Why companies and law firms in the bulk-claims market need an evidence trail from the first advert to the signed retainer
The lead generator sent the text. Can your business prove the consent?
If a complaint arrives about an unsolicited text, email or telephone call, there is an understandable first response: “We did not send it. The lead generator did.”
This may be factually correct, but it may also be only the beginning of the conversation. For organisations operating in the high-volume consumer-claims market, client acquisition often involves several businesses. An advert produces an enquiry. A marketing company captures the details. A lead generator qualifies the response. A claims management company may sit in the middle. Eventually, the lead reaches the business or law firm that hopes to act.
The model can make sense from a commercial perspective. However, from a regulatory perspective, it creates a chain of responsibility rather than a clean break.
Why this matters now
In July 2026, the ICO announced that it had executed search warrants at residential and business premises linked to five companies as part of an investigation into suspected nuisance marketing concerning car-finance claims. The regulator said that more than 12 million complaints had been made since September 2025 and the companies under investigation were believed to be responsible for a combined 170 million text messages.
The ICO's action followed the creation of a joint motor-finance taskforce involving the ICO, Financial Conduct Authority, Advertising Standards Authority and Solicitors Regulation Authority. The taskforce is addressing issues including unsolicited and misleading marketing, meritless claims, multiple representation and unfair exit fees.
Motor finance may be the immediate catalyst, but the underlying issue is wider. High-volume claims now operate across housing disrepair, diesel emissions, data breaches, financial services and other consumer-redress work. The SRA said in October 2026 that it had 107 live investigations involving 70 firms managing high-volume consumer claims. The investigations are not all about marketing, and they should not be conflated with ICO cases, but they demonstrate the level of regulatory attention currently directed at the sector.
At the same time, the financial consequences of PECR enforcement have changed dramatically. The Data (Use and Access) Act 2025 brought PECR enforcement broadly into line with the UK GDPR regime. The present maximum is up to £17.5 million or 4% of global annual turnover, rather than the historic £500,000 ceiling. The reform package also strengthened the regulator’s investigative toolkit, including powers to compel witness attendance and require reports from approved persons.
The message is clear: direct marketing is no longer a peripheral compliance issue for the marketing department. In the volume-claims sector, it is a board-level regulatory risk.
Outsourcing the message does not necessarily outsource responsibility
PECR applies not only to someone who physically sends an electronic marketing message, but also to a person who instigates it.
The ICO’s guidance says that a business is likely to be instigating marketing where it encourages, incentivises or asks another organisation to send messages containing its marketing. The sender and the instigator may both be responsible. A bulk-email platform providing only technical delivery is in a different position, but the business commissioning or benefiting from the campaign cannot assume that the contract has transferred the regulatory risk.
The distinction is especially important where a law firm or claims business buys leads rather than commissioning a named campaign. A “lead” is not a legal category. It is simply a bundle of information accompanied by a claim about how that information was obtained. The real questions are:
- What did the individual see?
- What were they told would happen to their details?
- Which organisations were named?
- Which method of contact did they agree to?
- Was there a positive opt-in?
- When was it obtained?
- Can the original evidence still be produced?
A spreadsheet containing a column marked “consent: yes” may tell a purchaser what the supplier says. It does not necessarily prove what the consumer agreed to. Each hand-off needs evidence. Outsourcing delivery does not necessarily outsource responsibility.
The ICO / PECR Evidence Trail
1 Advert or landing page
Evidence: Source URL and form version
↓
2 Consent and affirmative action
Evidence: Exact wording and channel-specific consent
↓
3 Timestamped lead record
Evidence: Date, source, and audit log
↓
4 Transfer by lead generator or CMC
Evidence: Named recipient and transfer details
↓
5 SMS, email or telephone contact
Evidence: Suppression checks and contact record
↓
6 Onboarding and signed retainer
Evidence: Audit trail, client confirmation and key documents
Consent needs evidence, not adjectives
Marketing lists are regularly described as “fully opted in”, “GDPR compliant”, “verified” or “exclusive”. Those descriptions are reassuring, but they are not evidence in themselves.
For unsolicited emails and texts to individuals, PECR generally requires valid consent unless the tightly defined “soft opt-in” applies. Consent must be freely given, specific, informed and unambiguous. It must cover the particular organisation and the method of contact being used.
For bought-in lists, the ICO says the consent should name the organisation that will market to the individual, cover the relevant channel and be supported by evidence showing who consented, when and how. A reference to “selected partners”, or a long list presented without genuine choice, may not be sufficient.
The soft opt-in is not usually an escape route for purchased leads. It depends on the organisation obtaining the details directly during a sale or negotiations for a sale, marketing its own similar products or services, and giving an opt-out both when the details are collected and in every later message. The ICO’s current guidance is explicit that there is no such thing as a third-party marketing list that is “soft opt-in compliant”.
Telephone marketing needs equally careful analysis. The precise rule depends on the type of call, but live calls about claims-management services require consent. A legitimate-interests assessment under the UK GDPR does not remove a separate PECR requirement for consent.
Nor will changing the label necessarily change the substance. In January 2026, the ICO fined a claims business after finding that texts described as service updates were actually promotional messages intended to generate further claims. The regulator examines what the communication was designed to achieve, not simply what the sender called it.
For law firms, there is a second regulatory question
An alleged PECR breach does not automatically become an SRA case. The regulators have different statutory functions, and many ICO investigations will remain data-protection matters only.
However, the crossover risk is real where the evidence raises questions about how a firm acquired clients, supervised third parties or monitored its systems.
The SRA’s warning notice on marketing legal services says that firms must ensure that clients referred by an introducer were not acquired in a way that would breach the SRA’s arrangements if the introducer were regulated. Firms should be satisfied that any consent obtained through a third party genuinely authorised contact about legal services. They should also conduct regular spot checks and understand how new clients reached the firm.
In other words, stating that “the introducer is not an SRA-regulated business” is not a complete answer.
The ICO may ask whether a message was lawfully sent or instigated. The SRA may ask whether the firm had effective governance, systems and controls; whether its publicity was accurate; whether it understood the client-acquisition process; and whether it kept records demonstrating compliance. The same underlying evidence may therefore matter to both regulators, even though the legal tests are different.
What happens when an ICO enquiry becomes an investigation?
There is no single, automatic sequence. Some matters begin with correspondence and end with an explanation or remedial action. Others develop through information requirements, interviews, enforcement notices, or monetary penalties.
The key mistake is to treat the regulator’s first letter as a customer service complaint.
An early request may require the business to identify campaigns, suppliers, datasets, consent mechanisms, scripts, landing pages, contracts, complaints and opt-outs. The answer can define the scope of everything that follows. An incomplete response, an unsupported assertion or the accidental destruction of records may create difficulties beyond the original allegation.
In more serious cases, the regulator can seek a search warrant. The ICO’s July 2026 announcement expressly referred to the seizure of items such as mobile phones, laptops and SIM farms during PECR investigations. A search can create immediate questions about business continuity, personal devices, irrelevant third-party information, confidential material and legal professional privilege.
That is why investigation strategy matters. The aim is not to obstruct the regulator. It is to cooperate accurately while preserving the organisation’s legal position, identifying the proper scope of compulsory demands and protecting material that should not form part of the investigative review.
If it came to it, could you answer these questions today?
Businesses dependent on volume acquisition should test their systems before the first regulatory letter arrives:
- Can we reproduce the exact advert, landing page and consent wording seen by an individual?
- Do we know when and how each lead was created, rather than merely when we bought it?
- Was our organisation named, and did the consent cover text, email or telephone contact?
- Can we identify every business that handled the data before it reached us?
- Do our contracts provide audit rights, warranties, complaint information and access to underlying consent records?
- Do we check samples ourselves and ask new clients how they were first approached?
- Are opt-outs and objections applied across our own systems and relevant suppliers?
- If challenged, can we preserve and retrieve the evidence quickly?
A contractual warranty is useful. An auditable record is much better.
How JMW can help
JMW’s regulatory team advises businesses, claims organisations and law firms facing ICO investigations and related professional-regulatory issues. We can assist with early investigation strategy, information requirements, preservation and review of evidence, representations, PECR enforcement, interviews, search warrants, seized material, privilege and any connected SRA exposure.
The most valuable advice is often obtained before the organisation commits itself to a factual or legal position. When the issue concerns millions of messages, multiple suppliers, and several regulatory regimes, the first response should be treated as part of the defence, not as an administrative reply.
Evan Wright is a partner and barrister in JMW's professional regulation team. He is also a legal advisor to regulatory panels, a Law Society certified Lexcel consultant and a civil and commercial mediator. He historically and currently acts in bulk claim cases under investigation by the ICO and SRA.
