United Kingdom: Information Commissioner's Office issued fines to Allay Claims and ZMLUK for unsolicited marketing messages

On 20 January 2026, the United Kingdom Information Commissioner’s Office (ICO) fined Allay Claims Ltd and ZMLUK Limited a total of GBP 225'000 for sending unsolicited marketing messages in breach of the Privacy and Electronic Communications Regulations 2003 (PECR). Allay Claims Ltd was fined GBP 120'000 for sending 4'046'947 marketing SMS messages between February 2023 and February 2024 promoting Payment Protection Insurance (PPI) tax refund services. The ICO found that Allay Claims Ltd did not have valid consent and could not rely on the soft opt-in exemption, because they did not provide a clear and simple refusal mechanism when collecting recipients’ details. ZMLUK Limited was fined GBP 105'000 for sending 67'772'285 marketing emails between January and July 2023 using third-party sourced data without valid consent. The ICO found that recipients were shown a list of 361 “partner” companies without any mechanism to choose which organisations could contact them, meaning consent was not specific or informed.