What is GDPR in Email Marketing

GDPR Email advertising

Sending newsletters or e-mail advertising is a constant in online marketing. In principle, the prohibition with reservation of permission also applies here to the processing of personal data. The processing is only lawful if either the data subject's consent or a legal justification is given. When sending e-mail advertising, this could be the safeguarding of the controller's legitimate interests. Recital 47 of the General Data Protection Regulation expressly states that the law also recognizes the processing of personal data for the purpose of direct marketing as a legitimate interest of the person responsible.

In addition, such an interest could exist, for example, if there is a relevant and appropriate relationship between the data subject and the person responsible. For example, if the person concerned is a customer of the person responsible or is in his service. Therefore, there is much to be said for the interpretation that e-mail advertising is permitted without consent, at least for existing customers. If the company can demonstrate a legitimate interest in cold calling through email advertising, the advertising emails could also be permitted to potential customers without consent. In order not to receive any further information by newsletter or email, the customer addressed only has to object to the processing for advertising purposes.

However, it should be noted that, according to Art. 95, the General Data Protection Regulation should only apply to all data protection issues, unless special regulations with the same regulatory objective result from the ePrivacy Directive (see also recital 173). As a result, e-mail advertising is currently only permitted with the consent of the person concerned. (Art. 13 para. 1 Directive 2002/58 / EC) It remains to be seen whether the upcoming ePrivacy Regulation will provide more clarity on this issue.

Regardless of whether a company subsequently bases the advertising measure on a legitimate interest or on consent, there are extensive information obligations for the person responsible for the recipient of the e-mail advertising. These differ in content depending on the chosen justification reason.

External links


  • Data protection conference DSK ► Short paper No. 3 - Processing of personal data for advertising (Link)
  • Data protection conference DSK ► Orientation aid for the processing of personal data for the purposes of direct mail (link)
  • Data Protection Authority Bavaria ► Processing of personal data for advertising (Link)
  • Data Protection Authority UK ► Direct marketing (Link)

Technical articles

  • Ryte ► Data protection 2018 - What online marketers should know and do (Link)
  • Data protection notes ► Send newsletters in accordance with the law and specific tips on using MailPoet (Link)
  • IHK Saarland ► Processing of personal data for advertising purposes (Link)