Consent and the law: GDPR and ePrivacy, done properly

Why this is the growth lesson in disguise

Here is the practical case for doing this properly, before the legal one: addresses collected without permission cannot be lawfully used, so every hour spent gathering them is wasted twice — once collecting, once deleting. Complaints to data protection authorities are free to file and fines are real. And permission-based lists get delivered and get read, because the people on them asked to be there; Lesson 8.4 will show you that mailbox providers now enforce this economically, whatever the law says. In Europe, lawful and effective are the same list.

Two laws, one programme

Two separate sets of rules apply to marketing email, and you must satisfy both:

• GDPR governs processing personal data. An email address is personal data — usually obviously so (t.herzog@… identifies a person; even info@ addresses often do). Storing, tagging and emailing addresses is processing, and processing needs a lawful basis.
• The ePrivacy rules govern sending electronic direct marketing — email, SMS, and similar. These come from the ePrivacy Directive, which each EU member state has implemented in its own national law. The core rule everywhere: marketing email to individuals requires prior consent, with one carefully bounded exception described below. The details — especially for B2B — genuinely vary by country.

A common and expensive confusion: "we have a lawful basis under GDPR" does not by itself authorise sending marketing email. GDPR's recitals acknowledge that direct marketing may be a legitimate interest — but the ePrivacy rules still demand consent or the soft opt-in for the sending. Legitimate interest is not a loophole around the inbox. Where it genuinely features is narrow: some member states permit opt-out-based email to corporate addresses in B2B contexts. If you plan to rely on that, check your country's specific rule first — this is one of the places national law differs most.

What valid consent looks like

GDPR defines consent tightly: freely given, specific, informed, and unambiguous, by a clear affirmative action. In practice:

• No pre-ticked boxes. The EU's top court has ruled explicitly that a pre-ticked box is not consent. The person must act.
• Unbundled. Consent to marketing cannot be smuggled into a "Download" button or buried in terms. If the button says "Get the guide", the marketing signup needs its own clear wording or its own box.
• Specific and informed. Say what they'll get and roughly how often: "Recovery advice and clinic news, about once a month." Link the privacy notice.
• As easy to withdraw as to give. Which is most of why unsubscribe links exist.
• Recorded. Keep who, when, what wording, and how. Your ESP does this if you let it — a reason it appears in Lesson 8.4's selection criteria.

The soft opt-in — and its real limits

The ePrivacy rules contain one exception worth knowing precisely, because it is both genuinely useful and routinely abused. You may email existing customers without fresh consent, if all of these hold:

1. You obtained the address in the context of a sale of your product or service (some countries extend this to sale negotiations; some don't — national variation again).
2. You are marketing your own similar products or services — not a partner's, not an unrelated line.
3. You told them at collection their address would be used this way, and offered an opt-out at that moment.
4. You offer an opt-out in every message.

What the soft opt-in is not: a basis for emailing people who downloaded a PDF (that's consent territory — the magnet in Lesson 8.3 needs a real signup), a way to use a list someone else collected, or a cure for addresses found, bought or scraped. It covers customers, narrowly, and the "told them at collection" condition means it can't be applied retroactively to a list gathered in silence.

Double opt-in

Double opt-in (DOI) means the signup only counts after the person clicks a confirmation link. GDPR does not use the words "double opt-in" anywhere. So why does this school teach it as the default?

Because consent you can't prove is consent you don't have, and the confirmation click — timestamped, logged by the ESP — is the cleanest proof there is. German case law has effectively made confirmed opt-in the standard of proof there, and if you mail into Germany or Austria you should treat DOI as non-negotiable. Everywhere else it is the difference between asserting your list is clean and demonstrating it — and it filters out typos and fake addresses before they poison your deliverability.

The honest cost: some share of signups never click the confirmation, and they are lost. Accept it. A smaller list you can prove beats a larger one you must hope about.

Unsubscribe, retention, minimisation

Unsubscribe: present in every marketing email, working, free, and requiring no login. Honour it promptly — in practice, immediately; the major mailbox providers now also require one-click unsubscribe for bulk senders and expect opt-outs processed within days. And suppress, don't delete: keeping the address on a do-not-contact list is how you prove you stopped. Deleting it entirely means you could re-import the same address next year and start the whole violation fresh.

Retention: GDPR's storage-limitation principle says keep personal data no longer than needed — it sets no number; you must, and must be able to defend it. A workable rule: contacts inactive for 24 months who never became customers are suppressed and anonymised. Lesson 8.6's sunset policy is this principle wearing work clothes.

Minimisation: collect what the purpose needs. A newsletter needs an email address, perhaps a first name. Birthdays "for later" are a liability collecting dust.

Lena audits the 900

Storkflow's 900-subscriber newsletter list has been sitting untouched since Module 1. Before Lena can market to it, she has to answer a question nobody at Storkflow ever asked: where did these addresses come from? The audit finds three populations:

• 380 customer contacts, collected at purchase, with product updates mentioned and an opt-out offered at signup. Soft opt-in conditions met, for messages about Storkflow's own services. She documents the basis and moves on.
• 340 past trial signups, told at signup their address would be used for onboarding tips and product news, opt-out offered. A trial is the negotiation of a service — soft opt-in territory in the Netherlands, and she notes the national-law caveat in her records. To use them beyond product messages, she sends one value-led re-permission email — "Want the client-intake guides?" — and upgrades the 96 who say yes to full newsletter consent. The rest stay soft-opt-in, product messages only.
• 180 addresses imported in 2022 from a trade-show attendee list the organiser shared. Nobody consented, nobody was told, no sale ever happened. No lawful basis exists, and none can be conjured. She deletes them.

Deleting 180 addresses feels like burning money. It is disposing of a liability — those contacts could never lawfully be mailed, and any accidental send to them was a complaint waiting to be filed. The list drops from 900 to 720, and for the first time every address on it has a documented basis.

Tomas, for contrast, has nothing to triage — the pack's brutal fact from Lesson 8.1 — but his front-desk card was designed right from day one: "Recovery advice and clinic news, about once a month. Tick here if you'd like it. Unsubscribe any time." Affirmative action, specific, informed, opt-out stated. Starting correctly is cheaper than auditing.

Now write your own policy.

---