Securiti Launches Industry’s First Solution To Automate Compliance


Email Marketing Requirements under GDPR and e-Privacy Directive

Published August 6, 2023 / Updated March 2, 2024

Listen to the content

Customers are never short of choices.

While that might be good for the market in the grander scheme of things, it makes things extra challenging for marketers. To design a campaign that breaks through the clutter of options customers have at all times, marketers need to establish clear communication with their potential customers.

There’s arguably no better way to do so than via emails. Organizations can send heaps of marketing and promotional content in addition to giveaways that capture the users’ attention among a sea of other emails they may have received.

For years, it seemed like the perfect tool. That is until the GDPR came into effect.

The GDPR heavily regulates how organizations and websites can target potential customers. As per the GDPR, the data subject’s consent is one of the legal bases of personal data processing. Consent is especially needed for using personal data for advertising and marketing purposes. So, the GDPR aims to protect the users' right to data privacy. This extends to when and how organizations can reach out to their potential customers via emails.

Other global privacy laws have similar provisions related to sending marketing communications to individuals.

So, with global data privacy regulations increasingly requiring organizations to obtain users’ consent before sending them any marketing communications, organizations must now re-evaluate their email marketing practices.

Here’s how they can start.

As a 2020 Privacy Study by the Advertising Research Foundation revealed, only 54% of people were comfortable sharing their emails online, down from 61% the previous year. The increasing number of people not willing to give consent to their data negatively impacts the marketing sector since it shrinks the database of customers to target. It is crucial to capture consent, engage, and build trust with customers while being legally compliant.

Failure to comply with applicable marketing requirements may expose organizations to excessive amounts of fines. Perhaps no other case illustrates this point better than the €9 million fine Austrian Post received from the Austrian Data Protection Authority for failing to adhere to a data subject request properly.

The data subject rights within the GDPR allow users to access, delete, or rectify personal data related to them. Austrian Post did allow users to make such requests via various mediums such as a web form, mail, or phone number.

However, the Austrian Post failed to provide an email address to users. Hence, depriving the users of a convenient method of exercising their data subject rights.

This begs the question, what steps do organizations need to take to stay compliant with applicable data privacy laws. This blog looks into the best email marketing practices under the European Union’s General Data Protection Regulation (GDPR) and e-Privacy Directive. It further delves into what an organization must do when an individual opts-out and if there is any exception to when an organization can send marketing communications without the individual’s consent.

How Does the GDPR Impact Email Marketing?

The GDPR directly impacts email marketing strategies. Email marketing under GDPR requires you to obtain freely given, specific, informed, and unambiguous consent (Article 32).

The GDPR only permits processing if the data subject has given consent or if there is another legal basis. This can involve, for instance, maintaining the controller's right to send marketing emails. Recital 47 expressly states that the law also applies to processing personal data for direct marketing as a legitimate interest of the controller.

As a business, you must implement these procedures to ensure compliance with the GDPR:

  • Enable an opt-in method,
  • Have proof of consent,
  • Enable an opt-out option,
  • Obtain consent for email marketing from legacy contacts.

Email Marketing Best Practices Under GDPR & e-Privacy Directive

GDPR and e-Privacy Directive prohibit organizations from sending direct marketing communications to individuals without first obtaining their consent. Such consent must be freely given, informed, specific, and unambiguous. Typically, organizations obtain consent from individuals by presenting them with a checkbox on their website asking whether they would want to receive marketing emails.

Let’s look into some of the best practices of email marketing for organizations aiming to comply with the GDPR and the e-Privacy Directive.

— Explicit Opt-In

Organizations must allow individuals to actively confirm their consent by taking affirmative action, such as ticking an unchecked opt-in box. Such a checkbox must not be pre-selected or pre-ticked by default, and the individual must actively select it themselves.

Organizations must ensure that an individual’s consent is specific to the purpose of sending marketing communications. Consent should not be bundled up as a non-negotiable part of the terms and conditions of a service or the organization’s privacy policy.

Organizations must provide an option to opt-out in every subsequent marketing email to the individual. This may be done by including language at the bottom of the marketing communication that instructs individuals on how they can opt-out.

For example:
If you do not wish to receive further marketing emails from us, please click here.

In addition, the opt-out must be free-of-charge, simple and as easy as giving consent.

The next question is what an organization must do when an individual opts out.

  • It must not send those individuals any further marketing emails nor contact them to invite them to opt back into marketing,
  • It must delete the personal data collected to send marketing emails. However, an organization may suppress personal data only to ensure that those individuals are not sent any more marketing emails unless they opt back in at a later stage,
  • Suppression of personal data involves retaining just enough information to ensure that the individual’s preferences are respected in the future. An organization must always inform individuals about such suppression so that they may ask it to remove or delete their details entirely,
  • Honor the opt-out request promptly and avoid any unnecessary delay.

— Soft Opt-In Exception

GDPR and e-Privacy Directive allow organizations to send marketing communications to individuals whose details they obtained in the context of the sale of a product or service i.e. existing customers without making them select an opt-in checkbox. This is referred to as the soft opt-in exception. However, to rely on a soft opt-in exception and send marketing emails to individuals without their consent, the following conditions should be fulfilled:

  • The organization obtained the individual’s contact details in the context of the sale of its product or service,
  • The individual did not opt-out at the time of providing their personal data, and a clear  and distinct opt-out ability was provided to them at the time their details were being collected,
  • The organization must send marketing emails only about its products and services and similar products and services for which the individual’s details were initially collected,
  • The organization must clearly and distinctly remind individuals about their ability to opt-out at every subsequent marketing communication,
  • Opt-out should be simple, free-of-charge, both at the time of the collection of the personal data from individuals and in each subsequent marketing communication.

The interpretation of the term “in the context of the sale of a product or service” may differ from one EU member state to another.

Most EU countries allow you to send marketing communications to existing customers via opt-out checkbox only if a sale transaction has taken place with them. There has to be a transaction (purchase/service agreement) in which you were or are obliged to deliver something and the customer to pay for it. Someone is not an existing customer if they have not yet purchased anything but only registered for your newsletter, completed a survey, participated in a contest/game, or created a user account.

In the United Kingdom, however, the individual does not have to buy anything to trigger the soft opt-in exception, but it should be enough if negotiations for sale take place. For example, if an individual completes an online inquiry form asking for more details about a product or range of products. In that case, this should be enough to constitute negotiations for a sale since they have expressed an interest in buying the organization’s products or services - for example, by requesting a quote, or asking for more details of what it offers. However, such emails must be related to similar products or services.

On the other hand, different member states of the European Union may take a different stance, such as that a transaction must take place in order to rely on the soft opt-in exception. Therefore, organizations are encouraged to look into specific requirements relevant to their particular jurisdiction.

In all cases, organizations must ensure the conditions required for utilizing the soft opt-in exception.

Purchased Marketing List - A Viable Option?

Many companies capture cold leads from a purchased list from a third party. However, buying and scraping marketing lists from another source is generally prohibited under the GDPR and e-Privacy Directive framework since it defeats the purpose of obtaining consent from the user. In such a situation, organizations must undertake due diligence on whether the individuals named in the marketing list consented to share their information with that particular organization and agreed to receive marketing emails. Organizations may cross-reference purchased marketing lists against their own “Do-Not-Contact” list of people who have previously objected to or opted out of its marketing emails.

While relying on a purchased marketing list for sending marketing emails, an organization must inform the individual about its identity, contact details, the source from where it obtained their information, and, if applicable, whether their details came from publicly accessible sources. This information must be provided to the individual upon their first communication with the individual. In addition, an organization must always provide the option to opt-out.

However, where an organization is unsure whether individuals in the purchased marketing list consented to share their personal data for direct marketing purposes, it must not rely on such a list.

Email Marketing Requirements Under Other Regulations

For countries not based on opt-in consent regimes, such as the United States, organizations are allowed to send marketing emails without obtaining an individual’s consent. However, as a matter of best practice, the organization must always inform individuals that their personal data will be used to send marketing communications and allow them to opt-out. Moreover, such organizations must honor opt-out requests promptly, thereby not sending any further marketing emails to individuals who have opted out or contacting them to invite them to opt back into marketing. In addition, opt-out requests must be promptly and immediately honored. As per the US CAN-SPAM Act, opt-out requests must be honored within 10 business days.

How Can Securiti Help

Using consumers’ data without consent can land an entity into hot waters, as was the case with Google. The day GDPR went live, privacy rights groups sued Google for not obtaining valid consent to process its consumers’ data for ad serving and personalization.

The case was handled by France’s data regulatory authority, Commission Nationale de l'informatique et des libertés, which ruled that Google disseminated information on how consumer data will be used across several documents and confused customers regarding their data ultimately being used.

The result: Google was fined 50 million euros (£44m) for breaching GDPR’s consent acquisition clause. Moreover, Google’s troubles with the GDPR are far from over, as illustrated by the recent Google Analytics fiasco.

Data collection is growing, and marketing companies will have a hard time managing consent for all this data. Securiti’s Universal Consent Management solution enables organizations to capture users’ consent and revocation fulfillment effectively and advertise their products and services efficiently and compliantly, thereby respecting an individual’s privacy and avoiding any potential legal consequences.

The Universal Consent Management Solution streamlines the consent management process and helps organizations efficiently and adequately honor consent preferences across multiple systems.

Key Takeaways:

  1. Increasing Importance of Consent: With the GDPR in effect, obtaining explicit, informed, and unambiguous consent from individuals before sending marketing emails has become crucial. This reflects a broader global trend towards stricter data privacy regulations requiring consent for processing personal data for marketing purposes.
  2. Impact of GDPR on Email Marketing: Email marketing strategies must now ensure that individuals actively opt-in for marketing communications, with clear options provided for opting out in every communication. This requirement mandates that organizations must adopt transparent practices in obtaining and managing consent.
  3. Best Practices for Email Marketing: Organizations should follow several best practices to remain compliant, including explicit opt-in mechanisms, separating consent from terms and conditions, simplifying consent withdrawal, and ensuring transparency about the use of personal data for marketing purposes.
  4. Soft Opt-In Exception: GDPR and e-Privacy Directive allow for a "soft opt-in" exception where organizations can send marketing communications to existing customers or those who have engaged in negotiations for a sale, under certain conditions. This exception, however, varies by jurisdiction within the EU and requires careful consideration by organizations to ensure compliance.
  5. Challenges with Purchased Marketing Lists: Utilizing purchased marketing lists for email marketing is generally not compliant with GDPR and e-Privacy Directive, as it bypasses the consent requirement. Organizations must exercise due diligence to ensure individuals on these lists have consented to receive marketing communications specifically from them.
  6. Requirements Under Other Regulations: Outside the EU, such as in the United States, regulations like the CAN-SPAM Act allow for marketing emails without prior consent but require a clear opt-out mechanism and prompt honoring of opt-out requests.
  7. Consequences of Non-Compliance: Failure to comply with GDPR and similar regulations can lead to significant fines and penalties, as illustrated by the €9 million fine imposed on Austrian Post. This underscores the importance of adhering to legal requirements in email marketing practices.
  8. Role of Consent Management Solutions: Solutions like Securiti’s Universal Consent Management can help organizations efficiently manage consent preferences, ensuring compliance with GDPR and other data protection laws while respecting individuals' privacy rights.

Frequently Asked Questions (FAQs)

Yes, GDPR applies to email marketing as it involves processing personal data for communication purposes.

GDPR rules for emailing include obtaining explicit consent for sending marketing emails, providing clear opt-in mechanisms, including an option to unsubscribe, and respecting individuals' rights.

Yes, you can send emails under GDPR, but you must ensure that you have a legal basis for processing the recipient's personal data and that you comply with their rights.

Gmail is a service provided by Google, and Google has taken steps to make its services, including Gmail, GDPR compliant by implementing privacy features and measures.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


More Stories that May Interest You