Email marketing and consent

The rules for commercial email are settled and routinely breached, usually by businesses that acquired a list and assumed it was usable.

The general rule

Sending unsolicited commercial communication to an individual requires their prior consent. That consent must be freely given, specific, informed and unambiguous, and it must be documented.

Documented means you can show, for each address: when consent was given, what wording was displayed, and evidence that the person themselves gave it.

Double confirmation

The practical mechanism is a confirmation email with a link that must be clicked before the address becomes active.

Without it, you cannot demonstrate that the address holder gave the consent rather than someone typing their address. In disputes this is the point on which cases turn.

Store per record: timestamp, IP address where available, the consent wording shown, and the confirmation timestamp.

The existing-customer exception

Most European jurisdictions provide a narrow exception permitting a business to email its own customers about similar goods or services, subject to conditions.

All conditions must be met. The exception does not cover enquiries that did not result in a sale, does not cover unrelated product categories, and never covers third-party offers.

What every message must contain

A clear identification of the sender, including the legal entity. A working unsubscribe mechanism that operates in one step. The commercial nature of the message, apparent from the subject line and sender. And the company information required by commercial law in your jurisdiction.

Unsubscribes must be actioned promptly and permanently, across all systems and all lists.

Purchased and rented lists

Buying a list does not transfer valid consent. Consent is given to a named controller for a named purpose; it does not travel.

Lists sold as consented are frequently based on consent language mentioning "carefully selected partners", which does not meet the specificity requirement in most interpretations.

The enforcement reality

Complaints come from recipients, from competitors and from consumer associations. The usual sequence is a formal warning with a demand for a signed undertaking and costs, followed by proceedings.

The exposure is per message and repeat breaches after an undertaking carry contractual penalties. It is one of the cheapest legal risks to avoid entirely.