UK Beauty Salons: The PECR Ban and Council Licence Reckoning

PECR + UK GDPR — the two-headed consent problem

Direct marketing by electronic means — SMS, email, WhatsApp broadcast, in-app push — is governed in the UK by two distinct but overlapping regimes: the Privacy and Electronic Communications Regulations 2003 (PECR, implementing the earlier EU ePrivacy Directive and amended repeatedly since) and the UK GDPR + Data Protection Act 2018 (post-Brexit domestication of the EU GDPR with subsequent UK-specific amendments including the DPDI Bill superseded by the Data (Use and Access) Act 2025 as it progresses).

PECR Regulation 22 — unsolicited electronic marketing. Regulation 22 prohibits sending unsolicited direct marketing communications by electronic means to an individual subscriber without prior consent. The narrow 'soft opt-in' exception (Reg 22(3)) applies only where (a) the individual's contact details were obtained in the course of a sale (or negotiations for a sale) of a product or service; (b) the marketing is for the sender's own similar products or services; (c) the individual was given the opportunity to opt out at the point of collection and in every subsequent message; and (d) the individual has not opted out.

How this hits a beauty salon. Buying a contact list and blasting a WhatsApp campaign to it — Regulation 22 breach, ICO enforcement territory. Sending a rebooking reminder to an existing regular customer whose contact was captured at their last appointment — soft opt-in applies if the four conditions above are all met and an easy opt-out is offered. Sending a promotional message about a new IPL machine to a nail-only customer — probably not 'similar' enough, safer to obtain fresh consent.

PECR fines. Up to £500,000 per breach under the existing regime (this cap sits alongside the UK GDPR administrative fine regime which reaches significantly higher tiers — the ICO can and does use both). ICO enforcement notices are published, so reputational cost is real.

UK GDPR — lawful basis. Article 6 requires a lawful basis for every processing activity — consent (Article 6(1)(a)), contract (6(1)(b)), legal obligation (6(1)(c)), vital interests (6(1)(d)), public task (6(1)(e)), or legitimate interests (6(1)(f)). For appointment booking, contract is often the correct basis. For marketing broadcast, PECR consent + UK GDPR consent align (marketing consent under PECR is a UK GDPR-standard consent).

UK GDPR sensitive data. Article 9 identifies special category data — including health data, biometric data used for identification. Salon customer records that touch on skin conditions, allergies (patch test outcomes), pregnancy (safety-related), medical conditions (bloods work, chemo hair loss, wig fitting) are health data — Article 9 consent or another Article 9(2) condition required.

DPA, DPO, breach. Data Protection Agreement with every processor (WhatsApp BSP, panel SaaS, booking software, payment processor); DPO not typically required for a single-salon SMB but larger chains cross Article 37 thresholds; breach notification to ICO within 72 hours of awareness where risk to rights and freedoms.

Local council Special Treatments Licence — the layer few vendors mention

Greater London. Under Part II of the London Local Authorities Act 1991 (as amended by London Local Authorities Act 2007 and later), most London boroughs require a Special Treatments Licence for premises offering 'special treatments' — the definition covers massage, manicure, chiropody, light, electric, or other special treatment, sauna and steam bath, acupuncture, ear piercing, tattooing, cosmetic piercing, electrolysis, semi-permanent skin colouring (including microblading), colonic irrigation, and various specific procedures. The licensing borough inspects premises, verifies practitioner qualifications, and issues an annual licence (fee varies by borough — typically several hundred pounds).

Salon-specific vs individual-practitioner. In most London boroughs the licence is premises-based; individual practitioners work under the premises licence.

Outside London. The framework is the Local Government (Miscellaneous Provisions) Act 1982, sections 13-17 (skin piercing, tattooing, semi-permanent makeup, electrolysis, acupuncture — under section 15 which councils may adopt) and section 14 (special treatment premises — under sections 13-14 which few councils outside London adopt in the same way). Adoption is discretionary — councils choose to bring in the licensing regime. Manchester, Birmingham, Bristol, Leeds, Newcastle, Liverpool and other major cities operate adopted or council-specific licensing schemes; some smaller councils operate byelaws instead; some operate no scheme.

Scotland and Northern Ireland. Different regimes — Scottish councils operate licensing under the Civic Government (Scotland) Act 1982 with skin piercing and tattooing licensing under the Civic Government (Scotland) Act 1982 (Licensing of Skin Piercing and Tattooing) Order 2006; Northern Ireland uses the Local Government (Miscellaneous Provisions) (Northern Ireland) Order 1985 adapted per council.

Aesthetics-adjacent. Botox / dermal fillers / laser IPL typically require additional considerations — the person administering must be a suitably qualified professional; the premises may require CQC registration if the activity falls under regulated activities (this is nuanced — CQC regulates 'regulated activities' as defined; cosmetic injectables have historically fallen partly outside CQC unless surgical or otherwise scoped in). The DHSC ran a consultation on non-surgical cosmetic procedures (closed 2023) with a response in May 2023 outlining a phased licensing scheme; implementing regulations are being developed. Salons offering these services should track the JCCP (Joint Council for Cosmetic Practitioners) practitioner register and the Save Face register as the current voluntary accreditation frameworks.

Panel implication. A WhatsApp panel can help capture booking, deposits, patch-test scheduling, and consent — but cannot substitute for the underlying premises and practitioner licensing. Salons occasionally use WhatsApp booking flows for treatments they are not licensed to perform (offering microblading without a Special Treatments Licence, for example) — this is a compliance breach at the underlying licence layer, not a panel choice issue.

HSE + COSHH — the chemicals compliance most salons under-estimate

Health and Safety at Work etc. Act 1974 — the employer has a duty to ensure, so far as reasonably practicable, the health, safety and welfare at work of all employees (section 2) and to conduct undertakings so that persons not in employment (i.e. customers) are not exposed to risks (section 3).

Control of Substances Hazardous to Health Regulations 2002 (COSHH). COSHH applies to substances that can cause harm to health — a salon uses many: hair colour (paraphenyl diamines), bleach/peroxide, ammonia in hair colour, acrylic monomers in nail extensions, methacrylate (MMA banned since 2020 in cosmetic use), acetone, formaldehyde, and — for salons offering waxing — hot wax handling. COSHH duties include:

• Risk assessment for each hazardous substance — what harm can it cause, who is exposed, how often, at what concentration.
• Control measures — ventilation, PPE (gloves, masks, aprons, eye protection), safe handling procedures, spill management.
• Information, instruction, training for staff.
• Maintenance of controls — extract fans, LEV (Local Exhaust Ventilation) tested annually.
• Health surveillance where appropriate.
• Emergency planning for spills and exposure.

Reporting. RIDDOR (Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013) applies — chemical burn to a customer, occupational asthma from acrylic dust, any incident requiring hospital treatment: reportable.

Fire safety. Regulatory Reform (Fire Safety) Order 2005 in England and Wales — fire risk assessment, escape routes, alarms, extinguishers. Nail salons using acetone are particularly attentive here.

Business insurance. Public liability and employer's liability insurance — employer's liability is a legal requirement under the Employers' Liability (Compulsory Insurance) Act 1969 (minimum £5 million cover, though most policies are £10M). Public liability recommended £2-5M.

Panel implication. WhatsApp panels can help — patch-test reminders 48h before hair colouring, allergy questionnaires captured pre-appointment, safety information sent post-service. But COSHH compliance itself is a physical-premises-and-training matter that no digital tool replaces.

HMRC + MTD + VAT — the tax layer that shapes the booking flow

VAT registration threshold. The VAT registration threshold in the UK is set annually (currently £90,000 taxable turnover as of April 2024 — verify current HMRC guidance). A salon crossing the threshold in the last 12 months (or expected to cross in the next 30 days) must register within 30 days.

VAT rate. Standard rate 20% on most services and products. Certain products (books, children's clothes) are zero-rated but not typically relevant to a salon.

Making Tax Digital (MTD) for VAT. Mandatory for all VAT-registered businesses since April 2022. VAT returns must be submitted through MTD-compatible software with digital links from records to return. HMRC-recognised software: Xero, QuickBooks, Sage Business Cloud, FreeAgent, Kashflow, Bokio, Zoho Books UK, Wave (limited MTD), plus bridging software (VitalTax, ANNA Money, AbraSoft's My Tax Digital) for those keeping records in spreadsheets.

MTD for Income Tax Self Assessment (MTD ITSA). Phased in — sole traders and landlords with income above set thresholds move to quarterly digital submission on a staggered schedule. Verify current HMRC schedule as the government has revised phasing multiple times.

Digital sales — DAC7 / OECD reporting. If the salon also generates income via marketplace platforms (rare for services but relevant if the salon rents chairs), DAC7 reporting to HMRC by platforms is now live.

Corporation Tax vs Self-Employment. Sole-trader salon owners pay Income Tax + Class 2/Class 4 NICs; incorporated salons (Ltd company) pay Corporation Tax on profits (rates vary — 19% small profits rate, 25% main rate, marginal relief).

Panel implication. WhatsApp bookings that produce revenue must flow into the accounting system that produces the MTD VAT return. Direct integrations from booking SaaS (Fresha/Booksy/Treatwell/Timely/Phorest) into Xero or QuickBooks are common; WhatsApp panels typically deliver the payment link and confirmation and route the reconciliation to the booking software or accounting system.

The UK salon payment stack — Stripe, GoCardless, Klarna, Square, SumUp

The UK is a card-first market with a distinctive open-banking payment layer:

Card acquiring. Stripe UK — dominant among modern SaaS and ecommerce; standard fee ~1.5% + 20p for UK/EEA cards, higher for international, subject to volume discounts. Square UK — flat-rate 1.75% for in-person, 1.4% + 25p for online for European cards (check current). SumUp — flat ~1.69% typical for card. Zettle by PayPal — competitive for small salons. Worldpay from FIS, Barclaycard Payments, Elavon, AIB Merchant Services for larger merchants with negotiated MSC (Merchant Service Charge).

Open Banking / A2A payment. GoCardless dominant for recurring Direct Debit (BACS) — memberships, packages, monthly retainers; fee ~1% + fixed. TrueLayer, Yapily, Tink for open banking rails.

Buy Now Pay Later. Klarna (Sweden, UK large), Clearpay (Afterpay), PayPal Pay in 3, Zilch — for larger packages (bridal package £2,000, hair extension install £600-1,500). Under new UK regulation (FCA taking BNPL under regulation with SI 2024 draft) — BNPL providers will need FCA authorisation, transitional period being finalised. Salons using BNPL should track the BNPL rules going live.

Digital wallets. Apple Pay, Google Pay ubiquitous on modern terminals.

FPS + CHAPS + Bacs. Faster Payments Service (real-time up to £1M per payment for most banks), CHAPS (same-day high-value), Bacs (three-day Direct Debit and Direct Credit) — used for salon-owner bank operations more than customer-facing.

Cash. Still meaningful for tips, though card-dominant for service payment. HMRC declared tip legislation in the Employment (Allocation of Tips) Act 2023 — employers must pass 100% of tips to workers, distribute fairly, keep records.

WhatsApp Pay is not launched in the UK. In-chat payment routes through Stripe/Square/SumUp/Klarna links or a booking-SaaS deposit link.

Booking SaaS vs WhatsApp panel — the honest split

The UK beauty vertical has strong incumbent booking SaaS with rich salon-specific features (stylist calendars, service durations, deposits, patch tests, packages, gift vouchers, product retail). WhatsApp adds a conversational layer on top rather than replacing:

Fresha — freemium booking SaaS with strong marketplace and integrated payments. Reported strong UK adoption in hair, beauty and wellness verticals with hundreds of thousands of businesses globally.

Treatwell — marketplace-first with booking software; commission on marketplace bookings, subscription for own-channel bookings.

Booksy — US-headquartered, strong UK penetration particularly in barbering; subscription-based with marketplace element.

Timely — New Zealand-founded, EMEA presence, tiered subscription.

Phorest — Ireland-founded, strong UK/Ireland footprint, reporting-heavy platform.

Salonlite — UK-focused, smaller footprint but tailored.

Meevo (Millennium Systems), Zenoti, Vagaro — US-headquartered platforms present in UK enterprise salons.

Where WhatsApp fits. (a) Inbound enquiry handling — 'do you have availability for a balayage Saturday' → auto-reply with next available slots. (b) Booking confirmation and reminder — reduces no-shows meaningfully vs SMS-only. (c) Post-service care instructions and product recommendations. (d) Retention broadcast to opted-in customers segmented by service.

Panels that fit UK salon workflows.

• Salon-specific panels (Fresha/Booksy/Treatwell WhatsApp add-ons where available).
• General panels with booking-SaaS integration — Wati (HK), BossBot, Sleekflow (SG/HK), Kommo (US), HubSpot Service Hub — connected to the booking SaaS via native connector or Zapier / Make bridge.
• UK-specific WhatsApp aggregators — Esendex, Text Anywhere, Textmagic (some support WhatsApp Business Platform via BSP partnerships).

What to avoid. Standalone WhatsApp panels with no connection to the booking system produce double-entry work and out-of-sync calendars — the fastest way to double-book chairs and lose customer trust.

The five recurring mistakes UK salons make with WhatsApp automation

(a) PECR broadcast without consent. Downloading a customer list from the booking SaaS and blasting a promotional message about a new brow-lamination service is the classic PECR breach. The soft opt-in exception is narrow — 'similar' products/services to the original purchase, easy opt-out at every stage, active-customer test. Blast marketing to lapsed customers or non-similar services requires fresh consent.

(b) No DPA with the WhatsApp SaaS vendor. UK GDPR Article 28 requires a written contract between controller and processor covering the specific data protection requirements. Signing a click-through vendor T&C without a DPA (or with a US-standard DPA that doesn't reference UK GDPR + IDTA/UK Addendum for international transfers) fails an ICO audit.

(c) Trading without the Special Treatments Licence. In London boroughs where the licence is required, offering listed treatments without a licence is a criminal offence (fine level 5 on the standard scale = unlimited fine since Legal Aid, Sentencing and Punishment of Offenders Act 2012). WhatsApp automation can make an unlicensed operator MORE discoverable — a compounding risk.

(d) Confusing 'patch test complete' with informed consent for aesthetics. A WhatsApp confirmation of a patch test 48h before hair colouring is a safety step, not informed consent for a treatment. Aesthetics-adjacent (dermal fillers, IPL, radiofrequency) requires a documented consultation, medical history, informed consent, and aftercare — separate from any chat automation.

(e) Missing the tip legislation. The Employment (Allocation of Tips) Act 2023 imposes on employers specific duties on tip distribution and record-keeping. A WhatsApp-driven card payment that includes a service charge must be handled per the Act.