It is an offence under the ePrivacy Regulations (SI 336 of 2011) to send an unsolicited marketing message to someone where there is no existing customer relationship. The onus is on the sender to show that the recipient has consented to the receipt of such messages. It is difficult to see how the operation of a "refer a friend" facility could meet this requirement.