Email Compliance

Marketing emails to individuals in the EU need their prior consent, with one narrow exception for existing customers. The rule comes from Article 13 of the ePrivacy Directive (2002/58/EC), and the GDPR governs the personal data behind every list.

When you need consent

• Newsletters and promotions to anyone who is not yet a customer.
• Emails promoting products unrelated to what a customer bought.
• Any address you bought, rented or scraped: consent given to someone else does not carry over to you.

Consent must be a clear, active choice: an unticked box or a separate sign-up, never a box ticked by default or a clause hidden in the terms. Double opt-in (a confirmation email) is not always mandatory, but it is the best proof that the person really signed up.

The soft opt-in for customers

You may email an existing customer without prior consent if all of these apply:

1. You got their email address in the context of a sale of a product or service.
2. You only promote your own similar products or services.
3. You gave them a clear, free and simple way to refuse when you collected the address.
4. Every message includes the same easy way to opt out.

Every message must

• Identify you as the sender, with a valid address.
• Contain a working, free unsubscribe link. Honour requests promptly and do not ask people to log in to unsubscribe.
• Be clearly recognisable as commercial communication.

Business addresses

Rules for emails to company addresses differ between member states: some apply the same consent rule, others allow B2B prospecting with an opt-out. Check the law of the country you send to. The GDPR still applies to named business addresses such as firstname.lastname@company.

This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.