UK cold calling law in 2026: what B2B callers actually have to do.

I make cold calls for my own businesses, and I'm building a dialler that has to obey these rules in its code. So I went back to the sources: the regulations themselves, the regulator's guidance, Ofcom's policy statement. Not other people's summaries of them.

What I found is that a lot of what gets repeated about UK cold calling is out of date or was never right. Some of it changed this year. This guide sets out what the law actually says for live B2B sales calls, as of October 2026, with the source for every rule listed at the end.

It covers live calls made by a person. Automated calls with recorded marketing messages are covered by different rules, and they're a different subject.

This is a practitioner's guide, not legal advice. Several of the ICO's guidance pages it relies on carry a notice that they're under review after the Data (Use and Access) Act 2025, so check for updates. If you're in a regulated sector, or about to run calls at scale, put it in front of a solicitor too.

Is cold calling legal in the UK?

Yes. B2B cold calling is legal, and in most cases you don't need consent to make a live sales call. The ICO puts it plainly: "In general, you don't need consent under PECR to make most types of live marketing call."

PECR is the Privacy and Electronic Communications Regulations 2003. Regulation 21 is the one that matters most to callers. You may not make an unsolicited marketing call to a number if either of these is true:

• the person has told you they don't want your calls, or
• the number is on the register kept under regulation 26, which is the TPS and CTPS.

So the law is permission by default, with two ways for people to say no: tell you directly, or register their number.

Two sectors are different. Claims management calls need consent, and that applies to businesses as well as individuals (regulation 21A).

Pensions cold calls to individuals are banned unless you're FCA authorised or a scheme trustee or manager and meet strict extra conditions (regulation 21B). If you sell in either area, this guide isn't enough.

A call only counts as "solicited" if the person specifically asked you to ring. The ICO says that "agreeing or not objecting to receiving live marketing calls from you doesn't mean the marketing is solicited." Almost every sales call is unsolicited, so the rules below apply to almost every call you make.

The rules on every call

Whoever you're calling, four things apply every time.

Give your name. Regulation 24 requires the caller to say who is calling on every marketing call.

Give an address or freephone number if they ask. Same regulation. You don't have to volunteer it, but if they ask, you must give either your address or a number they can reach you on free of charge.

Show a number they can call back. This rule sits in regulation 21(A1), in force since 16 May 2016, and it applies to solicited and unsolicited marketing calls alike. You must not withhold your number. Ofcom's guidance to phone providers says the number shown must be "a valid, dialable telephone number which uniquely identifies the caller": one that's in service, takes a return call, and that you're allowed to use.

Stop when they say stop. If someone tells you they don't want your calls, that's a regulation 21 objection and you can't call them again. The ICO says to put the number on a do not call list rather than delete it, so it can't creep back in on the next import.

TPS and CTPS: who is on which register

The TPS (Telephone Preference Service) and CTPS (Corporate Telephone Preference Service) are the two halves of the statutory register. They work the same way. The CTPS is for corporate subscribers, the TPS for everyone else.

The part B2B callers get wrong is who counts as "everyone else". PECR treats sole traders and most partnerships as individuals, not businesses.

So "we only call businesses, so we only check the CTPS" doesn't work. The ICO is explicit: "before you make live B2B calls, you need to screen against both the CTPS and TPS registers."

A few more points from the regulations and the ICO's guidance:

• Mobiles can be registered, and registration is free.
• Registration takes effect after 28 days. Regulation 21(3) gives callers a 28 day grace period after a number joins the register. That's why TPS Ltd tells organisations to screen at least every 28 days. That frequency is their guidance rather than a line in the statute, but it's the practical way to stay inside the rule.
• A list screened more than 28 days ago may not be clean. If you buy data, ask when it was screened. The ICO warns that an old screen may contain numbers "where the registration has become active."
• A number on a website doesn't override the register. The ICO: "Just because a telephone number is publicly available or appears in a telephone directory does not mean it overrides a TPS or CTPS registration."
• CTPS registrations lapse unless renewed. Companies get an annual reminder and must confirm. TPS registrations don't need renewing.

When you can call a registered number

Only if that subscriber has told you, specifically, that they don't object to your calls (regulation 21(4)). The ICO says the notification "must contain your name." The fact that someone never objected, or never opted out, isn't enough.

Keep a record of it. If it's ever questioned, you need to prove the person told you.

And it can be withdrawn at any time, after which you stop.

Ofcom's rules on abandoned and silent calls

This is where I found the most out of date advice, and it matters more as soon as you use a dialler.

Ofcom regulates "persistent misuse" of phone networks under the Communications Act 2003. Its current enforcement policy is a statement published on 20 December 2016, which applies from 1 March 2017. Ofcom republished it in January 2026 alongside a refresher reminding organisations to set diallers up so they don't create silent or abandoned calls.

The 3% figure was never a safe harbour

You'll still read that an abandoned call rate under 3% keeps you safe. Ofcom addressed this directly in the 2016 statement: "The view held by respondents that the 3% abandoned call rate set out in the 2010 policy created a safe harbour is incorrect."

It also removed any specific rate from its criteria for deciding when to act. A footnote spells it out: no reference to a specific rate, "whether three per cent or a different rate." And in the annex on calculating abandoned calls: "action against abandoned calls is an Ofcom priority and we may take action in any case where a calling organisation makes them."

Ofcom does still calculate an abandoned call rate, per calendar day and per campaign, as one of the things that make action more or less likely. A higher rate makes action more likely, and a lower one makes it less likely without ruling it out.

So the practical aim is zero abandoned calls. Progressive dialling, where a call is only placed when a rep is free to take it, is the simplest way to aim for that, which is why I think it's the sensible default in the UK.

What counts as harm

The statement sets out what Ofcom treats as harmful:

• Silent calls, where nobody and nothing speaks. Ofcom calls tackling these its "current top priority".
• Abandoned calls, where the person answers and there's no one to talk to.
• Calls cut off too soon. Calls "allowed to ring for less than 15 seconds before being terminated (unless answered before then) by the calling party" are likely to face enforcement. So are calls left ringing for long periods.
• Repeat calls. Calling a number again within 72 hours of an abandoned or silent call, without making sure a live person will be there, counts against you.
• Withheld or invalid caller ID, which Ofcom treats as aggravating.
• Unsociable hours, also aggravating, though Ofcom doesn't define them.

If a call is abandoned, Ofcom expects a short recorded information message within two seconds. It should say who called, offer a basic rate number to decline further calls, and contain no marketing at all.

Keep records that show you followed the policy for at least six months. And if you use an outsourced call centre or SDR agency, the risk stays with you: Ofcom says the organisation that engages the third party "may be the subject of an investigation."

The maximum penalty Ofcom can impose for persistent misuse is £2 million (Communications Act 2003, section 130).

Fines: what changed in 2026

For years the maximum fine for breaking the calling rules was £500,000. You'll still see that figure quoted, including on some of the regulator's own guidance pages. It's out of date.

The Data (Use and Access) Act 2025 replaced PECR's enforcement regime. The change came into force on 5 February 2026. For breaches of the calling rules, including regulations 21, 21A, 21B and 24, the maximum is now the higher data protection maximum: £17.5 million or 4% of worldwide annual turnover, whichever is higher. The ICO confirmed it the day it came in.

• It isn't retrospective. Breaches before 5 February 2026 are still dealt with under the old rules, with the old £500,000 cap.
• Directors can be fined personally. Where a company breaks regulations 19 to 24 with the consent, connivance or neglect of a director or other officer, that person can be fined too. That rule has existed since 2018, and it carries over into the new regime.

One naming change: on 30 September 2026 the Information Commissioner was formally replaced by the Information Commission. Its website and most of its guidance still say ICO, so that's what I use in this guide.

The regulator lists its fines on its enforcement page. Recent live call cases are worth reading before you plan a campaign: in two from 2026, companies made more than 500,000 and more than 750,000 calls to TPS-registered numbers.

Calling hours

There are no legal calling hours for B2B marketing calls in the UK. PECR doesn't set any.

What exists instead:

• Ofcom treats calls at unsociable hours as more harmful, but says "We do not prescribe those hours."
• The DMA Code, which binds Data and Marketing Association members only, asks them to avoid "times considered antisocial."
• FCA authorised firms must make spoken promotions to retail clients "only ... at an appropriate time of the day" (COBS 4.8.3R).

The rest is judgement. Ringing a company switchboard at 10am on a Tuesday isn't the same as ringing a sole trader's mobile at 9pm on a Sunday, and that sole trader's number may well be their personal phone.

Recording sales calls

Recording business calls can be lawful, and it's worth doing. You can review your calls, train new people, and settle what was actually said.

The legal authority is section 46 of the Investigatory Powers Act 2016 and the regulations made under it in 2018. They allow recording for purposes including establishing facts, regulatory compliance, and checking "the standards which are achieved or ought to be achieved". In other words, quality and training.

You'll still see the Lawful Business Practice Regulations 2000 named as the authority. The power those were made under was repealed on 27 June 2018.

There are two separate notice duties, and they come from different laws:

1. Your own staff. The 2018 regulations require "all reasonable efforts" to tell the people who use your phone system that calls may be recorded. That means your team, so put it in their contracts or handbook.
2. The person you're calling. This duty comes from UK GDPR. The ICO says: "You must tell these people that you are recording the call and why. A recorded message is good practice." On an outbound sales call, the caller usually says it at the start. The ICO says the rest of the privacy information about the recording, like how long you keep it and the person's rights, can be given by other means, such as a link.

Recordings are likely to be personal data. Keep them no longer than you need them, and remember someone can ask for a copy of theirs through a subject access request. The ICO also says recording every call by default isn't usually proportionate, so be clear about why you record.

UK GDPR and B2B calling

The moment you hold a named person's details, data protection law applies, even if you're calling them at work.

For live B2B calls to numbers that aren't registered, the ICO says legitimate interests is likely to be the right lawful basis in many cases. That got firmer in February 2026.

UK GDPR now lists direct marketing in Article 6(11) as an example of processing that may be necessary for a legitimate interest. You still need to weigh your interest against the person's, so treat it as support for your case rather than the whole case. And if you're relying on someone's permission to call a TPS-registered number, the ICO says your lawful basis is likely to be consent.

The right to object is absolute. If someone objects to direct marketing, you stop. The ICO: "This right is absolute and there are no grounds for you to refuse." You must also make people aware of this right "at the latest at the time of the first communication."

If you didn't get someone's details from them, for example from a data provider or a list you've enriched, Article 14 requires you to give them privacy information. That's within a month of getting the data, and if you use the data to call them, at the latest on that first call.

The soft opt-in has nothing to do with calls. It's part of regulation 22, which covers email and texts. It doesn't let you call TPS-registered existing customers.

What isn't law (yet)

Two claims I keep seeing:

• "Cold calling for financial services is banned." Not in general. The government announced in 2023 that it would extend the pensions ban to all consumer financial services, and ran a consultation. The consultation page still says "We are analysing your feedback", and PECR contains no such ban. FCA authorised firms do have their own cold calling rules (COBS 4.8), which are a separate matter.
• "Only the agency making the calls is liable." The ICO says a business that encourages, incentivises or asks someone else to make calls for it can be responsible too. Ofcom says the same about call centres.

A checklist before your next calling block

1. Screen the list against both the TPS and CTPS, and again if it's more than 28 days since the last screen.
2. Load your do not call list and make sure your dialler blocks those numbers before they ring.
3. Check your caller ID is a real, returnable number you're allowed to use.
4. Know what you'll say if someone asks for your address or a freephone number.
5. Use progressive dialling, so calls are only placed when someone is free to take them.
6. Let unanswered calls ring for at least 15 seconds.
7. Say at the start that the call is recorded, if it is.
8. When someone says stop, mark them do not call on the spot.
9. Keep call logs and records of how you followed Ofcom's policy for at least six months, and keep your do not call list for as long as you call.

I built KIK Studio around this list. The 15-second minimum ring, the do not call block and progressive-only dialling are part of the dialler itself. TPS and CTPS screening isn't built in, so you still screen your list before you import it.