GDPR
By Carlos Gil, Founder & Editor, The Best Network · Updated
EU data protection law. Marketing email to people in the EU needs a lawful basis: usually consent, sometimes legitimate interest, with the ePrivacy soft opt-in covering existing customers.
GDPR (Regulation 2016/679) requires a lawful basis for using personal data, including email addresses (Article 6). For marketing email that basis is usually consent, and consent must be a clear affirmative act: silence, pre-ticked boxes and inactivity do not count (Recital 32), and you must be able to prove it (Article 7). Consent is not the only route. Recital 47 says direct marketing may be regarded as a legitimate interest, but the separate ePrivacy rules (Directive 2002/58/EC, Article 13) still require consent for marketing email to individuals unless the soft opt-in applies: you got the address from a customer in the context of a sale, you are marketing your own similar products, and you gave a simple way to opt out when you collected it and in every message since. Whatever the basis, people can object to direct marketing at any time and you must stop (Article 21). Fines reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher, and GDPR applies to non-EU businesses that market to people in the EU. National rules vary, so get legal advice for your case.