GDPR Compliance for Email Marketing: Consent, Transfers, and Fines

If your marketing emails reach anyone in the European Union, GDPR compliance for email marketing means getting a valid legal basis for every send (in practice, active opt-in consent), telling subscribers up front who you are and what you’ll do with their data, honoring their rights and unsubscribes promptly, putting a written contract in place with your email platform, and using a lawful mechanism whenever data leaves the EU. Serious failures can be fined up to €20 million or 4% of worldwide annual revenue, whichever is higher.

The rules come from two instruments that operate side by side: the General Data Protection Regulation, in force since May 25, 2018, and the ePrivacy Directive (Directive 2002/58/EC), which contains dedicated rules for electronic messages. Where the ePrivacy Directive speaks specifically about email marketing, its rules take priority over the GDPR’s more general provisions. You need to satisfy both.

Whether the Rules Apply to You

The GDPR follows the subscriber, not the sender. Under Article 3(2), it applies to any organization that processes the personal data of people in the EU in connection with offering them goods or services, whether or not money changes hands.¹ A newsletter sent from New York to a subscriber in Berlin is covered. So is a promotional campaign from Tokyo to a customer in Madrid. Server location and headquarters location are beside the point.

If you’re outside the EU and you process EU subscriber data on a regular basis, Article 27 adds a further step: you must appoint a written representative inside the EU as a contact for supervisory authorities and data subjects.² The narrow exception for occasional processing that doesn’t involve sensitive data on a large scale rarely covers ongoing email campaigns.

The Legal Basis for Every Send

Article 6 requires a lawful basis for every act of processing personal data.¹ For marketing emails, two matter: consent and legitimate interest.

Consent is the practical baseline. The subscriber actively agrees to receive your messages, and you can prove it. Legitimate interest is recognized in Recital 47 as a possible basis for direct marketing, but relying on it requires a documented three-part assessment: identify the interest, show that email marketing is genuinely necessary to pursue it, and weigh your interest against the subscriber’s privacy rights.³ If the subscriber would be surprised to hear from you, that balance tips against you.

There is a bigger problem with leaning on legitimate interest for email: the ePrivacy Directive imposes its own consent requirement on electronic marketing under Article 13, and it operates independently. In most member states, that means email marketing still needs prior consent even if you satisfy Article 6 with legitimate interest.

The ePrivacy Directive does carry one exception, often called the soft opt-in. If you collected the email address in the course of selling a product or service, you can market your own similar products to that customer without fresh consent, provided you offered a clear, free opt-out at the moment of collection and repeat it in every message. Cold outreach to people who haven’t bought from you sits outside this exception.

What Valid Consent Actually Requires

Article 4(11) defines consent as a “freely given, specific, informed and unambiguous indication” of the person’s wishes, shown through a “clear affirmative action.”⁴ Recital 32 explicitly rules out silence, pre-ticked boxes, and inactivity.⁵ The subscriber has to do something deliberate, like tick an empty box.

Each word in that definition does work:

Freely given. You can’t make marketing consent a condition of buying your product or using your service unless the marketing itself is genuinely necessary to provide it. Bundling marketing into terms-of-service acceptance fails.
Specific. One purpose, one opt-in. A single checkbox covering newsletters, partner data sharing, and targeted ads is too broad.
Informed. Before someone consents, they need to know who you are, what data you’re collecting, why, and how to withdraw later.
Unambiguous. Vague language like “we may occasionally contact you” doesn’t qualify.

Article 7 adds two operational rules: you must be able to demonstrate that the subscriber consented, and withdrawal must be as easy as the initial opt-in.⁶ If joining takes one click, leaving can’t take five.

Double opt-in isn’t explicitly mandated, but it produces the strongest evidence. The subscriber fills out your form, then confirms by clicking a link in a verification email. You end up with a timestamped record showing that the person who controls the address actually agreed to receive your messages.

If your list could include minors, Article 8 sets a default age threshold of 16 for valid digital consent, and requires a parent or guardian to authorize consent for anyone below it. Individual member states can lower the threshold to as young as 13, so the applicable age varies by country.⁷ Age verification and a parental consent process become part of the signup flow.

The Privacy Notice at Signup

Article 13 lists what a subscriber must be told at the moment you collect their email address.⁸ The notice needs to cover:

Your identity as the controller and contact details, plus your Data Protection Officer if you have one.
The purpose of collecting the address and the legal basis you’re relying on.
Who else will see the data, including your email service provider and other third parties.
How long you’ll keep the data, or the criteria you use to decide.
The subscriber’s rights: access, correction, deletion, portability, withdrawal of consent, and the right to complain to a supervisory authority.
Any transfers outside the EU and the safeguards you use for them.

Plain language matters. Burying these disclosures behind a generic “I agree to the terms” link defeats the requirement.

Unsubscribes and the Rights You Have to Handle

Every marketing email must include a clear, free way to opt out. Article 21 requires you to bring this right to the subscriber’s attention no later than your first message, presented separately from other information.⁹ Objection to direct marketing is absolute: when a subscriber exercises it, you stop processing their data for marketing, with no balancing test.

When someone unsubscribes, remove them from active sends immediately, but don’t wipe the record. Move it to a suppression list so a future import or list merge can’t accidentally re-add them. That kind of mistake is exactly what draws regulatory attention.

Alongside objection, subscribers can invoke other rights that touch email marketing directly:

Right of access under Article 15. On request, provide a copy of the personal data you hold about the subscriber, in a commonly used electronic format.¹⁰
Right to erasure under Article 17. If the data is no longer necessary for the purpose you collected it, or the subscriber withdraws consent, delete it.¹¹
Right to data portability under Article 20. Deliver the data in a structured, machine-readable format so the subscriber can move it elsewhere.¹²

You have one month to respond, under Article 12. If a request is unusually complex or comes as part of a high volume, you can extend that by two more months, but only if you notify the subscriber of the delay and the reasons within the original month.¹³ You generally can’t charge a fee. Narrow exceptions apply for clearly unfounded or excessive requests, or for additional copies beyond the first.

Your Contract With the Email Platform

If you use a service like Mailchimp, Brevo, or Campaign Monitor, you’re the controller and they’re the processor. Article 28 requires a written contract, commonly called a Data Processing Agreement, between you. Most reputable platforms publish a standard DPA, but the responsibility to check that it covers the required terms is yours.

The DPA needs to set out the nature and purpose of the processing, the categories of data involved, its duration, and your rights and obligations as controller. It must bind the processor to act only on your documented instructions, keep the data confidential, apply adequate security measures, and help you respond to data subject requests. If the platform uses sub-processors, such as cloud hosting providers, the contract has to address that too, either by naming each one for your approval or through a general authorization that lets you object to changes.

The contract must also say what happens to the data at the end of the relationship: return or deletion. Read the standard agreement before signing it. Some include broad permissions for the processor’s own analytics or product improvement that may go beyond what you’ve disclosed to your subscribers.

Sending Data Outside the EU

Most major email platforms process data on U.S. servers, so a transfer mechanism is usually necessary.

The EU-U.S. Data Privacy Framework

Since July 10, 2023, U.S. organizations can self-certify compliance with the Data Privacy Framework Principles through the International Trade Administration. Once certified, they can receive EU personal data without additional transfer mechanisms.¹⁴ Participation is voluntary, but obligations become legally enforceable once you certify, and annual re-certification is required. Organizations that leave the program still have to protect the data they received while in it. If your email service provider is on the Data Privacy Framework List at dataprivacyframework.gov, that covers transfers to their systems.

Standard Contractual Clauses

Where the Data Privacy Framework doesn’t apply, Standard Contractual Clauses issued by the European Commission are the fallback: pre-approved contract terms both parties sign, committing to EU-level protection.¹⁵ The core clauses can’t be modified, though supplementary measures can be added.

Before relying on SCCs, run a Transfer Impact Assessment: consider whether the destination country’s laws (particularly on government access to data) could undermine the clauses’ protections. If gaps emerge, add measures such as encryption or pseudonymization.

Breach Notification

If your list is compromised through a hack, accidental exposure, or unauthorized access, Article 33 requires you to notify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to pose a risk to individuals’ rights. Miss the window and you have to explain the delay.¹⁶

When the breach is likely to result in a high risk to subscribers (for example, if email addresses were exposed alongside passwords or financial data) you also have to notify the subscribers themselves without undue delay. Individual notification isn’t required if the exposed data was encrypted or otherwise rendered unintelligible, or if you’ve taken steps that eliminate the high risk. In practice, most email list breaches involving identifiable data will require it.

Seventy-two hours is short. Map out in advance who detects a breach, who assesses risk, who contacts the authority, and who notifies subscribers.

Internal Records and How Long You Keep Data

Article 30 requires a written record of your processing activities. For email marketing, it should log the categories of personal data you collect, why you process them, who has access, and when you’ll delete them.¹⁷ For international transfers, the record must identify the destination country and the safeguards in place. Subscribers never see this document; a supervisory authority can request it during an investigation.

The GDPR doesn’t set specific retention periods. Article 5(1)(e) instead imposes a storage limitation principle: keep personal data only for as long as it’s necessary for the purpose you collected it.¹⁸ Holding onto addresses for subscribers who haven’t opened a message in three years is hard to defend. Set a clear inactivity threshold, put it in your privacy notice, and delete or anonymize when it passes.

The Fines

Article 83 creates a two-tier penalty structure, and which tier applies depends on which provision you broke. A lot of summary advice quotes only the higher figure.

The lower tier, under Article 83(4), covers violations tied to record-keeping, Data Processing Agreements, breach notification procedures, and Data Protection Officer obligations. Maximum fines reach €10 million or 2% of worldwide annual revenue, whichever is higher.¹⁹

The upper tier, under Article 83(5), covers violations of the core processing principles (including consent), data subject rights, and international transfer rules. Maximum fines reach €20 million or 4% of worldwide annual revenue, whichever is higher.¹⁹ For email marketers, that’s where the most common failures land: sending without valid consent, ignoring unsubscribes, failing to answer access requests, transferring data abroad without a lawful mechanism.

Supervisory authorities weigh the nature and severity of the violation, whether it was intentional or negligent, what you did to mitigate harm, and your history. A small company that fixes an honest mistake quickly is treated very differently from one that systematically ignores the rules. The ceilings, though, are real, and enforcement has grown steadily since 2018.

1
General Data Protection Regulation (GDPR). Art. 6 GDPR – Lawfulness of Processing
2
General Data Protection Regulation (GDPR). Art. 27 GDPR – Representatives of Controllers or Processors Not Established in the Union
3
General Data Protection Regulation (GDPR). Recital 47 – Overriding Legitimate Interest
4
Legislation.gov.uk. Regulation (EU) 2016/679 – Article 4
5
General Data Protection Regulation (GDPR). Recital 32 – Conditions for Consent
6
General Data Protection Regulation (GDPR). Art. 7 GDPR – Conditions for Consent
7
General Data Protection Regulation (GDPR). Art. 8 GDPR – Conditions Applicable to Childs Consent in Relation to Information Society Services
8
General Data Protection Regulation (GDPR). Art. 13 GDPR – Information to Be Provided Where Personal Data Are Collected From the Data Subject
9
General Data Protection Regulation (GDPR). Art. 21 GDPR – Right to Object
10
General Data Protection Regulation (GDPR). Art. 15 GDPR – Right of Access by the Data Subject
11
General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure
12
General Data Protection Regulation (GDPR). Art. 20 GDPR – Right to Data Portability
13
General Data Protection Regulation (GDPR). Art. 12 GDPR – Transparent Information, Communication and Modalities for the Exercise of the Rights of the Data Subject
14
Data Privacy Framework. Data Privacy Framework Program Overview
15
European Commission. Standard Contractual Clauses (SCC)
16
General Data Protection Regulation (GDPR). Art. 33 GDPR – Notification of a Personal Data Breach to the Supervisory Authority
17
General Data Protection Regulation (GDPR). Art. 30 GDPR – Records of Processing Activities
18
General Data Protection Regulation (GDPR). Art. 5 GDPR – Principles Relating to Processing of Personal Data
19
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines