Christmas shows, festive stays and seasonal promotions: why getting marketing compliance right matters

Laura Crowe, Senior Associate

Marketing is essential for leisure businesses, particularly in the run-up to Christmas. Hotels promote festive stays and party packages, theatres market Christmas productions and pantomimes, and visitor attractions advertise seasonal events. Email and text marketing can drive bookings and revenue, but campaigns must comply with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR.

Proceed with caution

Leisure businesses often collect a large amount of customer information, such as booking history, loyalty scheme details, customer preferences, attendance or travel information, and website and app activity.

While this information can help businesses offer relevant promotions, simply having customer data does not automatically give permission to send marketing messages.

Pressure to fill seats, sell tickets and secure bookings can tempt businesses to rely on historic customer databases or increase marketing frequency. Peak demand does not relax regulatory requirements and may increase complaints about unsolicited or excessive marketing.

The main rules

Businesses should make sure they:

Obtain proper consent – freely given, specific, informed, and unambiguous. Customers must clearly agree to receive marketing communications. Businesses should keep records showing when and how that permission was given.

Use the “soft opt-in” correctly – In some situations, businesses can market to existing customers without explicit consent. However, this only applies if:

• The customer provided their details when making, or considering, a purchase.
• The marketing relates to similar products or services.
• The customer was given the opportunity to opt out when their details were collected and in every marketing message afterwards.

For example, a hotel may market Christmas break packages to previous guests if the soft opt-in requirements are met, but it should not use those details to promote unrelated services or events without the necessary permissions.

Make it easy to unsubscribe – Customers should be able to stop marketing messages easily, and businesses should act on those requests promptly.

What regulators are looking at

The Information Commissioner’s Office (ICO) is increasingly focusing on whether businesses can prove they are following the rules.

The ICO recently fined food delivery company HelloFresh £140,000 after it sent 79 million spam emails and 1 million spam texts over seven months. Its opt-in wording did not mention text marketing, bundled marketing consent with age confirmation in a way likely to incentivise agreement unfairly, and failed to make clear that customer data could be used for marketing for up to 24 months after subscription cancellation.

Key lessons learnt

• Make consent wording clear and easy to understand.
• Avoid combining different permissions into one consent request.
• Review older customer databases rather than assuming existing permissions are valid.
• Keep accurate marketing records.

Why this matters

PECR compliance is increasingly important for leisure operators. Non-compliance can lead to regulatory investigations, significant financial penalties, reputational damage and loss of customer trust, while customers increasingly expect organisations to respect their marketing preferences.

Recent reforms introduced through the Data (Use and Access) Act 2025 have strengthened PECR’s enforcement framework and clarified aspects of direct marketing regulation. These changes reflect a broader regulatory shift towards supporting responsible data use and innovation while taking a firmer approach to unwanted marketing practices.

As a result, PECR should no longer be viewed as a niche compliance requirement. This is particularly relevant during seasonal promotional periods when marketing volumes increase significantly. A poorly managed festive marketing campaign can generate customer complaints at precisely the time businesses want to strengthen customer relationships and maximise revenue opportunities.

It is now a key consideration for managing regulatory risk, avoiding financial penalties, maintaining customer trust, and protecting brand reputation.

Good marketing builds trust

Businesses invest heavily in customer experience, yet this can quickly be undermined and Customers can quickly become frustrated by:

• Too many marketing messages
• Unclear requests for consent
• Difficult unsubscribe processes
• Continuing to receive marketing after opting out

The most successful Christmas campaigns are often those that are both relevant and expected. Customers are more likely to engage with festive offers, seasonal events, and special promotions when they have clearly chosen to receive them and can easily manage their preferences.

PECR reflects what customers already expect: transparency, choice, and respect.

Being transparent and giving customers genuine choice not only helps with compliance but can also improve customer loyalty and brand reputation.

Key compliance questions for businesses

• Can we show when and how customers agreed to receive marketing?
• Are our email and text marketing permissions clearly explained?
• Are we using the soft opt-in rules correctly?
• Does every marketing message include an easy way to unsubscribe?
• Are our opt-out and suppression lists up to date?
• Have we reviewed older customer databases recently?
• Are any third parties collecting marketing permissions correctly on our behalf?
• Could we demonstrate compliance if the ICO asked us to?

PECR is now a key consideration in managing regulatory risk, avoiding financial penalties, maintaining customer trust and protecting brand reputation, particularly during seasonal promotions when marketing volumes rise. A poorly managed festive campaign can generate complaints just as businesses seek to strengthen customer relationships and maximise revenue.

For more advice, please contact our commercial team at [email protected] or call 0161 832 3434.