Introduction

Sooner or later, every business owner opens a blank email to a stranger and hesitates. Is this actually allowed? Under EU law the honest answer is that it depends on three things: who the person is, which country they are in, and how you got their address. Get those right and email becomes a reliable way to grow. Get them wrong and a single campaign can produce a pile of complaints with your company’s name on every one of them.

This article covers the whole picture. It explains the basic rule and the most common myths, the exception that makes customer newsletters legal, how the rules for business recipients differ from country to country, and how legitimate interest works when it is used honestly.

Two Laws, Two Questions

Two sets of EU rules apply at the same time, and each answers a different question.

The ePrivacy rules decide whether you may use the channel at all. Sending direct marketing by electronic mail, which covers both email and text messages, requires the recipient’s prior consent unless an exception applies. The General Data Protection Regulation, decides what you may do with the personal data involved: the address itself, where it came from, and how you use it. For private individuals the result is simple. Without consent, and without an applicable exception, you may not send them marketing emails.

Three myths cause most of the trouble. The first is that business to business marketing falls outside the GDPR. It does not. An address such as name.surname@company.com identifies a real person, so it is personal data and the GDPR applies in full, alongside whatever national rules govern the channel. The second is that you can email people to ask whether you may email them. Regulators have treated an email asking for marketing permission as a marketing email in its own right, so the clever-sounding workaround is simply the same breach written more politely. The third is that moving the same message into social media direct messages changes the rules. It does not remove them. The GDPR still applies to the personal data you use, and the Court of Justice of the EU has read the concept of electronic mail broadly, holding in one case that advertisements displayed inside a user’s email inbox count as direct marketing by electronic mail.

Your Own Customers, and Everyone Else

The exception that keeps most online businesses running is usually called the soft opt-in. If you obtained a customer’s email address in connection with a sale, you may send them marketing about your own similar products or services without asking for new consent, provided two conditions are met. You must have given them a clear, free and easy way to refuse such emails when you collected the address, and you must repeat that opportunity in every message you send. In practice your customer base can be a lawful mailing list, as long as you stay within its limits: the same company, similar products, and an easy way out every time.

The Court of Justice has clarified this exception in the Inteligo Media case. It confirmed that the idea of a sale can also cover people who registered for a free account, where the free service forms part of selling paid products. It also held that where the conditions of the soft opt-in are met, you do not need a separate legal basis under the GDPR to send those marketing emails. Your other GDPR duties, such as being transparent and respecting objections, still apply.

Everyone outside that exception needs real consent. That means an active choice, given for a specific purpose, separate from the purchase itself, and recorded so that you can prove it later. A pre-ticked box is not consent. This is not a theoretical point. The French data protection authority fined the hotel group Accor in a case that included a newsletter box that was ticked by default during bookings. A good habit to adopt is double opt-in, where the person confirms their subscription by clicking a link, because it turns “they definitely signed up” into evidence.

Whatever the legal basis, two things are always required. Every marketing message must clearly identify who is sending it, and it must contain a working way to unsubscribe. Hiding the sender or the exit is prohibited outright.

Business Recipients: A Different Rule in Each Country

Cold outreach to businesses is where most online guides contradict each other, and there is a reason for that. EU law sets the consent rule for individuals, but it leaves each Member State to decide how far to protect companies and other legal persons. The result is a patchwork, and national rules can change over time, so always check the rule in the recipient’s country before a campaign.

Germany and Austria take a strict approach and generally require prior consent even when the recipient is a business. France is more permissive and accepts business to business prospecting on an opt-out basis, meaning without prior consent, where the message relates to the recipient’s professional role and they can easily object.

Slovenia shows why precision matters. The Slovenian Electronic Communications Act requires the prior consent of the subscriber or user for marketing by email, and by its wording that rule applies to subscribers who are natural persons. However, the national communications regulator AKOS and the Information Commissioner have taken the position that an individual’s work address, such as name.surname@company.si, is that person’s personal data, so marketing to it requires prior consent unless the existing customer exception applies. Shared company addresses, such as info@company.si, are treated differently. In practice the safest approach for named addresses in Slovenia is therefore to obtain consent first, relying otherwise only on the customer exception.

Legitimate Interest, Used Honestly

Legitimate interest is often used as a phrase that is meant to make questions go away. Used properly, it is a real legal basis. The GDPR itself recognises that direct marketing may be carried out on the basis of legitimate interest.

Its limit, however, is firm. Legitimate interest can justify the handling of personal data in countries and situations where the channel itself allows marketing without prior consent. It can never override a national rule that says the channel requires consent. Where the ePrivacy rules demand consent, legitimate interest is not a substitute.

Using it honestly involves four things. First, you document your assessment before you send anything, weighing your business interest against the person’s reasonable expectations and rights. Second, the message is genuinely relevant to that person’s professional role. Third, the first time you write, you tell the person where you obtained their address, as the GDPR requires when personal data was not collected from them directly. Fourth, you treat any objection as final. Under the GDPR the right to object to direct marketing is absolute, so anyone who objects must be added to a suppression list, meaning a list of people you must never contact again, and must not hear from you again.

A Practical Checklist

Five steps turn these rules into a routine.

1. Sort every address by its source. Customers can be covered by the soft opt-in, subscribers by recorded consent, and everyone else is a prospect who needs a check against the recipient’s country before any campaign. A single column in your spreadsheet for the recipient’s country makes this manageable.

2. Treat purchased lists as high risk. Consent that someone gave to another company, for that company’s messages, almost never transfers to you.

3. Fix your templates. Every message needs a real sender, a genuine reason why this person is receiving it, a one-click way to unsubscribe and, where the address did not come from the person directly, a note saying where you obtained it.

4. Build the systems. Keep consent records and suppression lists inside your email tool, and make sure the objection link works even for business emails that did not need prior consent.

5. Respect the stakes. Breaches of the GDPR consent rules fall within its highest fine tier, up to 20 million euros or four per cent of worldwide annual turnover, whichever is higher, in addition to national penalties for unsolicited messages. And unlike many breaches, every recipient of a bad campaign is a potential complainant who already has the evidence in their inbox.

Your email software will not check any of this for you. It simply multiplies whatever you give it, which means it multiplies mistakes just as efficiently as it multiplies good campaigns.

Conclusion

In summary, marketing emails to private individuals generally need prior consent, and a named work address is personal data whatever the business to business myth suggests. Your own customers are the main exception, because the soft opt-in covers your similar products as long as you offered a way to refuse when you collected the address and repeat it in every message, and the Court of Justice has confirmed it can cover free accounts that form part of selling paid products. Newsletters for everyone else require active, separate and recorded consent, ideally confirmed through double opt-in and never through a pre-ticked box. Rules for business recipients vary by country, from strict consent in Germany and Austria to role-based opt-out in France and consent for named work addresses in Slovenia. And legitimate interest is a documented assessment with an absolute right to object, never a phrase that makes the rules disappear. The underlying principle is simple and it does not change when the tools do. Before any message goes out, you should be able to say who the person is, how you got their address, and which rule allows you to write to them. A business that can answer those three questions for every contact can use email with confidence.