Is Buying Leads Legal in the UK? The Rules for Installers

Buying leads is legal in the UK. What the rules control is how you use and contact them: under PECR you can text or email a bought lead only if their consent named your business, and you can ring them only if their number isn't on the Telephone Preference Service (TPS) and they haven't objected, or they have specifically told your business they want your calls.

Since 5 February 2026, the ICO can fine up to £17.5 million or 4% of a business's worldwide turnover, whichever is higher, for breaking those rules. Before that date the cap was £500,000.

Is buying leads legal in the UK?

Yes. The ICO's guidance on using marketing lists says you can use bought-in lists for live marketing calls if you screen them, and for texts and emails only where the people on the list consented to messages from you.

Buying the lead doesn't buy the supplier's permission, though. The ICO's guidance on collecting information and generating leads says that if you buy personal data, you are responsible for complying with data protection law and PECR, and you must make proportionate checks before you get it. Its guidance on valid consent says consent bought in from someone else is only valid for you if it specifically identified you.

If you've been reading about the TCPA or the FTC: those are US rules. The UK equivalents are PECR (the Privacy and Electronic Communications Regulations 2003) and UK GDPR, and the regulator for both is the ICO.

What are the UK rules for buying leads in 2026?

These are the main rules on using and contacting a bought lead. "Instigate" in the table matters to buyers: the ICO's guide to electronic and telephone marketing says that when a contractor makes calls or sends messages for you, you are both responsible for complying with PECR.

Are the rules different for solar leads and home extension leads?

No. The rules above turn on how you contact someone, not on what you sell, so they are the same for solar leads, home extension leads and every other home-improvement product. PECR's stricter live-call rules cover claims management services and pension schemes (regulation 21(6), and the ICO's live calls guidance), and neither is a home-improvement product.

What differs by product is the ad. The ASA rulings on grant and funding claims below concern solar, energy-scheme and heat pump ads. If you're comparing suppliers, our guides to who sells solar leads and home extension lead suppliers set out each one's published terms.

What changed in 2026?

Three changes from the Data (Use and Access) Act 2025 came into force on 5 February 2026, under the commencement regulations.

• Higher fines. For breaches of PECR's call, text and email rules in regulations 19, 21 and 22, among others, the maximum is now £17.5 million or 4% of a business's total annual worldwide turnover in the previous financial year, whichever is higher. The text is in Schedule 1 to PECR, which applies section 157 of the Data Protection Act 2018, and the ICO's commencement statement gives the same figures. Before, the cap was £500,000, as the ICO's penalty notices set out.
• A call counts even if nobody answers. In PECR, making a call now includes attempting to connect one (section 110 of the Act). The government's factsheet on the PEC Regulations says senders can be fined even if their calls don't connect. That matters if you run a dialler.
• Direct marketing is named as a possible legitimate interest. UK GDPR Article 6(11) now lists processing necessary for direct marketing as an example of what may be a legitimate interest. That's a UK GDPR change. PECR's rules for calls, texts and emails sit in regulations 19 to 22 and still apply.

Conduct before 5 February 2026 is still dealt with under the old PECR rules, regulation 11 of the commencement regulations says. Many of the ICO's pages on calls, texts and marketing lists now carry a notice that they are under review because of the Act.

What lawful basis do you need to use a bought lead under UK GDPR?

Usually consent, sometimes legitimate interests. The ICO's guide to choosing a lawful basis for direct marketing says those are the two most likely, and that PECR can affect which one you use. Its table, applied to a bought lead:

• Texts and emails. PECR needs consent or a soft opt-in, and the ICO's electronic mail guidance says the soft opt-in can't be used for a bought-in list. That leaves consent.
• Live calls to a TPS number. The person must have told you they don't object to your calls. The ICO lists consent as the likely basis.
• Live calls to a number that isn't on the TPS, from someone who hasn't objected: legitimate interests or consent.
• Recorded-message calls: consent.

The ICO says PECR uses the same standard of consent as UK GDPR. Its consent guidance says a consent request must name any third-party controllers who will rely on it. Its guidance on recording consent says to keep who consented, when, how, the wording they saw and whether they've withdrawn, and that consent for categories of third parties isn't specific enough. Consent to hear from a group of installers is exactly that. Our guide to exclusive vs shared leads covers how to check who else a lead went to.

Two more duties come with every bought lead:

• Privacy information. Under Article 14, you must tell the homeowner who you are and how you'll use their data within a reasonable period and at the latest within a month, or at your first contact if that comes sooner.
• Objections. Under Article 21, anyone can object to direct marketing at any time, and you must stop. You must tell them about that right at the latest when you first contact them. The ICO's call guidance says to add them to a do-not-call list rather than delete every record of them. Otherwise nothing stops them coming back on the next list you buy.

Can you call, text or email a purchased lead?

Calls

Regulation 21 of PECR stops you making, or getting someone else to make, a live marketing call to a number on the TPS or the Corporate TPS (CTPS), or to anyone who has told you not to call. The exception, for a TPS number, is a person who has told that caller they don't object. The ICO's live calls guidance says they must take a positive step, and their notification "must contain your name". In the Coastal Windows case below, the ICO said agreement to calls from "selected third parties" or similar generic wording isn't valid.

Every marketing call must show your number, or another number you can be reached on. The caller must give the business's name and, if asked, an address or freephone number (regulations 21(A1) and 24). Recorded-message calls need prior consent to that caller under regulation 19, and the ICO's telephone marketing guide says consent to live calls isn't enough for them.

Texts, emails and messages

Regulation 22 requires consent to that sender for marketing texts and emails to individuals. For a bought list, the ICO's electronic mail guidance says the consent must have named your organisation, not just "trusted partners", and must cover the method you plan to use. If it doesn't, the consent isn't valid, and regulation 22 then rules out sending.

"Electronic mail" is broad. The ICO's guide to electronic mail marketing lists texts, picture and video messages, voicemails, direct messages on social media and "any similar message that is stored electronically". It doesn't name WhatsApp, so plan on the same rules applying to a WhatsApp follow-up.

Does a quote request make the contact solicited?

Most PECR rules apply only to unsolicited marketing. The ICO's guide defines a solicited message as "one that is actively requested", and says an opt-in to future marketing still counts as unsolicited. Even a solicited message must say who it's from, show your number on a call and give a contact address.

We found no ICO guidance on whether a form sent to a lead generator counts as a request to the installer it names. So treat a bought lead as unsolicited and rely on consent that names you. And say why you're calling: one of the ICO's concerns about Coastal Windows was that its callers didn't mention a reason, such as a quote request.

Do you still need to screen bought leads against the TPS?

Yes, unless each lead's consent names you and covers calls. The ICO's live calls guidance says that without that consent you must check every number against the TPS and CTPS, and that if a third party did the check, you should make sure it was recent. A registration can take 28 days to become active, and a number being public, in a directory for example, doesn't override it.

PECR gives callers 28 days' grace for a newly registered number (regulation 21(3)), and the TPS says organisations must screen against its register every 28 days. Registration is free for the public and covers landlines and mobiles.

Screening isn't the whole job. Keep your own do-not-call list and check against it, as the ICO advises. If someone who agreed to your calls withdraws, you must stop calling them (regulation 21(5)).

What should you ask a lead supplier before you buy?

The ICO's lead generation guidance lists checks to make before you buy. A reputable supplier should be able to show you the data is reliable, it says, and you shouldn't use it if they can't. Its guidance for organisations using data brokers adds that simply accepting a supplier's assurances isn't enough.

Here are those checks as questions, each tied to the rule it answers.

If a supplier can't answer the first four, the ICO's guidance points one way: don't use the data. Our guide to how to choose a lead generation company covers the commercial questions, such as exclusivity, returns and price.

What has the ICO fined home-improvement and energy cold callers for?

These cases come from the ICO's own news and enforcement pages. Each concerns calls made before 5 February 2026, so the old rules and the £500,000 cap applied.

Three patterns run through them: calls to TPS numbers without the person's say-so, consent that didn't name the caller, and data bought without checks. In the Home Improvement Marketing and Green Spark Energy case, the ICO reports that the director behind both firms said due diligence checks weren't carried out on data providers.

Thermotech is the case to read if you buy leads. Its notice sets out messages with an overseas contact centre about dialling to generate leads for the business, and invoices to it for hundreds of leads and thousands of data records. The ICO treated Thermotech as the instigator of the calls. A script in the evidence told callers asked how they got the number to say they called people "either not on the TPS or who have opted via a competition website". That is the kind of assurance the ICO's guidance tells you not to take on trust.

In October 2026 the ICO said complaints about automated nuisance calls were at their highest since 2021, and that it had issued 15 penalties for nuisance calls and spam texts since April 2025, totalling £2,370,000.

What do the ad rules say about lead generation and grant claims?

The ad that produced a lead is usually the supplier's, but the homeowner arrives expecting whatever it promised. The ASA's advice on lead generation marketing says marketers must make their commercial intent clear where the context doesn't, should say up front that they are a lead generation company, and that disclaimers or footnotes are unlikely to be enough. It notes rulings against solar ads that implied panels and funding were available directly from the advertiser, and says a marketer offering funding should hold robust evidence that it is genuine and available.

Two rulings show how that applies to grants:

• ECO4U Ltd, trading as Citizens Energy Advice, ruled on 11 December 2024. Its Facebook ads gave the impression of UK Government endorsement and didn't make clear the business was mainly a lead generator passing details to installers. The ASA upheld both points under CAP Code rules 2.3, 3.1, 3.7 and 3.50.
• Aira Home UK Ltd, ruled on 6 August 2025. A heat pump ad said a £7,500 grant was available without saying eligibility criteria applied. The ASA upheld it under rules 3.1, 3.3 and 3.9 and said future ads for government heat pump grants must state that eligibility conditions apply.

So ask to see the ad. If it mentions ECO4, a grant or anything "free", ask what evidence sits behind the claim and whether the ad says eligibility conditions apply. We haven't covered ECO4 or Boiler Upgrade Scheme eligibility here: check the scheme's own pages, not the ad.

When is buying leads the wrong move?

Buying leads is the wrong move when you can't use what you've bought:

• You plan to text or email, and the consent doesn't name you. Under regulation 22 you can't send.
• The supplier won't show you the consent wording, the record or the ad. The ICO says not to use data you aren't satisfied about.
• The leads come from cold calls. If they were made for you, you can be the instigator, as Thermotech was.
• Your offer depends on a grant you can't promise. The homeowner clicked an ad that set an expectation your surveyor will have to correct.

Where POCKLA fits

POCKLA sells qualified web leads to UK home-improvement installers. You pay per lead, with no setup fee, no monthly fee and no minimum term; our pricing page explains the model. On every lead, the homeowner's consent names you as the business they'll hear from, and the wording and the time are stored with it. Each lead goes to the buyer named in its consent, handled under UK GDPR.

Follow-up runs on WhatsApp or SMS, and leads arrive in your CRM or POCKLA Desk; our guide to WhatsApp lead follow-up covers how that works. The checklist above applies to us as much as anyone: ask us to show you the consent wording before you buy, and take this article's table to your own adviser.