The ICO motor finance investigation moved from review to enforcement on 29 July 2026. The regulator executed search warrants at residential and business premises linked to five companies in Bolton, Burnley, Liverpool, London and Swansea. The five are suspected of sending 170 million text messages about motor finance claims between September 2025 and May 2026. None has been named and no findings have been made.
What the ICO did, and under what power
The warrants were applied for under the Privacy and Electronic Communications Regulations. PECR lets the ICO go to court for authority to search premises and seize evidence, and the regulator specified what it wants: mobile phones, laptops and sim farms. Andy Curry, the ICO’s head of investigations, said the searches send the sector a message: “comply with the law or expect to hear from us”.
The scale is what makes this unusual. Since September 2025 the ICO has taken more than 12 million complaints about motor finance nuisance texts, peaking at 100,000 in a day. Volumes at that level are not a compliance problem at the margins of a sector. The enforcement response has scaled accordingly.
Why this lands on law firms, and not only CMCs
The detail the trade coverage has largely passed over sits in the ICO’s own wording. The regulator urged everyone in the claims management sector to check their PECR compliance, naming three groups: lead generators, claims management companies, and law firms responsible for instigating direct marketing.
That last category is the one to read twice. PECR liability attaches to the person who instigates the marketing, not only to the person whose sim card sent the message. A firm that buys motor finance leads from a generator has instigated the marketing that produced them. If the consent behind those leads does not stand up, the firm’s position is no better for a third party having pressed send.
The action forms part of the joint regulatory taskforce of the ICO, the Financial Conduct Authority, the Advertising Standards Authority and the Solicitors Regulation Authority. Four regulators sharing information about the same firms is a different environment from four working separately. The SRA’s presence in that group means conduct findings can follow data protection ones.
Any firm buying motor finance leads needs to be able to evidence the consent behind them, because PECR liability follows the instigator rather than the sender. The practical test is whether the firm can produce, for a given lead, the record of what the individual agreed to and when. Where that record sits with the generator rather than the firm, the firm is relying on a supplier to discharge its own regulatory exposure.
How did the taskforce get here?
The taskforce set out its scope in spring 2026, and we covered its formation and the FCA’s parallel claims management review at the time. The searches are the first visible enforcement step since. They also sit alongside the FCA’s partly suspended motor finance redress scheme, which is what has kept claims volumes and marketing activity high through 2026.
The ICO has said it cannot comment further on the companies or the searches while enquiries continue. Investigations under PECR can end in monetary penalties, enforcement notices, or no action at all. Nothing published so far indicates which.
What should firms check now?
Three questions are worth putting to any firm taking motor finance work through third-party leads. Where did the consent come from, and can it be produced for an individual lead rather than described in the abstract? What does the supply contract say about PECR responsibility, and does that match what the regulations do? Who inside the firm signs off externally sourced marketing?
The ICO publishes a Direct Marketing Advice Generator for organisations working through their obligations. The FCA’s motor finance complaints pages carry the current position on the redress scheme generating the underlying claims.