Direct Marketing GDPR: Legal Basis, ePrivacy, and Penalties

Direct marketing under the GDPR is lawful only when you have a valid legal basis for using someone’s personal data, you also satisfy the separate ePrivacy consent rule for electronic channels, you tell people clearly what you’re doing, and you stop as soon as they object. The regulation applies wherever your business is located, so long as you’re marketing to people in the EU or wider European Economic Area, and the fines for getting it wrong reach €20 million or four percent of worldwide annual turnover, whichever is higher.¹

What Counts as Direct Marketing

Direct marketing covers any promotional communication aimed at an identifiable person: email campaigns, SMS blasts, postal mail, phone calls, push notifications, and targeted social media ads. The common thread is that you’re using personal data (a name, email address, phone number, or online identifier) to reach a particular individual with a message that promotes a product, service, or cause.

Untargeted brand advertising sits outside this scope. A billboard or a mass-market television spot is not direct marketing under the regulation. The line is crossed the moment personal identifiers are used to reach a specific person. Recital 47 recognizes that processing personal data for direct marketing “may be regarded as carried out for a legitimate interest,” which tells you regulators anticipated the activity, and also that they expect it to follow the rules.²

One boundary worth naming: the GDPR itself makes no formal distinction between business-to-business and business-to-consumer marketing, because a named individual’s work email is still personal data. National implementations of the ePrivacy rules often treat incorporated companies more leniently than sole traders and individuals, so electronic marketing to corporate bodies can sometimes proceed without prior consent.³ When in doubt, treat every contact as an individual.

Picking a Legal Basis: Consent or Legitimate Interests

Every piece of personal data you process for marketing needs a legal basis under Article 6.⁴ Two matter here: consent and legitimate interests. Which you can rely on depends on your channel, your relationship with the person, and the data involved.

Consent

Consent must be freely given, specific, informed, and unambiguous, given through a clear affirmative act. Pre-ticked boxes, silence, and inactivity don’t count. Recital 32 spells it out: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent.”⁵

Consent also comes with an exit door. Under Article 7(3) a person can withdraw at any time, and withdrawing must be as easy as giving it. If signing up took one click, opting out cannot take a phone call or a five-step process. You need to explain the right to withdraw before consent is given, not after.⁶ And you must be able to prove each person actively opted in, with consent that was genuinely specific to marketing rather than bundled into a general terms-of-service acceptance.

Legitimate Interests

Article 6(1)(f) allows processing without explicit consent, but the bar is higher than many marketers assume. You must run a documented legitimate interests assessment (LIA) covering three tests:⁷

Purpose test: identify the specific legitimate interest behind the marketing.
Necessity test: show that processing this data is actually necessary, not merely convenient.
Balancing test: weigh your interest against the individual’s rights and reasonable expectations. If the person would be surprised or uncomfortable to learn how you’re using their data, you probably fail.

Recital 47 puts the person’s reasonable expectations, based on their relationship with you, at the center of that balancing. A customer who bought running shoes would reasonably expect to hear about new running gear. That same customer would not expect their details to be shared with an unrelated insurance company.⁸ The LIA must be completed and recorded before processing starts, and kept on file.

Sensitive Data

If your marketing involves special category data (health, political opinions, religious beliefs, ethnic origin, sexual orientation, biometric identifiers, or trade union membership), legitimate interests isn’t available. Article 9 prohibits processing this data unless a narrow exception applies, and for marketing purposes the practical one is explicit consent.⁹ Marketing a wellness product to people based on health conditions, for example, needs explicit consent that specifically covers the use of health data for promotion.

The ePrivacy Rules on Top of the GDPR

The GDPR isn’t the only regulation in play. The ePrivacy Directive (Directive 2002/58/EC) adds a separate layer for electronic communications: email, SMS, fax, and automated calling systems. Each member state has implemented it through national law, so details vary, but the core principle holds: electronic direct marketing to individuals requires prior consent.¹⁰

The practical consequence: you cannot send a marketing email to a new prospect on the basis of legitimate interests alone. Even if your GDPR assessment holds up, the ePrivacy rules still demand prior opt-in. Both frameworks apply in parallel, and you have to satisfy each.

The Soft Opt-In for Existing Customers

Article 13(2) of the ePrivacy Directive carves out one exception. If you collected someone’s email address during a sale or during active negotiation of a sale, you can market your own similar products or services to that person without fresh consent, provided you gave them a clear and free way to opt out when you collected their details and you include an opt-out option in every subsequent message.¹⁰

The limits are tight. The products marketed must be similar to what the customer originally bought. You cannot use the soft opt-in to promote an unrelated product line, to market on behalf of a third party, or to contact people whose details you acquired from a purchased list. Once someone opts out, the exception disappears for that person permanently.

Cookies and Tracking Pixels

Marketing cookies, tracking pixels, and similar technologies used to build advertising profiles also sit under the ePrivacy framework. Consent is required before you place marketing or analytics cookies on a user’s device. The only exception covers cookies strictly necessary to deliver a service the user has requested, such as a shopping cart. A behavioral advertising tracker doesn’t qualify.¹¹ Cookie consent has to meet the GDPR standard: freely given, specific, informed, and unambiguous. A banner declaring that continued browsing implies acceptance is not consent.

What You Must Tell People

Before you process anyone’s data for marketing, Articles 13 and 14 require a clear explanation of what you’re doing and why. Which article applies depends on whether you collected the data directly from the person or obtained it from another source.¹²

At minimum, your privacy notice needs to state:

Who is responsible for the data and how the person can reach you.
That the data is being processed for direct marketing.
The legal basis, and if it’s legitimate interests, what those interests are.
Whether data is shared with third parties for promotional purposes, and who they are.
How long the data will be kept.
The person’s rights, including the right to object to marketing, withdraw consent, request deletion, and lodge a complaint with a supervisory authority.

When data is collected indirectly, from a partner, a broker, or public sources, Article 14 requires you to tell the person where you got the data and what categories you hold.¹³ The notice has to reach them within a reasonable period and no later than one month after you acquire the data, or at the point of first contact, whichever comes first. Plain language is expected.

Handling Opt-Outs and Objections

The right to object to direct marketing under Article 21(2) is absolute. No balancing test, no exemptions. When someone tells you to stop, you stop.¹⁴ The person doesn’t have to give a reason or fill out a special form. Once the objection arrives, Article 21(3) requires that personal data no longer be processed for those purposes. The rule applies whether the original legal basis was consent or legitimate interests.

You must inform people of this right at the latest during your first communication with them, and Article 21(4) says it has to be presented “clearly and separately from any other information.” Burying the notice in paragraph nine of a privacy policy doesn’t satisfy that.¹⁴ Every marketing email should carry a visible unsubscribe mechanism, and every first contact should call out the right to opt out.¹⁵

Objection and consent withdrawal are distinct routes to the same outcome. Withdrawal under Article 7(3) applies when consent was the legal basis. Objection under Article 21 applies even when the legal basis was legitimate interests. Track which mechanism was triggered, because the underlying documentation differs.

Response Times

Any GDPR right (objecting to marketing, requesting deletion, asking for a copy of the data) has to be answered within one calendar month of receiving the request.¹⁶ A request received on January 15 is due by February 15. Complex requests can be extended by up to two additional months, but you must tell the person within the first month and explain why. A straightforward marketing opt-out shouldn’t need an extension; most are processed within days.

Suppression Lists

When someone objects or withdraws consent, you stop sending them messages, but you also keep their contact details on a suppression list, a record of people who must not be contacted. Without it, you risk re-importing the same person’s data through a purchased list, a CRM migration, or a new lead generation campaign. Suppression lists are one of the few situations where holding personal data after an objection is required, because deleting everything leaves you unable to screen future lists.

Records

Article 5(2) sets out the accountability principle: you must be able to prove compliance, not just claim it.¹⁷ Document when each consent was given and what exactly the person agreed to, including the version of the form they saw. Record when objections and withdrawals arrive and when the database was updated. Keep your LIAs and DPIAs on file. If a supervisory authority investigates, these records are your defense.

Profiling and Behavioral Advertising

Profiling is defined as any automated processing of personal data used to evaluate personal aspects of someone: their preferences, interests, behavior, location, or economic situation.¹⁸ In marketing that covers building customer segments from purchase history, serving targeted ads from browsing behavior, and anything similar. Sorting people into categories to decide what marketing they see is profiling.

Article 21(2) extends the right to object to “profiling to the extent that it is related to such direct marketing.”¹⁴ When someone objects, you also have to stop any profiling that feeds the marketing. You cannot honor an unsubscribe request while continuing to build an advertising profile on the same person for later use.

When You Need a DPIA

Some marketing activities are risky enough to require a Data Protection Impact Assessment before processing begins. Article 35 makes a DPIA mandatory when processing is “likely to result in a high risk to the rights and freedoms of natural persons,” and it names systematic, large-scale profiling as a trigger.

Marketing operations that commonly need a DPIA include:

Large-scale profiling, such as applying AI to segment audiences or using social media data for ad targeting.¹⁹
Data matching across sources, combining personal data from multiple databases for direct marketing or fraud prevention.
Invisible processing, using personal data obtained from third parties (list brokers, aggregators, publicly scraped sources) where the individuals don’t know you hold their data.
Cross-device or geolocation tracking, including wealth profiling to identify high-net-worth individuals.
Marketing to children or vulnerable people, including any use of children’s data for profiling or automated decisions.²⁰

A DPIA is not a checkbox. It requires you to describe the processing, assess necessity and proportionality, identify risks to individuals, and document the mitigation measures. If the assessment reveals high risks you cannot adequately address, you must consult your supervisory authority before proceeding.

Penalties

Violations of the processing principles, consent rules, and data subject rights (the provisions most relevant to marketing) sit in the higher fine tier: up to €20 million or four percent of worldwide annual turnover from the preceding financial year, whichever is greater.¹ That covers Articles 5 through 9 on processing principles and consent, Articles 12 through 22 on data subject rights including the right to object, and the rules on international data transfers.

Regulators don’t always push to the maximum, but marketing-focused fines have been substantial, and the GDPR also gives affected individuals a private right of action alongside supervisory enforcement.

1
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines
2
GDPR.eu. Recital 47 – Overriding Legitimate Interest
3
Information Commissioner’s Office. Business-to-Business Marketing
4
GDPR.eu. GDPR Article 6 – Lawfulness of Processing
5
GDPR-Info.eu. Recital 32 – Conditions for Consent
6
GDPR.eu. Art. 7 GDPR – Conditions for Consent
7
Information Commissioner’s Office. How Do We Apply Legitimate Interests in Practice?
8
Privacy-Regulation.eu. Recital 47 EU General Data Protection Regulation
9
GDPR-Info.eu. GDPR Art. 9 – Processing of Special Categories of Personal Data
10
European Data Protection Supervisor. Directive 2002/58/EC – ePrivacy Directive
11
Data Protection Commission. Guidance on Cookies and Other Tracking Technologies
12
GDPR-Info.eu. GDPR Article 13 – Information to Be Provided Where Personal Data Are Collected From the Data Subject
13
General Data Protection Regulation (GDPR). Art. 14 GDPR – Information to Be Provided Where Personal Data Have Not Been Obtained From the Data Subject
14
General Data Protection Regulation (GDPR). Article 21 GDPR – Right to Object
15
GDPR.eu. How Does the GDPR Affect Email?
16
GDPR-Info.eu. Right of Access
17
General Data Protection Regulation (GDPR). GDPR Article 5 – Principles Relating to Processing of Personal Data
18
GDPR.eu. Art. 4 GDPR – Definitions
19
Information Commissioner’s Office. Examples of Processing Likely to Result in High Risk
20
Information Commissioner’s Office. When Do We Need to Do a DPIA?