The short answer
To send newsletters lawfully in Europe you need five things: freely given, specific consent from the people you email (or, for your own customers, the “soft opt-in”), proof of that consent, a clear privacy notice, an unsubscribe link in every email, and a provider that processes the data on your behalf under a contract (a DPA), ideally with the data kept in the European Union. Each one is explained in practice below.
When you need consent
Marketing emails in Europe are governed by two sets of rules: the GDPR, which covers personal data in general, and the ePrivacy Directive, which each country turns into its own law for electronic marketing. In the UK the equivalents are the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). The basic rule is the same: to send marketing emails to individuals you need their prior consent.
Consent only counts if it meets a few conditions:
- It must be freely given: no pre-ticked boxes, and no making consent a condition for using a service or downloading a freebie.
- It must be specific: consent to the newsletter is separate from accepting your terms or placing an order.
- It must be informed: say who you are and what you will send.
- It must be an active choice: silence or inactivity is not consent.
- An address you found online, on a website or in a directory, is not permission to write.
The soft opt-in: emailing your own customers
There is a useful exception for businesses. If someone gave you their email address while buying from you (in the UK, also while negotiating a sale), you can send them marketing about your own similar products or services without separate consent, provided that:
- you gave them a simple way to opt out when you collected the address;
- every email you send offers the same easy, free way to opt out.
The soft opt-in does not cover addresses from a competition, a business card or a bought list. And it only covers your own similar products, not partners’ offers.
Emailing businesses: the rules differ by country
In the UK, PECR lets you send marketing emails to corporate subscribers (companies, partnerships, public bodies) without consent, as long as you identify yourself and give them a way to opt out; sole traders and some partnerships are treated like individuals. Across the EU the rules vary: some countries, such as France, allow B2B emails relevant to the recipient’s job with an opt-out, while others, such as Germany and Italy, generally require consent for business addresses too. If you write to businesses in several countries, consent is the safe choice everywhere.
How to collect consent the right way
- Use a clear sign-up form: say what you will send and how often (“offers and news, once or twice a month”).
- If the form also does something else (an order, a booking), add an unticked box just for the newsletter.
- Link your privacy notice: who handles the data, why and for how long.
- Turn on double opt-in: subscribers confirm with one click from their inbox. The law does not require it, but it is the strongest proof.
- Only ask for what you need: an email address and a first name are almost always enough.
Proving consent
The GDPR (Article 7) requires you to be able to demonstrate that consent was given. You do not need a signature, but you must be able to show who agreed, when, how and to what. For every contact, keep:
- where they came from (website form, shop, file import, till);
- the date and time they signed up and confirmed;
- the wording they saw when they signed up;
- for imports, where the list came from and how consent was collected.
On Spedito this is saved automatically for every contact: open the contact and look under consent. We explain how in Consent and GDPR.
What every email must include
- Who you are: your business name as the sender, easy to recognise.
- An unsubscribe link that works in one click. Gmail and Yahoo also require it as a technical header from bulk senders, and expect unsubscribes to be honoured within two days.
- A contact address for your business.
- Content that matches what people signed up for.
Spedito adds the unsubscribe link automatically, including one-click unsubscribe from the inbox, plus your postal address, in each recipient’s language. Anyone who unsubscribes gets nothing more, even if you re-import them by mistake.
If you also email people in the United States, the US CAN-SPAM Act works the other way round: no prior consent needed, but every email must have a working opt-out, honoured within ten business days, and a valid postal address. Following the European rules covers you there too.
Your provider: DPA and where the data lives
The platform you use for newsletters processes your subscribers’ data on your behalf: under the GDPR it is a processor, and you need a written contract with it, the DPA (Article 28). Also check where the data is stored: transfers outside the EU and the UK need extra safeguards.
With Spedito the DPA applies to every customer and is in our legal pages. Data stays in the European Union: the database is in Frankfurt and emails are sent from servers in Ireland. The full list of providers is in the privacy policy.
Bought lists, people’s rights and fines
Do not buy email lists. Whoever sells them cannot pass on consent that was given to them, and bought lists are full of old addresses and spam traps that also damage your deliverability.
People have the right to know what data you hold, to have it corrected and to have it deleted. On Spedito you can export a contact’s data or delete them for good with one click from their profile.
GDPR fines (Article 83) go up to 20 million euros or 4% of worldwide annual turnover; in the UK the ICO can also fine for PECR breaches. For a small business, though, the more immediate risk is spam complaints, which push even the emails your fans want into the wrong folder.
The final checklist
- Sign-up form with a clear purpose and an unticked box (where needed).
- Privacy notice linked from the form.
- Double opt-in turned on.
- For customers: soft opt-in offered at checkout, with an opt-out.
- Source and date of consent saved for every contact.
- Unsubscribe link and postal address in every email.
- DPA in place with your provider, data in the EU.
- No bought or scraped lists.
Frequently asked questions
Can I send newsletters to my customers without consent?
Yes, under the soft opt-in: if they gave you their address while buying, you can market similar products of your own, as long as you offered an opt-out when collecting the address and in every email.
Is double opt-in required by GDPR?
No, the GDPR does not require it. But you must be able to prove consent, and double opt-in is the most reliable way to do it. In Germany and Austria it is standard practice.
Can I add people from business cards to my list?
Only if they agreed to receive your emails. A business card is not consent to a newsletter. In the UK, emails to corporate addresses are allowed without consent, but you must identify yourself and offer an opt-out.
How long can I keep contacts?
As long as the person stays subscribed and it makes sense to write to them. It is better to remove people who have not opened anything in a long time: it also helps deliverability. Keep the proof of consent for as long as you use the data, and as long as you might need to show it.
Is Spedito GDPR compliant?
Spedito keeps data in the European Union, provides a DPA to every customer, saves proof of consent, adds an unsubscribe option to every email and lets you export or delete a contact’s data. Deciding whom you may contact remains your responsibility.