Monetary penalties · Retail and manufacture

Grocery Delivery E-Services UK Ltd t/a HelloFresh

£140,000penalty

Root cause Unlawful direct marketing Nuisance calls, spam texts or emails sent without valid consent — enforced under PECR rather than UK GDPR.

What happened

The Information Commissioner’s Office (ICO) has fined food delivery company HelloFresh £140,000 for a campaign of 79 million spam emails and 1 million spam texts over a seven-month period. The marketing messages were sent based on an opt-in statement which did not make any reference to the sending of marketing via text, and which was also bundled with an age confirmation statement which was likely to unfairly incentivise customers to agree. Customers were also not given sufficient information that their data would continue to be used for marketing purposes for up to 24 months after cancelling their subscriptions.

Summarised from the notice published by the ICO on 12 January 2024. Read the original notice — it is the authoritative version.