responsibility for compliance with PECR.

How to comply with PECR

As set out by the ICO, the following guidelines provide an overview of actions service providers must take, in order to comply with PECR rules:

• You must consider storage or access technologies as part of the design and implementation of your service and business practices.
• You must have appropriate arrangements in place with any third parties you are using to provide your service.
• In general, you must provide clear and comprehensive information about the storage and access technologies you use.
• PECR has some exceptions that mean you don’t have to provide this in certain cases. But if your storage and access involves processing personal data, you must provide it anyway. 
• You must explain your storage and access technologies in a way that anyone visiting your service can understand.
• You must not pre-enable non-exempt storage and access technologies. 
• PECR does not specify how long you can use any storage and access technologies for. You should consider the appropriate duration in relation to the circumstances of your online service and for the purpose for which you want to use the technology.
• You should undertake regular reviews of your online service, as well as any storage and access technologies it includes.

Stakeholder commentary

Andy Curry, Head of Investigations at the ICO, said: “People are fed up with being bombarded by unwanted calls, texts and emails about car finance claims, and we’re taking action.” He added that the searches “send a clear message to the claims management sector: comply with the law or expect to hear from us.”

Alison Walters, Director of Consumer Finance at the FCA, said: “Firms that misuse people’s personal information or use aggressive marketing can cause serious harm and damage trust.” She said the joint taskforce is sharing information to protect consumers and improve standards across the sector, and that the FCA will not hesitate to act with its regulatory partners where firms break the rules.

The Advertising Standards Authority’s involvement also underlines the wider concern that car finance claims advertising should be clear, transparent and not misleading. The regulatory focus is therefore not limited to data privacy: it also extends to the way claims are presented to consumers, including whether adverts create unrealistic expectations, obscure fees or fail to explain available alternatives.

Regulatory Enforcement

If you receive complaints about your electronic marketing, you may be investigated in relation to your compliance with PECR. If you have failed to comply with the regulations, you may be asked to remedy this. Enforcement action may be taken, which can include criminal prosecution, non-criminal enforcement and audit. The Information Commissioner can also serve a monetary penalty notice imposing a fine of up to £500,000, which can be issued against the organisation or its directors. These powers can be used in combination where justified.

This blog was co-authored by Olivia Gregson and Evan Wright.