UK Gambling Commission rules for marketing calls (2026)

Two regulators decide whether a UK gambling marketing call is lawful. The Gambling Commission sets licence conditions through the LCCP (Licence Conditions and Codes of Practice). The ICO enforces PECR, the Privacy and Electronic Communications Regulations, and UK GDPR. Most guides cover one or the other. Calls are where both apply most clearly, so this guide follows a single call from list to hang-up and notes which rule bites at each stage.

UK Gambling Commission rules for marketing calls at a glance

Building the list: consent by product and by channel

The rule that changed phone marketing most is SR Code 5.1.12, which took effect on 1 May 2025. It applies to remote casino, bingo and betting licensees and says operators must provide customers with options to opt in to direct marketing on a per product and per channel basis. Channel options must include phone calls, email and SMS. Product options must include betting, casino and bingo. All options start at opt-out, and customers must not receive marketing that goes against their choices.

That turns a single "marketing consent" column into a grid. For a casino reactivation call, the only players you may dial are those with a tick in the casino row of the phone column.

Player D matters more than it looks. Existing customers must be asked to confirm their preferences at their first login after the rule started. A lapsed player who hasn't logged in since May 2025 may never have been asked, so they have no phone consent and don't go on the list.

SR Code 5.1.11 adds the evidence and withdrawal duties: no direct electronic marketing without informed and specific consent, a chance to withdraw consent on every contact, and proof of consent on request.

PECR on top

PECR's live-call rules are older and looser, but they still apply. You must not make marketing calls to anyone who has told you they don't want your calls, or to a number registered with the TPS or CTPS, unless the person has specifically consented. The ICO also warns that it can take 28 days for a TPS registration to become active, and that you remain responsible for screening even when a supplier says they've done it.

The Data (Use and Access) Act 2025 changed PECR in two ways that matter here. A "call" now covers attempts to connect, not only connected calls, so unanswered dials to an unlawful list still count. And PECR enforcement has been aligned with UK GDPR, so penalties are the same in most cases.

The AI question

PECR is stricter about automated calls than live ones. The ICO defines an automated marketing call as a call made by an automated dialling system that plays a recorded message, and those calls need consent that specifically covers automated calls. A conversational AI agent doesn't play a recorded message, but it isn't a person either, and the ICO's current guidance doesn't address it.

Two practical consequences:

1. Word your phone opt-in so it covers calls from an AI assistant, for example: "Calls about casino offers, which may be made by our AI assistant." That covers the stricter reading without costing you anything.
2. Disclose the AI at the start of every call. Dial Milo does this by default. A player who learns halfway through that they've been talking to an AI feels misled, and a feeling of being misled tends to turn into a complaint. The wider legal picture is in is it legal to make AI calls.

Building the list: who must come off

Consent is necessary but not sufficient. Three groups come off even if they ticked every box.

Self-excluded customers. SR Code 3.5.3 requires you to remove the name and details of a self-excluded individual from any marketing databases, or flag them, within two days. The Commission's guidance extends this to customers whose self-exclusion has expired but who haven't chosen to return, names recycled old customer lists as a known cause of breaches, and holds you primarily responsible when a third party markets on your behalf. GAMSTOP participation is required separately. Our self-exclusion registers reference sets out the GAMSTOP rules next to the other European registers.

Customers with strong indicators of harm. SR Code 3.4.3 says licensees must prevent marketing and the take up of new bonus offers where strong indicators of harm, as defined within the licensee's processes, have been identified, and must act on them in a timely way through automated processes. Your harm model's output belongs in the list filter, not only in a case-management tool.

Anyone who objected. Under PECR an objection overrides earlier consent. Keep a suppression list and check every new upload against it, across every campaign and supplier.

During the call: what the agent must say and do

Identify, disclose, display

PECR requires you to always say who is calling and allow your number to be displayed. For gambling there's a privacy wrinkle: naming a casino to whoever picks up the phone tells a partner or parent something the player may not have shared. The safe order is AI disclosure, then an identity check, then the brand. Dial Milo confirms it's the right person before naming the brand. If the person turns out not to be the player, Milo doesn't mention the brand or the offer, and the call is recorded as a wrong person.

Present the offer within the 2026 bonus rules

The January 2026 LCCP update added a cap on wagering requirements and banned mixing products within incentives. The current SR Code 5.1.1 says licensees must not apply wagering requirements over a maximum of 10 times or include more than one type of gambling product in an incentive. SR Code 5.1.9 adds that all significant conditions which apply to marketing incentives are provided transparently and prominently, and must not be misleading under the Digital Markets, Competition and Consumers Act 2024. The ordinary code at 5.1.2 asks that rewards be proportionate to the type and level of customers' gambling.

On a phone call, "prominently" means said out loud. A practical standard is that the agent states the significant conditions in the same breath as the offer, and gives the full terms whenever asked:

Milo: We'd like to offer you 20 free spins on [game], with no deposit needed. The main conditions: winnings carry a 10x wagering requirement and the spins expire after seven days. I can send the full terms by SMS and email if you'd like them.

Dial Milo works from the offer and terms you write. It presents the offer once and never invents, rounds or changes a term. Your compliance team approves the wording once, and every call uses that exact text. More on structuring the offer in casino bonus offer calls.

SR Code 5.1.6 requires compliance with the CAP and BCAP advertising codes and, for media they don't explicitly cover, regard to their principles. The CAP Code's gambling section covers content and targeting to protect under-18s and vulnerable people, so have whoever signs off your ads read the call script against it too.

Stop at the first sign of harm

A player who says "I only stopped because I was losing too much" has just given you an indicator of harm, on a recorded line. Under 3.4.3 the marketing has to stop. Script this as a hard rule, not a judgement call:

1. 1

   End the offer immediately

   Don't finish the pitch, don't mention the terms, don't offer a smaller bonus instead.

2. 2

   Give help information

   Your safer-gambling tools, how to set limits or self-exclude, and the support line you use in every other channel.

3. 3

   Flag and suppress

   Pass the player to your customer interaction team and stop all marketing to them until that team has reviewed the case.

Dial Milo stops selling at any sign of harm, flags the player for your team and puts the number on the do-not-call list. If you use Customer.io, it also sets milo_safer_gambling_flag on the player so your journeys can suppress other channels too. Scripting detail is in safer gambling outbound calls.

Language

If you market in another language, the ordinary code at 3.3.2 says you should provide responsible gambling information, game guides and the summary of terms in that language. If a player answers in Polish and the call carries on in Polish, your help information and terms need a Polish version too.

After the call: withdrawals and the record

When a player says "don't call me again", 5.1.11 requires you to stop electronic marketing as soon as practicable, and the ICO recommends keeping a do-not-call list and checking every list against it. Apply it to every campaign, not just the one that heard it. Dial Milo records it as an opt-out, suppresses the number across all campaigns, and fires milo_opted_out so a Customer.io journey can update the player's preference grid in your own system. The full event list is in Customer.io AI phone calls.

Keep the recording, transcript and outcome. If the Commission or the ICO asks why a particular player was called, you want to be able to show the consent record, the list filters and exactly what was said.

Callbacks need the same care. Players often ring back a number that called them, sometimes hours later. Whoever picks up has to run the same identity check before naming the brand. Dial Milo recognises returning players and gives unknown callers a neutral line.

Pre-dial checklist for a UK campaign

The checklist cuts your callable list, often by a lot. That isn't a reason to skip it: a smaller list of players who chose phone contact answers more often, complains less, and costs you less if anyone asks how it was built. For segmentation and measurement across markets, start with the player reactivation guide. For the Dutch equivalent, which is stricter, see calling players in the Netherlands.