GDPR and Email Marketing: A Plain-English Guide

If you send marketing emails to people in the European Union or the United Kingdom, the General Data Protection Regulation (GDPR) shapes how you collect addresses, what you tell people, and how you store their data. Some parts are genuinely complicated, but the core ideas for email marketers are fairly intuitive: be clear with people, have a good reason to email them, let them leave easily, and look after their data. This guide explains those ideas in plain English and briefly compares the US approach.

Two sets of rules: GDPR and ePrivacy

A common source of confusion is that email marketing in Europe is governed by two overlapping sets of rules:

• The GDPR covers personal data in general: how you collect it, the legal reason you have for using it, what you tell people, how long you keep it, and who you share it with. An email address that identifies a person is personal data. You can read the official GDPR text on EUR-Lex.
• The ePrivacy rules come from an EU directive (the ePrivacy Directive) that each country has implemented in its own national law. These rules deal specifically with electronic marketing, including when you may send unsolicited marketing emails. In the UK, the equivalent rules are known as PECR, and they sit alongside the UK GDPR.

In practice, the ePrivacy-based rules usually decide whether you may send a marketing email, and the GDPR governs how you handle the data. Because each country implemented the ePrivacy Directive separately, the details, especially around existing customers and business contacts, vary.

Lawful basis: why you are allowed to email someone

Under the GDPR, every use of personal data needs a lawful basis. For email marketing, two are commonly discussed: consent and legitimate interests.

Consent

For marketing emails to individuals, the ePrivacy-based rules in most EU countries and the UK generally require consent. That makes consent the default starting point for most newsletters and promotional emails.

Legitimate interests and the “soft opt-in”

The GDPR recognizes that direct marketing may be a legitimate interest. However, that does not override the separate ePrivacy rules on sending marketing emails. Where those rules require consent, legitimate interests alone are generally not enough.

There is an important exception in the ePrivacy Directive, often called the soft opt-in. Broadly, it may allow you to email your own existing customers without separate consent when:

• you obtained their email address in the context of a sale (or, in some countries, negotiations for a sale) of a product or service;
• you are marketing your own similar products or services; and
• you gave them a clear, simple, free way to opt out when you collected their address, and you repeat that opportunity in every email.

How this works in practice differs by country. Some interpret “sale” and “similar products” narrowly, some have extra conditions, and some apply it differently to charities or non-commercial organizations. If you rely on soft opt-in, check your national regulator’s guidance.

What valid consent looks like

The GDPR sets a high bar for consent. In short, it must be:

• Freely given. People have a genuine choice. Making consent to marketing a condition of something unrelated can be a problem.
• Specific. Consent to marketing emails should be separate from, for example, agreeing to your terms of service.
• Informed. People know who you are and what they are signing up for.
• Unambiguous. It requires a clear affirmative action, such as ticking an empty box or submitting a signup form that clearly explains what it is for. Silence, pre-ticked boxes, and inactivity do not count.

You also need to be able to show that someone consented, and withdrawing consent must be as easy as giving it.

Here is how that might look in practice. These are illustrative examples, not legal templates:

Probably fine	Likely a problem
A newsletter form that says “Get our monthly tips by email. Unsubscribe anytime.”	A checkout with a pre-ticked “Send me offers” box
An unticked, optional checkbox for marketing at checkout	Adding everyone who downloads an invoice to the newsletter
A QR code at the counter leading to a clear signup form	Copying business cards from an event into your list
Separate checkboxes for different types of email	Buying or renting an email list

For practical, consent-friendly ways to grow your list, see how to build an email list.

Double opt-in as evidence

With double opt-in, someone who signs up receives an email asking them to confirm by clicking a link. Only after they click are they added to your list.

The GDPR text does not explicitly require double opt-in. But it is widely used because it:

• creates a record that the owner of the address actually agreed;
• prevents people from signing up others, maliciously or by typo; and
• tends to produce a cleaner list, which helps deliverability.

Whether you use single or double opt-in, keep records of when, where, and how each person signed up, and what they were told. Many email platforms store signup date, source, and IP address automatically. Check what yours records.

Privacy notice: tell people what you do

The GDPR requires you to give people certain information when you collect their data. For email marketing, that usually means a privacy notice (often a page on your website) linked from your signup forms, covering things like:

• who you are and how to contact you;
• what data you collect and why;
• your lawful basis;
• which service providers process the data (for example, your email platform);
• whether data is transferred outside the EU or UK, and on what basis;
• how long you keep it; and
• people’s rights, including to access, correct, or delete their data, and to complain to a regulator.

Unsubscribe: make leaving easy

Every marketing email should include a clear, working unsubscribe link. Unsubscribing should be simple, with no login and no hoops. Honor requests promptly and keep the address on a suppression list so you do not accidentally email that person again after a future import.

It also helps deliverability: people who cannot easily unsubscribe are more likely to mark your emails as spam. See our email deliverability checklist.

Data retention: do not keep data forever

The GDPR’s storage limitation principle means you should not keep personal data longer than you need it. For email marketing, sensible practices include:

• deciding on a retention approach for inactive subscribers, for example running a re-engagement campaign and then removing those who do not respond;
• deleting data you no longer use, such as old imported lists or stale form submissions; and
• stating your approach in your privacy notice.

Choose a period you can justify and apply it consistently. Our segmentation guide explains how to identify inactive subscribers.

Processor agreements (DPAs) with your email platform

When you use an email marketing platform, you are usually the controller (you decide why and how the data is used) and the platform is a processor (it handles the data on your behalf). The GDPR requires a written contract between controller and processor, commonly called a data processing agreement or DPA.

Most established email platforms offer a standard DPA, sometimes built into their terms and sometimes as a separate document you accept or sign. When choosing a platform, check:

• that a DPA is available and covers the services you use;
• where data is stored and how international transfers are handled;
• which sub-processors are involved; and
• what security measures are described.

Our guide on how to choose email marketing software includes other factors worth comparing.

Customers vs prospects

The distinction between existing customers and people who have never bought from you is central to European email rules:

• Existing customers may, in many countries, be emailed about your own similar products or services under the soft opt-in, as long as they were given a chance to opt out at the start and in every message.
• Prospects, such as website visitors, social media followers, or people you met at an event, generally need to give consent before you send them marketing emails.

When in doubt, asking for consent is the safer route.

B2B: it depends on the country

Rules for emailing business contacts vary considerably. The ePrivacy Directive leaves member states room to decide how much protection to give to businesses as subscribers, so:

• some countries apply similar consent rules to business email addresses as to personal ones;
• others are more permissive for emails sent to corporate addresses; and
• in the UK, PECR’s email marketing rules generally do not apply to corporate subscribers in the same way, though sole traders and some partnerships are treated like individuals.

Even where consent rules are looser, the GDPR still applies if you are processing data about an identifiable person, such as firstname.lastname@company.com. That means transparency, a lawful basis, and respecting objections still matter.

Default for individuals

Consent, in most EU countries and the UK

Main exception

Soft opt-in for existing customers (varies by country)

Consent must be

Freely given, specific, informed, unambiguous

Every email needs

A clear, easy unsubscribe

With your platform

A data processing agreement (DPA)

B2B rules

Differ between countries

How the US approach differs: CAN-SPAM

In the United States, commercial email is mainly governed by the CAN-SPAM Act. Its approach is quite different from Europe’s. CAN-SPAM generally does not require consent before sending commercial email. Instead, it is largely an opt-out model: you may email people, but you must follow certain rules and stop when they ask.

According to the FTC’s CAN-SPAM compliance guide, the main requirements include:

• do not use false or misleading header information;
• do not use deceptive subject lines;
• identify the message as an ad (the guide notes there is some flexibility in how);
• tell recipients where you are located, including a valid physical postal address;
• tell recipients how to opt out of future email;
• honor opt-out requests promptly (the guide specifies a time limit); and
• monitor what others do on your behalf, since you can remain responsible.

CAN-SPAM applies to commercial email in general, including business-to-business messages. Permission is still wise in the US: emailing people who never asked to hear from you tends to hurt deliverability.

Other countries differ

Many other countries have their own rules, and they do not all follow either the European or US model. For example, Canada’s anti-spam legislation (CASL) is consent-based: it generally requires consent before sending commercial electronic messages, along with identification and a working unsubscribe mechanism. Australia, Brazil, and many others have their own frameworks too. If you have subscribers in several countries, the rules of the recipients’ countries may apply, not only your own.

A simple compliance checklist

This is a starting point, not a complete legal audit:

1. Know your lawful basis for each part of your list, and whether consent or soft opt-in applies.
2. Use clear signup forms with no pre-ticked boxes.
3. Consider double opt-in, and keep records of how and when people signed up.
4. Publish a privacy notice and link it from your forms.
5. Include a working unsubscribe link in every marketing email and honor it promptly.
6. Set and apply a retention approach for inactive subscribers.
7. Make sure you have a DPA with your email platform.
8. Check the rules for business contacts in the countries you email.
9. Never buy or rent email lists.
10. Review your setup periodically, and ask a professional when in doubt.

For the bigger picture of how email marketing fits together, see our email marketing guide.