GDPR Email Marketing: Consent, Subscriber Rights, and Fines

GDPR email marketing compliance comes down to a short list of duties: have a lawful reason to email each person on your list, tell them clearly what you’re doing with their address, give them an easy way out of every message, and be able to prove all of it if a regulator asks. Two laws set those duties. The General Data Protection Regulation governs how you handle the underlying data, and the ePrivacy Directive governs the act of sending a marketing message. Getting one right without the other is not compliance.1General Data Protection Regulation (GDPR). GDPR Email Marketing The penalty ceiling for the serious violations is €20 million or 4 percent of worldwide group turnover, whichever is higher, so the details are worth the time.2General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines

Whether the Rules Apply to You

The GDPR follows the recipient, not the sender. If you offer products or services to people located in the EU, or you track their online behavior, you are covered regardless of where your business sits.3General Data Protection Regulation (GDPR). GDPR Article 3 Territorial Scope A U.S. retailer that ships to France, or a SaaS company running German-language ads, is inside the rule.

If you fit that description and have no EU establishment, Article 27 tells you to appoint a written representative inside the EU as a contact point for authorities and subscribers. The exception for occasional, low-risk processing does not fit routine marketing, so a business running an EU mailing list will normally need to designate one.4General Data Protection Regulation (GDPR). Art. 27 GDPR Representatives of Controllers or Processors Not Established in the Union

One more piece before the substantive rules: the ePrivacy Directive is implemented country by country, so the exact wording of the consent and identification rules can vary between member states. Where the ePrivacy Directive and the GDPR both address the same question, the Directive prevails under GDPR Article 95. A proposed ePrivacy Regulation that would have unified the rules across the EU was withdrawn by the European Commission in October 2025, so the national implementations remain the governing text.

Getting Consent That Actually Holds Up

For electronic marketing to EU residents, the working assumption is that you need prior consent from each recipient. The GDPR defines the standard in Article 7 and Recital 32: consent must be freely given, specific, informed, and unambiguous, which means a positive action by the subscriber after being told who you are and what you plan to send.5General Data Protection Regulation (GDPR). Art. 7 GDPR Conditions for Consent

  • Freely given. You cannot make marketing consent a condition of buying something or opening an account. Consent tied to a purchase is not valid.6Information Commissioner’s Office. What Is Valid Consent?
  • Specific. The marketing opt-in is a separate choice, not a line inside a broader terms-and-conditions or privacy policy acceptance.
  • Informed. Name your company and describe what kind of emails the subscriber will receive before they agree.
  • Unambiguous. An affirmative action is required. Pre-ticked boxes, silence, and continued browsing all fail. An empty checkbox the user actively selects is the standard pattern.

Withdrawing consent must be as easy as giving it, and you have to tell people about that right before they opt in.7General Data Protection Regulation (GDPR). Article 7 GDPR Conditions for Consent A one-click signup cannot lead to a five-screen unsubscribe.

Double opt-in, where the subscriber confirms by clicking a verification link, is not required by the GDPR text. It is widely treated as best practice, particularly in Germany, because the confirmation click creates a timestamped record that the person who owns the address actually asked for the messages. That record is worth more in a dispute than a lone form submission.

Recording Consent So You Can Prove It

You have to be able to demonstrate that every person on your list consented. At a minimum, keep who consented, when, how, and what they saw at the time.8Information Commissioner’s Office. How Should We Obtain, Record and Manage Consent? In practice that means storing the timestamp, the version of the signup form, and the IP address or device identifier tied to the action. Consent you cannot evidence is treated as no consent at all.

The Existing-Customer Exception

The soft opt-in is the one realistic route to email someone in the EU without fresh consent. All three conditions have to hold: you got the email address in the course of a sale or negotiation with that person, you are marketing only similar products or services, and you offered a clear opt-out both at collection and in every message since.9Information Commissioner’s Office. Electronic Mail Marketing It does not cover prospects, purchased lists, or charity appeals.

Direct marketing is recognized as a possible legitimate interest under Recital 47 of the GDPR.10General Data Protection Regulation (GDPR). Recital 47 Overriding Legitimate Interest For electronic messages, though, the ePrivacy Directive’s separate consent rule still bites in most member states, so legitimate interest rarely replaces consent for email. If you rely on it for any part of your program, document a purpose, necessity, and balancing assessment and keep it on file.11Information Commissioner’s Office. Legitimate Interests

What Every Marketing Email Must Contain

Each message needs a working unsubscribe. The ePrivacy Directive requires an opt-out in every marketing email, and Article 21 of the GDPR makes a subscriber’s objection to direct marketing absolute: once they object, you stop, with no balancing argument available to you.12General Data Protection Regulation (GDPR). Art. 21 GDPR Right to Object The unsubscribe should be easy to find, should not require the recipient to log in, and should take effect immediately.

The sender’s identity cannot be disguised. Name the business clearly in the “From” field or the body of the message, and provide a valid return address for opt-out requests. A physical postal address in every email is a U.S. CAN-SPAM requirement rather than a GDPR one, but some member states impose comparable rules through their national ePrivacy implementations, so check the countries where your recipients live.

What You Have to Tell Subscribers at Signup

Articles 13 and 14 set out the information you must give people when you collect their data. If you collect the email address directly, Article 13 applies and you disclose it at that moment.13General Data Protection Regulation (GDPR). Art. 13 GDPR Information to Be Provided Where Personal Data Are Collected From the Data Subject The notice should cover:

  • Who you are and how to contact you.
  • The purpose of collecting the address and your lawful basis (consent, in most cases).
  • Any third parties or categories of third parties you share the data with.
  • How long you will keep the address, or the criteria you use to decide.
  • The rights the subscriber has: access, correction, erasure, objection, and withdrawal of consent.
  • The right to complain to a supervisory authority.14General Data Protection Regulation (GDPR). Art. 77 GDPR Right to Lodge a Complaint With a Supervisory Authority

If the address came from somewhere other than the subscriber, such as a partner or a public directory, Article 14 requires the same information plus the source. It has to reach the subscriber within one month, or at the first communication, whichever comes first.15General Data Protection Regulation (GDPR). Art. 14 GDPR Information to Be Provided Where Personal Data Have Not Been Obtained From the Data Subject

Plain language matters here. A notice buried behind three click-throughs or written in dense legal prose defeats the transparency the rule expects.

Handling Subscriber Requests

Subscribers have several rights they can exercise against your list, and Article 12 gives you one calendar month to respond, extendable by two more months for complex requests if you notify the person of the extension inside the first month.16General Data Protection Regulation (GDPR). Art. 12 GDPR Transparent Information, Communication and Modalities for the Exercise of the Rights of the Data Subject Document each request and its outcome, and if you refuse, explain why within that same window.

Right to Object to Marketing

Article 21 is unconditional for direct marketing. When someone objects, you stop using their data for that purpose. There is no threshold to meet and no counterweight you can put on your side.

Right to Erasure

Article 17 goes beyond unsubscribing. An erasure request means removing the email address and associated data from your systems, not just moving the person to a suppression list, unless a specific ground for retention applies. Grounds for erasure include the data no longer being needed for its original purpose, withdrawal of consent, and unlawful processing.17General Data Protection Regulation (GDPR). Art. 17 GDPR Right to Erasure

Right of Access and Portability

A subscriber can ask what you hold about them, why, and with whom you’ve shared it, and receive a copy in a common electronic format if they asked electronically. Where processing is based on consent and done by automated means, Article 20 also lets them ask for that data in a structured, machine-readable form and, where technically feasible, have it sent directly to another controller.18General Data Protection Regulation (GDPR). Art. 20 GDPR Right to Data Portability

Marketing to Minors

If children might be on your list, Article 8 sets a default consent age of 16 for information society services. Below that age, a parent or guardian must give or authorize the consent. Member states can lower the threshold, but not below 13.19General Data Protection Regulation (GDPR). Art. 8 GDPR Conditions Applicable to Child’s Consent in Relation to Information Society Services You must make reasonable efforts to verify the parental consent is real; a self-declared age or a form field for a parent’s email address is not enough. Options range from a confirmation code sent to a verified parental contact to knowledge-based authentication or, for higher-risk processing, ID validation. Keep the verification record.

Using an Email Service Provider

When you send through a platform like Mailchimp or Brevo, that platform is a processor under Article 28 and you remain the controller. You need a written contract in place that covers the mandatory terms:20Information Commissioner’s Office. What Needs to Be Included in the Contract?

  • Processing only on your documented instructions.
  • Confidentiality obligations for anyone with access to the data.
  • Appropriate security measures, including encryption where suitable.
  • Written permission before engaging any sub-processor.
  • Cooperation with subscriber rights requests.
  • Deletion or return of the data at the end of the contract.
  • Audit and inspection rights for you.

If your provider is in the United States, the transfer itself needs a legal basis. The EU-U.S. Data Privacy Framework currently provides one, but only for companies with active certification, which you should verify on the U.S. Department of Commerce’s DPF List before sending any subscriber data. DPF covers the transfer question and nothing else; every other GDPR duty still runs alongside it.

If Your List Gets Breached

Article 33 gives you 72 hours from becoming aware of a personal data breach to notify the relevant supervisory authority, unless the breach is unlikely to result in a risk to subscribers’ rights. Miss the window and you have to explain the delay.21General Data Protection Regulation (GDPR). Art. 33 GDPR Notification of a Personal Data Breach to the Supervisory Authority When the risk to individuals is high, you also have to tell the affected subscribers directly, without undue delay, in plain language that describes what happened, the likely consequences, and what you’re doing about it.22General Data Protection Regulation (GDPR). Art. 34 GDPR Communication of a Personal Data Breach to the Data Subject Direct notice can be skipped only if the exposed data was rendered unintelligible by encryption or similar protection, or if individual contact would take disproportionate effort, in which case a public communication takes its place.

A leaked mailing list, with names and marketing preferences attached to addresses, is exactly the kind of incident that triggers both duties. Meeting the 72-hour deadline is only realistic if the response plan already exists before something goes wrong.

What the Fines Look Like

Penalties come in two tiers under Article 83. Administrative and procedural failures, such as missing processor contracts or breach-notification lapses, sit in the lower tier at up to €10 million or 2 percent of worldwide annual turnover, whichever is higher. Violations of core principles, including lawful processing, consent, and subscriber rights, sit in the upper tier at up to €20 million or 4 percent of worldwide annual turnover.2General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines

For businesses inside a corporate group, the turnover figure is the group’s worldwide revenue, not just the subsidiary that caused the problem.23General Data Protection Regulation (GDPR). Fines and Penalties General Data Protection Regulation Intentional violations, failure to mitigate, and lack of cooperation with the authority all push penalties upward. Most email marketing failures, from sending without valid consent to ignoring an unsubscribe, land in the upper tier.