GDPR Email Marketing: What the Law Actually Requires

Published by the Secure Privacy Compliance Team · Last reviewed: Feb 2026

Email marketing, for GDPR purposes, means using someone’s email address to send them promotional or commercial content — a newsletter, a product announcement, a discount code — rather than a transactional message tied to something they already asked for, like an order confirmation. It sits at the meeting point of two separate EU legal instruments: GDPR, which decides whether holding and using that address is lawful, and the ePrivacy Directive, which decides whether sending to it is allowed in the first place. Most compliance problems in this area come from treating the two as one question.

In short

GDPR does not itself say when you may send a marketing email — that question sits with the ePrivacy Directive and each Member State’s national implementation of it. What GDPR governs is the lawfulness of the underlying processing: the legal basis you rely on, the conditions your consent has to meet, and the recipient’s right to object at any time.

In practice, most B2C email marketing in the EU/EEA needs prior opt-in consent unless the narrow “soft opt-in” exception applies. Since the proposed ePrivacy Regulation was formally withdrawn by the European Commission in February 2025, the 2002 ePrivacy Directive and its national transpositions remain the operative law, which is why the exact rules still differ somewhat by country.

In This Page
Art. 6(1)(a)Consent as a lawful basis for processing an email address to send marketing, the basis most B2C senders rely on.GDPR
Art. 6(1)(f)Legitimate interest — sometimes argued for existing-customer or B2B marketing, but it does not override the ePrivacy consent requirement for the send itself.GDPR
Art. 7Sets the conditions valid consent must meet: freely given, specific, informed, unambiguous, and as easy to withdraw as to give.GDPR
Art. 21(2)Gives the recipient an absolute, unconditional right to object to direct marketing at any time, free of charge.GDPR
Art. 13The provision of the ePrivacy Directive that actually prohibits sending unsolicited marketing by email without prior consent, subject to the soft opt-in exception.ePrivacy Directive

GDPR and the ePrivacy Directive work together: ePrivacy decides whether you may send the email at all; GDPR decides whether the consent, and everything you do with the address afterwards, is lawful.

In most cases, yes. The ePrivacy Directive requires prior opt-in consent before sending marketing communications by email to an identified or identifiable person, and GDPR then requires that consent to meet the Article 7 standard — specific, informed, unambiguous, and given through a clear affirmative act. Pre-ticked boxes, inferred consent from a business relationship, and “by continuing to browse you agree to marketing” language do not meet that standard.

Because the proposed ePrivacy Regulation that was meant to harmonise this across the EU was withdrawn from the European Commission’s work programme in February 2025, the rules on the send itself are still set at national level, transposing the 2002 Directive. That means, for example, exactly how the soft opt-in is worded, or how double opt-in is treated as evidence, can differ between an authority like Sweden’s IMY and France’s CNIL.

Consent

The default basis for marketing to consumers. Under Article 7, consent must be freely given (no bundling it with contract performance), specific to email marketing (not folded into a general terms-and-conditions checkbox), and withdrawable at any time through a mechanism no harder to use than the one used to give it.

Legitimate Interest

Recital 47 explicitly names direct marketing as an activity that “may be regarded as carried out for a legitimate interest.” This is most commonly argued for existing-customer marketing or B2B outreach, after a documented balancing test. It can support the GDPR lawful-basis question — but it does not remove the separate ePrivacy requirement to have consent, or fall within the soft opt-in exception, before actually sending the email.

The Soft Opt-In Exception

Most Member States’ implementations of Article 13 of the ePrivacy Directive carry a narrow exception, commonly called the “soft opt-in,” that lets a business email an existing customer without fresh consent when all of the following hold:

  • The recipient’s email address was collected in the context of a sale of a product or service (not merely a newsletter sign-up or a quote request, depending on the Member State)
  • The marketing is for the sender’s own similar products or services
  • The recipient was clearly given the opportunity to opt out, free of charge, at the point the address was collected
  • Every subsequent marketing email offers an equally simple way to opt out

What counts as “similar,” and whether the exception extends beyond an actual sale, varies by national law — this is one of the areas most worth checking against the specific Member State a subscriber list sits in.

B2B Email Marketing

A corporate email address that identifies a natural person ([email protected]) is still personal data under GDPR, so the same lawful-basis and consent rules apply to it as to a consumer address. Several Member States treat marketing to generic role addresses, or B2B outreach more broadly, more permissively at the ePrivacy level — but this is a national-law distinction, not a GDPR exemption, and it does not change what GDPR itself requires once an identifiable person is on the other end of the address.

The Right to Object (Article 21)

Article 21(2) gives every recipient an absolute right to object to direct marketing, including any profiling done for marketing purposes, at any time and without needing to give a reason. Article 21(4) requires that this right be brought to the data subject’s attention clearly and separately from any other information, at the latest at the time of the first communication. Once someone objects, the personal data may no longer be processed for that purpose — there is no balancing test and no legitimate-interest override available here, unlike most other objection rights under Article 21(1).

Real Fines for Email Marketing

Because ePrivacy governs the send and GDPR governs the processing, most email-marketing enforcement in the EU is brought under the national law implementing Article 13 of the Directive alongside GDPR’s consent and transparency articles. Three recent CNIL decisions show how this plays out in practice — each is documented in full below.

CompanyAuthority & dateFineWhat happened
GoogleCNIL (France), Sep 2025€325,000,000Ads formatted as emails shown inside Gmail’s Promotions and Social tabs without consent, affecting over 53 million users, plus a defective cookie-consent flow at account creation
OrangeCNIL (France), Dec 2024€50,000,000Advertising inserted among genuine emails in “Mail Orange” inboxes, styled to look like real messages, without consent, affecting 7.8 million people
Groupe Canal+CNIL (France), Oct 2023€600,000Marketing sent using addresses collected by commercial partners, with no evidence of valid consent and no disclosure that Canal+ would use the data for its own marketing

See all email marketing enforcement cases →

Recitals That Explain This Issue

Recital 47 – Legitimate InterestNames direct marketing as an activity that may be carried out on the basis of legitimate interest, subject to a balancing test against the data subject’s interests, rights and freedoms, and their reasonable expectations.

Recital 32 – Conditions for ConsentExplains what a valid affirmative act looks like in practice, and rules out silence, pre-ticked boxes, and inactivity as forms of consent.

Recital 70 – Right to Object to Direct MarketingConfirms that a data subject should be able to object to direct-marketing-related processing, including profiling, free of charge and at any time, and that this should be explicitly brought to their attention.

Checklist: GDPR-Compliant Email Marketing

  • Confirm the lawful basis for each list segment — consent, soft opt-in, or a documented legitimate-interest assessment — and keep evidence of which applies
  • Use a clear, unticked opt-in checkbox specific to marketing, separate from any general terms acceptance
  • Record consent with a timestamp, the exact wording shown, and the collection channel, so it can be demonstrated on request
  • If relying on the soft opt-in, confirm the address came from an actual sale, the offer is for similar products, and an opt-out was offered at collection
  • Put an equally simple unsubscribe option in every marketing email, not only the first
  • Process unsubscribe/objection requests immediately and stop further marketing use of that address
  • Re-check consent validity after a long gap in contact — stale consent is a common finding in enforcement decisions
  • Check the specific national implementation of Article 13 ePrivacy for the country each recipient is in, since the soft opt-in’s exact conditions are not fully harmonised
  • If buying or receiving lists from a commercial partner, verify — don’t just assume — that valid, specific consent naming your business was actually collected

None of the three cases above turned on whether a company had a privacy policy — they turned on whether consent could actually be evidenced, per list, per channel, at the moment it mattered. A consent and preference management platform that logs proof of opt-in and opt-out per subscriber, and keeps it queryable by country, is what turns “we believe we had consent” into something you can actually show a regulator.

See how Secure Privacy handles this

Relevant GDPR Articles

Art. 6 GDPR Lawfulness of processing
Art. 7 GDPR Conditions for consent
Art. 21 GDPR Right to object
Art. 95 GDPR Relationship with Directive 2002/58/EC

Frequently Asked Questions about GDPR Email Marketing

+Is email marketing legal under GDPR?
Yes, when you have a valid lawful basis under GDPR (almost always consent) and, separately, satisfy the ePrivacy Directive’s requirement of prior consent or a valid soft opt-in before sending. Both conditions have to be met — GDPR alone does not make a marketing email lawful to send.
+Can I email existing customers without new consent?
Possibly, under the soft opt-in exception, if the address came from an actual sale, you’re marketing similar products or services, and you offered an opt-out both at collection and in every email since. The exact conditions vary by Member State.
+ Does GDPR treat B2B email marketing differently from B2C?
Not directly. If a business email address identifies a natural person, GDPR applies to it the same way it applies to a consumer address. Some countries’ ePrivacy implementations are more permissive for B2B or role-based addresses, but that’s a national-law distinction, not a GDPR exemption.
+What must an unsubscribe link do to be GDPR-compliant?
It has to let the recipient object to further marketing at least as easily as they gave consent, work without requiring a login or a reason, and be honoured promptly — GDPR guidance and enforcement practice both treat “add a delay” or “require an account” as undermining the right.
+Is the ePrivacy Regulation replacing these rules?
No. The European Commission formally withdrew the proposed ePrivacy Regulation in its 2025 work programme, announced February 2025. The 2002 ePrivacy Directive and each Member State’s national implementation of it remain the applicable law for the foreseeable future.

External Links

Expert contribution

  • Deloitte ► Direct marketing and privacy: striking that balance (Link)
Scroll to Top