ICO Fines Call-Blocker Seller £190,000 Over 758,000 Nuisance Calls to TPS Numbers

ICO Fines Call-Blocker Seller £190,000 Over 758,000 Nuisance Calls to TPS Numbers

The UK's Information Commissioner's Office issued Elderly Aids Limited a £190,000 monetary penalty notice dated 6 August 2026, announced on 27 August 2026, for making 758,053 unsolicited live marketing calls to numbers registered with the Telephone Preference Service, breaching regulations 21 and 24 of the Privacy and Electronic Communications Regulations 2003. The company sold call-blocking devices marketed as protection from that kind of call.

Information last verified on August 27, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article addresses the UK's Privacy and Electronic Communications Regulations 2003 (PECR) and the Telephone Preference Service, which apply across England, Wales, Scotland and Northern Ireland. It does not address the US Do Not Call Registry or EU member-state telemarketing rules, which are separate regimes. For a broader look at the wider framework, see our guide to UK data privacy law.

What Happened

The ICO served Elderly Aids Limited (EAL) with a £190,000 monetary penalty notice dated 6 August 2026, announced on 27 August 2026, after finding the company made 758,053 unsolicited live marketing calls between 27 May 2024 and 10 February 2025 to numbers registered with the Telephone Preference Service (TPS) or the Corporate TPS, in breach of regulations 21 and 24 of the Privacy and Electronic Communications Regulations 2003 (PECR). The notice records that a notice of intent was served on 30 July 2026 and that EAL made no representations in response. EAL sold call-blocking devices on an annual subscription. The ICO's press release says the company deliberately targeted elderly people to promote those devices while making hundreds of thousands of unlawful calls itself. The penalty notice records that complainants reported EAL was targeting the elderly and vulnerable, and separately finds that EAL did not deliberately set out to contravene PECR but knew or ought to have known of the risk and failed to take reasonable steps to prevent it. Twenty complaints about EAL's calls were made to the ICO and the TPS during that period, and the penalty notice records a further 40 complaints between 25 April 2025 and 17 October 2025, 33 of them from numbers that had been registered with the TPS for more than 28 days. The ICO listed EAL's aggressive and misleading conduct on the calls as an aggravating feature of the penalty, and found that its callers often failed to identify themselves. The penalty notice finds that EAL contravened regulation 24 as well as regulation 21, because it did not give call recipients the particulars regulation 24(2) requires. The ICO also issued an enforcement notice ordering EAL to stop the unlawful calls and to comply with the identification rules. The regulator says EAL repeatedly ignored its requests for information and continued making the calls throughout the investigation.

One person who complained to the ICO described a relative being sold a service the complainant said EAL was not authorised to sell, calling it "overcharging for call blocking services that they aren't authorised to sell." According to the ICO's account of that complaint, the same person's father had been persuaded to pay £139 upfront plus a £6.99 monthly fee.

Andy Curry, the ICO's Head of Investigations, said of the case: "EAL showed a complete disregard for the law and the people they were hounding." Russell Roach, Director of Preference Services at the Data & Marketing Association, said in the same release that organisations "must respect the choices people have made about their privacy" when they register with TPS.

The ICO's release also states that EAL attempted to strike itself off the Companies House register once it became aware it was under scrutiny and is now registered at a default address. The release does not elaborate further on that point, and this article does not speculate about what it means for enforcement or recovery of the penalty.

What the Law Actually Says

PECR, not UK GDPR, is the rulebook EAL is found to have broken. UK GDPR and the Data Protection Act 2018 govern how organisations collect, store and use personal data generally. PECR is the more specific set of UK rules for electronic marketing: calls, texts, emails and cookies. The ICO enforces both regimes, but a PECR finding and a UK GDPR finding are legally distinct, even where, as here, marketing calls also involve personal data. For the wider data protection framework this sits alongside, see our explainer on the UK's core data protection law.

Regulation 21 of PECR makes it unlawful for a person to make, or instigate, a live call for direct marketing purposes to a subscriber's line where that subscriber has previously told the caller not to call, or where the number is listed on the register kept under regulation 26, which is the TPS. A number is not protected for the first 28 days after it is added to the register, though that carve-out applies only to the TPS-register route under regulation 21(1)(b); a direct do-not-call notification to a specific caller under regulation 21(1)(a) binds that caller straight away. A subscriber can also tell one specific caller that they do not object to that caller's calls, which permits that caller, and only that caller, to keep calling despite the TPS listing; the subscriber can withdraw that permission at any time, after which the caller must stop.

Automated recorded calls are governed separately, and more strictly, by regulation 19. A person may not transmit a recorded marketing message by an automated calling system unless the subscriber has already told that caller they consent to it, regardless of whether the number is TPS-listed. In short: live calls use an opt-out model built around the TPS register, while automated or recorded marketing calls require the subscriber's opt-in consent from the outset, TPS registration or not.

Regulation 24 requires anyone making a marketing call to give their name, and, if the recipient asks for it, either an address or a telephone number on which they can be reached free of charge. Failing to identify the caller, which the ICO found EAL's callers often did, is a compliance failure in its own right, and the ICO found EAL in contravention of regulation 24 alongside regulation 21.

How large a penalty PECR carries has changed recently. During the period EAL was calling (May 2024 to February 2025), PECR penalties were capped at £500,000, the limit set by the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 under the Data Protection Act 1998 framework that Schedule 1 to PECR extended to marketing-call breaches. From 5 February 2026, the Data (Use and Access) Act 2025 replaced that framework: Schedule 1 to PECR was substituted so that breaches of a list of PECR provisions that includes regulations 19 to 24, covering live calls, automated calls and caller identification, and also regulations 5, 6, 7, 8 and 14, now attract the same "higher maximum amount" the UK GDPR uses for its most serious infringements, £17,500,000 or 4% of an undertaking's total annual worldwide turnover, whichever is higher, under section 157(2)(a) and (5) of the Data Protection Act 2018 as applied to PECR. The penalty notice resolves which cap applied here. It is issued under section 55A of the Data Protection Act 1998 and records that the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 capped any penalty at £500,000, because the 1998 Act provisions remain in force for PECR breaches occurring before 5 February 2026. The notice does not set out an arithmetic breakdown of how the £190,000 figure was reached.

Because the conduct predates 5 February 2026, EAL's penalty notice was issued under section 55A of the Data Protection Act 1998, and the notice sets out a right of appeal to the First-tier Tribunal (General Regulatory Chamber) under section 55B(5) of that Act. The notice states that any notice of appeal should reach the Tribunal within 28 days of the date of the notice, which was 6 August 2026. For breaches occurring on or after 5 February 2026, the equivalent appeal right runs through section 162 of the Data Protection Act 2018 as applied to PECR. No appeal by EAL appears in the ICO's published material as of 27 August 2026.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The pattern here, a business selling protection from nuisance calls while itself running an unlawful call operation, is not unique to EAL. In notices dated 3 February 2026 and announced that March, the ICO fined Birmingham-based TMAC Ltd £100,000 for 260,332 unsolicited calls, also to TPS-registered numbers, also pushing a personal safety product (pendant alarms) at elderly recipients, with staff who misrepresented who they were calling on behalf of. Two enforcement actions in the same six-month window, against two companies selling different protective products through the same unlawful channel, points to a specific and recurring exploit: TPS registration signals to a caller that the person on the other end is older, has a line they actively want protected, and is concerned enough about nuisance calls to have taken a formal step against them. That is the exact profile a caller offering to "solve" the problem is targeting.

The gap between 758,053 unlawful calls and 20 recorded complaints during the same period is also worth sitting with. The penalty notice puts EAL's total outbound call volume for that period at 1,860,705; the 758,053 figure is the subset that screening against the TPS register identified as reaching numbers registered for more than 28 days. It does not show that most recipients were unbothered by the calls; it more plausibly reflects reporting friction among a caller pool that skews older and, per the ICO's own public advice, may not know an online reporting tool exists or feel able to use it. The complaint count in this case is a measure of who reported, not of how many were affected.

The February 2026 change to PECR's penalty ceiling matters independently of this case. Moving marketing-call breaches from a flat £500,000 cap to the same turnover-linked ceiling the UK GDPR uses for its worst infringements changes the calculus for larger telemarketing operators, for whom £500,000 could be treated as a manageable cost of doing business relative to the revenue a large-scale unlawful calling operation can generate. Whether the ICO applies that higher ceiling in a future nuisance-calls case is not something this article predicts.

How This Affects You

Registering a UK landline or mobile number with the TPS at tpsonline.org.uk is free and, once it takes effect (allow 28 days), makes it unlawful under PECR regulation 21 for most organisations to call that number for direct marketing without specific permission. Registration is a legal prohibition on the caller, not a technical block on the line, so it will not stop calls from an operator willing to break the law, from numbers outside UK jurisdiction, or from calls that fall outside "direct marketing" altogether, such as a genuine customer-service callback or certain calls from registered charities.

Be cautious of any unsolicited call offering a call-blocking device or service, particularly given this case. If nuisance calls continue after registering, they can be reported to the ICO free of charge through its online reporting tool, and separately to the TPS. Complaints about a business's wider trading practices, as opposed to its marketing calls specifically, can go to Trading Standards through Citizens Advice; our guide to making a UK consumer complaint covers that general process. Where personal data has also been mishandled, our walkthrough of filing a complaint with the ICO explains what the regulator needs to investigate.

What Happens Next

EAL's enforcement notice requires it, within 30 days of the notice date of 6 August 2026, to stop making unlawful marketing calls and to give call recipients the particulars regulation 24 requires. The penalty notice sets a payment deadline of 8 September 2026 and offers a 20% reduction to £152,000 if the full amount is received by 7 September 2026, a discount that is not available if EAL exercises its right of appeal. Separately, if a penalty notice recipient does not pay, the ICO has a general power to pursue recovery of the penalty amount and, in appropriate cases, to seek disqualification of a company's directors. That is a description of the ICO's standard recovery process for any unpaid penalty, not a statement about what will happen with this fine specifically, and this article does not predict whether EAL will pay, appeal, or otherwise respond.

This is general legal information, not legal advice. It covers United Kingdom law under the Privacy and Electronic Communications Regulations 2003 and reflects sources verified on August 27, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Step-by-step: filing a complaint with the ICO
• How UK consumer complaints work more broadly

---

Last updated: 2026-08-27. This is a developing story; details verified as of 2026-08-27.