Refer-A-Friend Emails: When Your Business Is Responsible

Referral offers can be a useful way to grow an online retail business, but the legal risk often sits in the detail of how the message gets sent. Under the rules on electronic mail marketing, the key question is not simply whether a customer presses send from their own phone or inbox. The real issue is whether your business has actively encouraged or facilitated that marketing message in a way that makes it responsible for it.

That distinction matters because a friend's email address or mobile number cannot simply be treated as consent to receive your marketing. The Information Commissioner's Office takes a specific approach to refer-a-friend schemes, and it does not let businesses fall back on the soft opt-in for these messages. In practice, this means a retailer needs to assess the actual journey before launch: the buttons, page wording, any pre-filled messages, any address collection, and any rewards.

When Does A Referral Message Become Your Business's Responsibility?

The most useful starting point is the ICO's idea of instigation. If your business actively encourages someone to send marketing emails or texts to friends or family, you are likely to be instigating those messages. If you are instigating them, you need to comply with the PECR electronic mail marketing rules.

This point often catches retailers out because they assume the customer is the sender, so the risk sits with the customer. That is not how the regulator approaches it. A message can still be your business's marketing even if it is technically sent from the customer's own account or device.

The ICO also makes clear that you do not need to offer a reward for instigation to exist. A discount, voucher or account credit may make the commercial purpose obvious, but the absence of an incentive does not solve the problem. Active encouragement on its own can be enough.

For an online retailer, signs of likely instigation may include:

• asking customers to email or text friends about your promotion;
• presenting a share flow that pushes electronic messages as the expected next step;
• auto-generating a marketing message for the customer to send;
• providing pre-written promotional wording aimed at a friend or family member; or
• designing the journey so the customer is effectively acting as a delivery channel for your campaign.

None of those features should be judged in isolation. The legal assessment turns on the actual journey and wording. A small change in product design can move a scheme closer to, or further from, business-instigated marketing.

Why A Referrer Cannot Give Consent On Behalf Of A Friend

A common misconception is that a customer can lawfully provide a friend's email address because they know that person, believe they would be interested, or tick a box confirming they have permission. That is not a reliable route.

The ICO's position is that refer-a-friend schemes should not rely on soft opt-in, and valid consent from the recipient is unlikely to be achievable in practice. The basic problem is evidence. If your business instigates these referral marketing messages, the ICO says you need valid consent from the recipient. A referring customer handing over the contact details does not show that the friend agreed to receive your marketing.

That remains true even if your page says something like:

• I confirm my friend is happy to receive this email; or
• I have my friend's permission to share their mobile number.

Those statements may feel commercially sensible, but they do not fix the underlying issue that your business cannot show the recipient actually consented to receive your direct marketing from you.

For the same reason, the soft opt-in is not a shortcut here. Soft opt-in is a narrow exception used in particular circumstances, but the ICO specifically says businesses must not rely on it for refer-a-friend schemes. So if your proposed workflow depends on a customer uploading friends' contact details and your business then sending or instigating promotional emails or texts, that model needs very careful reconsideration.

The Practical Boundary: Instigated Referral Marketing Versus Independent Sharing

The easiest way to understand the line is to compare two broad scenarios the ICO discusses.

In one scenario, a retailer runs a referral promotion and the customer enters their own details. The retailer then automatically creates a marketing email for the customer to send to friends or family. The regulator treats the retailer as responsible because it is instigating the marketing. The problem is not just the reward. The problem is that the business has created and prompted the electronic marketing message without valid recipient consent.

In the other scenario, a business explains a referral scheme on the customer's account page and says the customer will get a benefit if a friend signs up using a unique code. The page does not tell the customer to email or text anyone and does not suggest a communication method. The customer is left to decide whether to participate and how to mention the scheme. In that example, if the customer independently chooses to send an email or text, the business is not responsible under PECR because it did not instigate the message.

That distinction is narrow but workable. The safer end of the spectrum is a neutral explanation of the scheme, combined with a code or account-page information, where the business does not push the customer towards electronic mail marketing.

However, it would be a mistake to treat every code, link or share feature as a legal safe harbour. A unique code can still sit inside an instigated journey if the surrounding copy, prompts or templates are nudging customers to send marketing emails or texts. Equally, a customer-operated share button is not automatically safe if it launches a pre-drafted promotional message or otherwise turns the customer into an extension of your campaign.

The question is always factual: what exactly did the business build, suggest and encourage?

A Retailer Example: How Small Product Choices Change The Outcome

The following fictional example compares two designs for an online retailer's referral discount. It is not a guarantee that a particular feature complies.

Version one says: Share this offer with friends by email or text and get 10% off when they buy. The page includes fields for the friend's email address, a button marked Send Invite, and pre-written copy promoting the retailer. Even if the customer can edit the message, the retailer has designed a flow that actively encourages electronic marketing and gathers the recipient details for that purpose. That is likely to be treated as instigated marketing, and the retailer should not assume the referrer has supplied valid consent.

Version two says: Your unique referral code is available on your account page. If someone uses it on checkout, you receive 10% off your next order. The page does not tell the customer to email or text anyone, does not collect friend details, and does not provide a pre-filled marketing message. A customer may still choose to mention the code to friends, including by private message, but that choice is left to them. That sits much closer to independent sharing.

Now consider middle-ground features. Suppose the account page includes a button labelled Email My Friends, which opens the user's mail app with a pre-populated subject line and sales message. The retailer might think this is safer because it does not send the email itself. But the ICO's approach means the technical sending route is not decisive. If the business has actively encouraged and structured the message, responsibility may still arise.

This is why referral compliance is often a product-design question as much as a legal wording question.

The Referral Journey Your Team Needs To Assess

A sensible pre-launch review is not a formal filing exercise. It is a practical record of what the customer actually sees and does, so the business can assess whether it is encouraging electronic mail marketing.

For most online retailers, the review should cover at least the following:

• the referral landing page, account page and app screens;
• all button labels, prompts and explanatory text;
• whether any message is auto-generated, pre-filled or suggested;
• whether the flow asks for a friend's email address or mobile number;
• whether the business stores or uses those friend details in any way;
• what reward is offered and when it is triggered;
• what marketing permissions wording appears elsewhere in the journey;
• whether customer service, CRM or marketing tools also send reminders about the scheme; and
• what changes are made over time as the feature develops.

Keeping screenshots, product notes and version history can be useful evidence of the actual design choices. That does not guarantee compliance, but it helps the business assess the real journey rather than relying on assumptions about what the feature is supposed to do.

This record is especially helpful where teams are split across marketing, product and engineering. A legal risk often appears because one team approves a neutral referral concept, but a later build adds a pre-written email template, an import-contacts feature or a stronger call to action that changes the analysis.

How To Reduce Risk Without Dropping The Scheme Entirely

Not every referral programme needs to be abandoned. But if growth depends on customers spreading the word, the design should minimise business encouragement of electronic messages to third parties.

Practical risk-reduction steps may include:

• describing the benefit and referral code in neutral terms rather than telling customers to email or text friends;
• avoiding forms that collect friends' contact details for promotional outreach;
• avoiding pre-populated marketing templates for emails, SMS or similar messages;
• removing prompts that frame electronic sharing as the expected action;
• checking whether in-app copy, onboarding messages or support scripts accidentally encourage prohibited behaviour; and
• reviewing whether the commercial value of the incentive is driving the product team towards a more aggressive sharing flow.

That said, a referral feature still needs a wider compliance review. Privacy information, data handling, platform messaging rules, consumer-facing promotion terms and any affiliate-style mechanics may all need separate assessment. Those issues sit alongside the PECR question rather than replacing it.

For example, if your scheme stores referral activity, tracks sign-ups, or combines referral data with marketing profiles, you may also need to look carefully at your Privacy Policy, privacy notices and internal data handling. If the programme resembles a broader ambassador or affiliate arrangement, the contractual and advertising position may need review as well.

The key point is that solving the instigation issue does not automatically solve every other legal issue in the programme.

Frequently Asked Questions

Does It Help If The Referral Email Is Sent From The Customer's Own Email Account?

Not necessarily. The ICO's position is that sending from the customer's own inbox does not automatically remove business responsibility. If your business actively encouraged or structured the marketing message, you may still be instigating it.

Can We Ask The Customer To Confirm They Have Their Friend's Consent?

That confirmation is not a reliable substitute for valid recipient consent. The regulator's view is that refer-a-friend schemes should not rely on soft opt-in, and a referrer providing the contact details is not enough to show the friend agreed to receive your marketing.

Are Referral Codes Always Safer Than Referral Emails?

They can be lower risk if the code sits on a neutral page and the customer decides independently whether and how to mention it. But codes are not automatically safe. If the surrounding design pushes customers to send emails or texts, the business may still be instigating the marketing.

Can We Still Offer A Discount Or Credit For Referrals?

A reward is not the legal test on its own. The ICO says you do not need to give an incentive for instigation to exist. The central question remains whether the business actively encouraged the electronic marketing message, not simply whether a reward exists.

What If The Referral Feature Changes After Launch?

Revisit the actual design. A scheme initially explained on a neutral account page may later gain email prompts or pre-filled sales copy, so the original assessment may no longer describe what customers see. Keeping screenshots and version notes is a practical way to support that reassessment, not a separate compliance filing suggested by this guide.

Key Takeaways

• If your business actively encourages customers to send referral emails or texts, you may be responsible for those marketing messages under PECR.
• The fact that a customer sends the message from their own inbox or phone does not automatically solve the problem.
• You should not rely on soft opt-in for refer-a-friend schemes, and a customer cannot simply provide a friend's contact details as proof of valid consent.
• A neutral scheme page with a unique code may be lower risk than an auto-generated email or prompted share flow, but the outcome depends on the real design and wording.
• Before launch, map the actual buttons, prompts, templates, contact-detail collection, permissions wording and product changes so the scheme can be assessed properly.
• PECR is only one boundary. Privacy, promotional terms and wider marketing or affiliate issues may also need review.

If you are designing or revising a referral programme, Sprintlaw's legal team can help review your referral journey, customer messaging, promotion terms and privacy-facing documents. You can reach us on 08081347754 or at team@sprintlaw.co.uk.