UK regulator raids businesses linked to car finance nuisance marketing

The ICO has executed search warrants at properties in Bolton, Burnley, Liverpool, London and Swansea as part of an investigation into suspected nuisance marketing connected with car finance mis-selling claims. The action was undertaken by a joint regulatory taskforce involving the ICO, FCA, Advertising Standards Authority and Solicitors Regulation Authority.
More than 12 million complaints about unsolicited car finance marketing messages have reportedly been submitted since September 2025, with as many as 100,000 complaints received in a single day. The scale and coordinated nature of the investigation demonstrate the regulatory risks arising where claims-management businesses, marketing companies, lead generators and professional advisers form part of the same commercial chain.
Organisations purchasing marketing leads should not assume that assurances from a supplier provide sufficient evidence of lawful consent. They should be able to establish how and when the information was collected, precisely what individuals were told, which organisations were named and whether the consent covered the particular communication channel and marketing purpose. Contracts, suppression arrangements and audit rights should also be examined, alongside the organisation’s own records demonstrating compliance with PECR and the UK GDPR.
The investigation may also indicate an increasingly coordinated approach to misconduct spanning privacy, financial services, advertising and professional regulation. Organisations operating in high-volume claims or lead-generation markets should therefore consider regulatory exposure across the entire business model, rather than treating direct marketing compliance as an isolated data protection issue.
For more information, see our course on Marketing & Data Protection.
Special Category Data Course Banner

Special Category Data — Getting it Right

Special category data errors sit behind the majority of ICO fines. Gain detailed, practical knowledge of the definitions, conditions and compliance systems.
AI microchip embedded in an intricate blue circuit board, to represent advanced artificial intelligence, futuristic computing, and digital innovation.

AI & Data Protection

Practical steps controllers can take today to manage AI compliance risk. Fairness, transparency, lawfulness and security across the AI lifecycle.

Stay informed - Sign up to receive PDP Email News Updates

Analysis from PDP’s experts on the changes that matter, written for practitioners