GDPR and email marketing: what to know before you send to Europe

You don't need an office in the EU for GDPR to reach you. Sell to people in the Union and email them, and their addresses fall under it. The top fine for serious breaches is 20 million euros or 4% of worldwide turnover for the previous year, whichever is higher.

What GDPR is, and why your list is covered

GDPR, the General Data Protection Regulation, is Regulation (EU) 2016/679. It was adopted in 2016, has applied since 25 May 2018, and binds every member state directly, with no national law needed to switch it on.

Article 4(1) defines personal data as any information about a person who can be identified, directly or indirectly. An address like anna.schmidt@example.de points at one person on its own. A shared inbox such as info@ says less, until it sits in your CRM next to a name and an order history. "Processing" under Article 4(2) is any operation on that data, so collecting, storing, segmenting, exporting, sending to it and even deleting it all count.

Territorial reach comes from Article 3. A company with no EU establishment is covered when it offers goods or services to people who are in the Union, or monitors their behaviour there. Citizenship is irrelevant. A shop in Toronto that ships to Germany and mails its German customers is inside the scope.

There is a deliverability angle as well. Someone who doesn't remember subscribing hits "Report spam", and Gmail asks senders to keep the spam rate shown in Postmaster Tools below 0.1% and never let it reach 0.3%. Complaints from your EU segment count toward the same number as everyone else's.

Where the consent rule actually comes from: GDPR and ePrivacy

The rule that marketing email needs permission isn't in GDPR at all. It sits in Article 13(1) of the ePrivacy Directive (2002/58/EC), which allows email for direct marketing only to people who gave prior consent. Directives work through national law, so in Germany you find it in section 7 of the Act Against Unfair Competition (UWG), which calls email advertising without the recipient's prior express consent an unacceptable nuisance.

GDPR answers a different question, namely what counts as consent. The directive originally pointed to the definition in the old Directive 95/46, and Article 94(2) of GDPR says those references now mean GDPR. That is why the consent standard in the next section applies to your signup form.

There is one exception, usually called soft opt-in (ePrivacy Article 13(2)). If you got a customer's email address while selling them a product or service, you may market your own similar products to them without separate consent. The customer must be offered a free, easy way to object both when the address is collected and in every message. Partner offers don't qualify. Neither does a newsletter subscriber who never bought anything.

Article 13(4) adds two more conditions for any marketing email: the sender's identity can't be hidden, and there has to be a valid address the recipient can use to make it stop.

What valid consent looks like

Under Article 4(11), consent has to be freely given, specific, informed and unambiguous, and expressed by a statement or a clear affirmative action. For a signup form that means four checks.

• 1. Freely given. Saying no costs the person nothing. Article 7(4) asks whether a service was made conditional on consent it doesn't need, so "subscribe to download the PDF" holds up only if the PDF is also available without subscribing.
• 2. Specific. The consent request must stand apart from other terms (Article 7(2)). One "I agree to everything" box fails, and so does "by clicking Buy you agree to receive our newsletter". Buying and subscribing are two decisions, each needing its own opt-in.
• 3. Informed. The person knows who will email them and about what. "Weekly store news" does that; a bare "Newsletter" doesn't.
• 4. Unambiguous. It takes an active step: a box the user ticks, a button they press, an address typed into a clearly labelled form. Recital 32 spells it out, saying silence, pre-ticked boxes and inactivity are not consent.

The burden of proof is yours. Article 7(1) says the controller must be able to demonstrate consent, so keep the date and time, IP address, form wording at signup, page URL and the version of the privacy policy that was live then. That record is what you will point to when a complaint arrives.

Double opt-in: not in the text, but hard to prove consent without it

The words "double opt-in" don't appear in GDPR. The mechanism is simple. Someone enters an address, gets an email with a link, clicks it, and only then lands on your list.

Why bother with the second step? Go back to Article 7(1). A ticked box proves that somebody typed an address, not that the mailbox owner did, and anyone from a prankster to a bot can sign up someone else's inbox. The confirmation click comes from the mailbox itself. In Germany, where UWG demands prior express consent for email advertising, double opt-in has become the usual way to document it.

A side benefit is that typos like gmial.com and junk addresses never reach the list, because nobody is there to confirm. Our comparison of double opt-in and single opt-in covers when one step is enough.

Legitimate interest: where it works and where it doesn't

Article 6(1) lists six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Email marketing arguments are almost always about the first and the last, consent versus legitimate interest under Article 6(1)(f).

Recital 47 does say that processing for direct marketing may be regarded as a legitimate interest. The interest still has to be weighed against the person's rights, taking into account what they would reasonably expect from their relationship with you, and that balancing is written up as a Legitimate Interest Assessment (LIA). A past customer may well expect an offer on a related product. Somebody on a purchased list expects nothing from you.

For email, ePrivacy sits on top. Even with a legitimate interest under GDPR, the directive lets you skip consent only within soft opt-in, meaning your own customers and your own similar products. Cold outreach to new EU contacts can't lean on legitimate interest. Business addresses are less uniform, because Article 13(5) leaves the protection of legal persons to each member state, so check B2B sends against the law of the country concerned.

Transactional email is outside this debate. Order confirmations, shipping notices and password resets rest on performance of a contract (Article 6(1)(b)) and need no marketing consent. Where the line falls is covered in transactional vs marketing email.

Subscriber rights and response deadlines

Data subject rights live in Articles 12 to 22. You must reply without undue delay and in any case within one month of receiving the request. Complex or numerous requests allow an extension of two further months, but you have to tell the person about it, with reasons, inside that first month (Article 12(3)). Replies are free of charge (Article 12(5)).

Settle the procedure for each right before the first request shows up: who takes it, how identity is verified, where the outcome is logged. Articles 5(2) and 24 make the controller responsible not only for complying but for being able to demonstrate it.

Data storage: collect less, keep it shorter

Data minimisation (Article 5(1)(c)) limits you to what the stated purpose needs. Email needs an address. A first name earns its place if you greet people by name. Birth date, phone and city only make sense for a specific purpose written into your processing policy.

Storage limitation (Article 5(1)(e)) forbids keeping data longer than necessary. The regulation names no number of months. You set the period and tell subscribers at collection either the period itself or the criteria used to work it out (Article 13(2)(a)). For email the natural criterion is engagement: an address that hasn't opened or clicked in a long time is a cue to ask whether the person still wants your mail, and to delete it if there's no answer. Choose the cut-off yourself, write it into the policy and let your ESP run the deletion.

Your ESP and third-party tools: compliance does not delegate

Your ESP, CRM, analytics platform and address verification service all handle subscriber data on your behalf, which makes them processors. Article 28 lets you use only processors that give sufficient guarantees, and requires a contract with each one setting out the data, the purposes and the security measures. That contract is what people call a Data Processing Agreement (DPA). Under Article 28(3)(g), when the service ends the processor deletes the data or returns it, at your choice, and erases the copies.

Uploading a list to a verification service is a transfer to a processor too, and the contract is needed even for a one-off check.

Then there is the question of where the data physically sits. Chapter V (Articles 44 to 49) governs transfers outside the EU. On 16 July 2020 the EU Court of Justice struck down Privacy Shield in Schrems II (C-311/18), and for a while US transfers relied on Standard Contractual Clauses (SCCs). On 10 July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework, so data can go to a certified US company without an extra transfer mechanism. If your vendor isn't certified, you still need SCCs or another Chapter V basis.

Practical checklist for marketers

Eight steps covering the main GDPR and ePrivacy requirements for the email channel:

Fines and processing bans

Article 83 has two tiers, and in both the higher of the two amounts applies. Up to 10 million euros or 2% of worldwide annual turnover for the previous year covers the controller and processor obligations in Articles 25 to 39, such as the processor contract (Article 28), records of processing (Article 30) and breach notification (Article 33). Up to 20 million euros or 4% covers the basic principles and conditions for consent (Articles 5 to 7 and 9), data subject rights (Articles 12 to 22), transfers outside the EU, and ignoring an order from a supervisory authority.

Two decisions at very different scales:

• Meta, 1.2 billion euros, Ireland, 2023. Issued by the Irish regulator after EDPB Binding Decision 1/2023, over transfers of Facebook user data to the US on the basis of SCCs. Not an email case, but it concerns anyone keeping EU data on US servers.
• BBVA, 5,508,000 euros, Italy, 2026. Promotions sent after an Article 21 objection, described above under subscriber rights.

Money isn't the only tool. Article 58(2)(f) lets a supervisory authority impose a temporary or definitive limitation on processing, including a ban. For a company whose main sales channel is email, a forced pause in sending can cost more than the fine itself.

List verification and the accuracy principle

Article 5(1)(d) requires personal data to be accurate and, where necessary, kept up to date, with inaccurate data erased or rectified without delay. An address that no longer exists is inaccurate in the most literal sense. The person changed jobs, closed the account, or the company let its domain lapse. Mailing it achieves nothing, and hard bounces from dead mailboxes hurt your sender reputation.

uChecker checks address syntax, the domain's MX records and whether the mail server accepts the mailbox. Each address ends up as good (the mailbox exists and accepts mail), bad (broken syntax, which also covers stop-listed disposable domains and misspelled domains, or the server rejected the mailbox) or unknown (we couldn't tell, for example because the domain has no MX or the server accepts mail for any address). Uploading a list to any service like this, ours included, hands data to a processor, so the contract point above applies here as well.

Where to start

Start with the EU segment. For each address, find out where it came from and whether you hold a consent record, or a purchase record that qualifies for soft opt-in. Take addresses with neither out of your sends and decide with a lawyer whether you can contact them at all. After that come vendor contracts, the privacy policy and the retention period.