Skip to main content
Compliance

What consent do I need to capture for financial advice leads under GDPR?

Last reviewed 22 April 2026 · Reviewed by Jake McQuillan

Quick answer

What consent do I need to capture for financial advice leads under GDPR?

You need specific, granular, freely-given consent for: (1) being contacted by phone/SMS, (2) email marketing, (3) processing sensitive data (health, financial). Store consent timestamp, IP, user-agent and exact text shown. Unlimited retention requires separate basis.

Want us to do this for your firm?
Get a compliant lead-gen plan tailored to your niche and compliance setup.
Book a discovery call

Required consents

  1. Marketing calls/SMS: explicit, separate checkbox. Check TPS/CTPS.
  2. Marketing email: explicit, separate checkbox (soft opt-in narrow in regulated advice).
  3. Data processing: lawful basis (contract, legitimate interest, consent).
  4. Special category data (health for protection, ethnicity): explicit consent.

What to store

  • Consent text shown (verbatim).
  • Timestamp (ISO-8601).
  • IP address.
  • User-agent.
  • Landing-page URL.
  • Version of terms/privacy policy.

Retention

  • Prospect (no client relationship): 12 to 24 months typical.
  • Client: for life of relationship + 6 to 7 years after (FCA retention rules).
  • Declined-advice: 6 years.

Watch out

  • Pre-ticked consent boxes are not valid.
  • Bundled consent is not valid.
  • Use of third-party lead lists is almost always non-compliant.
Was this useful?
JM
Reviewed by
Jake McQuillan
Founder at Platinum Prospects
Last reviewed 22 April 2026

Ask your own question

Describe your firm’s situation and we’ll reply with a tailored answer and benchmarks.

We’ll email you once with an answer. No marketing sequences.

Related questions

Is Platinum Prospects FCA regulated?
Platinum Prospects is a marketing agency, not a regulated financial firm. All financial promotions produced by the agency are signed off by the client firm's a…
How does Consumer Duty affect financial adviser marketing?
Consumer Duty requires all marketing to be fair, clear, not misleading, aligned to target market and delivering good outcomes meaning claims, risk balance and…
How do I handle protected characteristics in financial marketing targeting?
Do not target or exclude on protected characteristics (age is protected only in limited contexts). Use proxies carefully and document rationale.
Can financial services firms send cold email in the UK?
Cold email to sole traders and limited company contacts is permitted under PECR for B2B, but consumer cold email requires soft opt in or consent.
How do I verify my Google or Meta ad account for UK financial services?
Google requires financial services verification via the FCA register (FRN). Meta requires authorisation via their Financial Products and Services policy. Both…