GDPR and Email Marketing: Consent Basics for Small Online Shops

Does GDPR apply to a small shop outside the EU?

Often, yes. The European Commission explains that the GDPR applies to a company established outside the EU when it offers goods or services, paid or free, to individuals in the EU, or monitors their behavior there. The key test is targeting: a non-EU business that doesn’t specifically target people in the EU isn’t covered just because an EU resident happens to use its site while traveling.

Size doesn’t get you out of it either. The Commission states that the application of the GDPR does not depend on the size of your company. Some record-keeping duties are lighter for organizations with fewer than 250 employees, but the rules on lawful processing and consent apply to everyone.

The United Kingdom has its own versions of these rules (the UK GDPR and the Privacy and Electronic Communications Regulations, or PECR), enforced by the Information Commissioner’s Office. They’re similar in shape, and we note the UK specifics where they matter.

Two sets of rules: GDPR and ePrivacy

Marketing email in the EU sits under two layers of law, and it helps to keep them apart:

The two layers fit together in a way that settles most questions for a store. The EDPB’s guidelines on legitimate interest (version for public consultation) state that under the ePrivacy Directive, unsolicited direct marketing by email can only be sent with the prior consent of the recipient, that this consent must meet the GDPR’s definition, and that in this context the processing can’t be based on legitimate interest instead.

In plain terms: for marketing email to people who aren’t already your customers, plan on consent. For existing customers, there’s an exception, covered below.

What counts as valid consent

Under the GDPR, consent has to be freely given, specific, informed and unambiguous, and given by a statement or a clear affirmative action. The EDPB’s Guidelines 05/2020 on consent explain each element. Here’s what they mean for an email sign-up.

Freely given: no bundling, no penalty for saying no

People must be able to refuse or withdraw consent without detriment. Two common store patterns fail this test:

1. Making marketing a condition of buying. If checkout can’t be completed unless the customer agrees to receive newsletters, consent isn’t freely given. Marketing isn’t necessary to deliver an order, and the EDPB’s SME guide says the “contract” legal basis doesn’t cover marketing.
2. Bundling marketing into the terms and conditions. The EDPB says consent can’t be obtained through the same motion as agreeing to a contract or accepting general terms. “By placing your order you agree to our terms and to receive marketing emails” doesn’t work.

What about sign-up incentives such as a discount code? The EDPB says the GDPR does not preclude all incentives, but the burden is on the business to show that consent was still freely given. Its guidelines include the example of a fashion retailer’s newsletter: when a subscriber withdraws consent to personalized offers and goes back to receiving general discounts, that loss doesn’t count as detriment, because only a permissible incentive was lost. Keep incentives proportionate, and never make withdrawal cost the person something.

Specific: one consent per purpose

If you use email addresses for more than one purpose, people need to be able to agree to each separately. The EDPB gives a directly relevant example: a retailer asking, in one consent request, to send marketing email and to share customers’ details with other companies in its group. That consent isn’t valid because the two purposes aren’t separated.

For a small shop, the usual purposes are your own marketing email and, sometimes, sharing with a partner brand. If you ever plan the second, ask separately, and name the partner.

Informed: what to tell people at sign-up

The EDPB lists the minimum information people need for consent to be informed:

1. who you are (the business asking for consent),
2. the purpose of each processing operation you’re asking consent for,
3. what type of data you’ll collect and use,
4. that they can withdraw consent,
5. information about automated decision-making, where relevant, and
6. risks of data transfers outside the EU without an adequacy decision or appropriate safeguards, where relevant.

You don’t have to fit all of this into the form. A short statement next to the field, linking to your privacy notice for details, is a common layered approach, but keep the key facts (who, what you’ll send, how to unsubscribe) next to the button.

Unambiguous: a clear action, no defaults

The EDPB is explicit that pre-ticked opt-in boxes are invalid, that silence, inactivity or simply continuing to use a service aren’t consent, and that scrolling or swiping through a page can never be a clear affirmative action. Opt-out boxes that a person has to untick to avoid agreeing are also not allowed.

The existing-customer exception (“soft opt-in”)

The ePrivacy Directive includes a narrow exception for your own customers. As the EDPB summarizes it, when you obtain someone’s electronic contact details from them in the context of selling a product or service, you may use them for direct marketing of your own similar products or services, as long as:

1. the contact details were obtained lawfully, in the context of a sale,
2. the marketing is for your own similar products or services,
3. customers were told about this and given a clear, easy, free way to object when their details were collected, and
4. every message gives them that same way to object.

In the UK, the ICO calls this the “soft opt-in.” Its guidance on electronic mail marketing sets out the same core conditions: the person bought, or negotiated to buy, a similar product or service from you; you gave them a simple way to opt out when you collected their details and in every message; and you’re marketing your own similar products. The ICO adds that the exception doesn’t cover prospective customers or lists you’ve bought. Note that the ICO page currently says its guidance is under review following changes made by the Data (Use and Access) Act, so check it for updates.

For a store, this means a checkout can offer a clear “Don’t send me marketing emails” option at the point of purchase, and you can then email customers about similar products, with an opt-out in every message. Two cautions: national laws in EU countries implement this exception, and the details can differ; and it covers people who bought or were in the process of buying, not people who only entered an address in a pop-up.

Wording your sign-up form

Put the essentials where people decide. Here are two examples you can adapt:

Newsletter form (single purpose):

  Email address [______________]
  [ Subscribe ]
  Get new arrivals and member offers from Northline Goods by
  email, about twice a month. Unsubscribe anytime with the link
  in every email. Privacy notice: [link]

Checkout (separate, unticked box):

  [ ] Email me about new arrivals and offers from Northline Goods.
      You can unsubscribe at any time. Privacy notice: [link]

1. Name your business. Don’t make people guess who will email them.
2. Say what you’ll send and roughly how often. It sets expectations and supports the “informed” element.
3. Mention that they can unsubscribe. The EDPB says people must be told about the right to withdraw before they give consent.
4. Keep the marketing checkbox separate from any terms or privacy acknowledgement.
5. Collect only what you need. For a newsletter, an email address is usually enough.

If you’re reviewing a form anyway, our guide to finding where people give up on a form shows how extra fields can cost completions.

Children

The EDPB’s guide for small businesses explains that children aged 16 and over can give their own consent for online services, while for younger children consent must come from a parent or guardian. EU countries can set the age anywhere between 13 and 16, so check the national rule. If your products appeal to teenagers, think about how you’d handle sign-ups from under-age users.

Keeping records of consent

Under the GDPR, the burden of proof is on you: you must be able to show that each person consented. The EDPB says the GDPR doesn’t prescribe exactly how, but suggests you be able to show how and when consent was obtained, and what information the person was given at the time. In an online context, it suggests keeping information on the session in which consent was given, documentation of the consent workflow at that time, and a copy of the information presented. It adds that merely referring to a correct configuration of your website is not sufficient.

For a small shop, that translates into a simple record:

The EDPB also warns that demonstrating consent shouldn’t lead to collecting excessive extra data. Keep enough to show the link to consent, not more. Proof of consent should be kept while you’re emailing the person, and afterward no longer than necessary for legal obligations or legal claims.

There’s no fixed expiry date for consent under the GDPR. The EDPB says it depends on context, and recommends refreshing consent at appropriate intervals as a best practice. If you haven’t emailed a segment in a long time, a fresh confirmation is safer than suddenly restarting campaigns.

Unsubscribes: withdrawal and the right to object

Two rights point the same way, and you need to honor both:

1. Withdrawing consent. It must be as easy to withdraw consent as to give it, at any time. The EDPB says that if consent was given online with one click, withdrawal must be equally easy, and that people should be able to withdraw through the same interface, such as your website or email, without charge. Its example of a business that only lets people withdraw by calling a call center during office hours is given as non-compliant.
2. Objecting to direct marketing. Under Article 21 of the GDPR, people can object at any time to the use of their data for direct marketing. The EDPB describes this right as unconditional and irrespective of the legal basis you rely on, with no reason required. Once someone objects, their data must no longer be used for marketing.

The Commission adds that you must tell people, in your privacy notice or at the latest in your first communication, that you’ll use their data for direct marketing and that they have a right to object. In practice, an unsubscribe link in every email, a one-page unsubscribe flow, and a line in your privacy notice cover this. Make sure an unsubscribe in one tool stops marketing from all the tools you use.

Bought lists and partner data

The Commission’s guidance on using data received from a third party says that before acquiring a contact list, you must be able to show the data was obtained in compliance with the GDPR and that it may be used for advertising. If the list was built on consent, that consent should have covered passing the data to others for their own marketing. You also need to keep the list up to date, never send to anyone who has objected, and tell people where you got their data at the latest in your first message. Combined with the ePrivacy consent requirement for email, buying lists is rarely workable for a small shop. Growing your own list is slower but far safer.

Business customers

If you sell to businesses, the rules depend on who the recipient is. The EDPB notes that marketing to legal persons that doesn’t involve personal data falls only under the ePrivacy Directive, and that some national laws impose consent requirements that go beyond the Directive, for example for marketing to professionals. In the UK, the ICO says you can email corporate bodies, but sole traders and some partnerships are treated as individuals, and you should keep a “do not email” list of businesses that object. Check the national rules for each country you target.

What about website tracking?

Email consent isn’t the only consent question for an online store. The EDPB notes that the ePrivacy Directive also requires consent for storing or accessing information on a user’s device, such as cookies, unless an exemption applies, and that where tracking is used for direct marketing, those requirements must be respected. Many stores use a separate cookie consent tool for this. It’s a different question from email consent, so treat it on its own.

Penalties

The Commission’s overview of enforcement says data protection authorities can impose fines of up to €20 million or 4% of a business’s total annual worldwide turnover, and that fines must be effective, proportionate and dissuasive. Authorities weigh factors such as the gravity and duration of the infringement and whether it was intentional, and can also issue reprimands or ban processing.

A one-page checklist

1. Decide whether you target customers in the EU or UK. If yes, these rules apply to those subscribers.
2. List every place an email address enters your list, and the legal basis for each: consent, or the existing-customer exception.
3. Remove pre-ticked boxes, opt-out constructions and marketing language bundled into terms.
4. Add clear wording next to every sign-up: who you are, what you’ll send, how to unsubscribe, link to your privacy notice.
5. At checkout, offer a clear way to refuse marketing if you rely on the existing-customer exception.
6. Keep dated copies of each version of your sign-up wording, and record when and where each person signed up.
7. Put an unsubscribe link in every marketing email and make sure it works on a single page, free of charge.
8. Make an unsubscribe in one tool stop marketing everywhere, including manual requests sent by reply.
9. Don’t email bought lists.
10. Refresh consent for long-dormant segments before emailing them again.

Where marketingLABO fits (and where it doesn’t)

marketingLABO is a marketing tool, not a compliance tool. It does not include a consent management feature, cookie consent banner or consent record log, so you’ll need to handle those parts of your setup yourself or with a dedicated tool. Where it can help with the steps above:

1. Sign-up forms. The form builder includes checkbox fields, so you can add a separate marketing opt-in next to any other questions. Leave it unticked, keep it apart from the terms agreement field, and remember that the box on its own doesn’t control who receives email; it’s up to you to send marketing only to people who opted in.
2. Unsubscribe links. The unsubscribe link isn’t added automatically. The email editors include an option to insert one, which becomes a personal link for each recipient when the email is sent. Add it to every marketing email and test it.
3. Honoring opt-outs. People who unsubscribe aren’t sent newsletters and don’t receive the remaining emails in a journey. If someone objects by reply, you can mark them as unsubscribed in their contact record.

Newsletters are on the Light plan and automated journeys on the Standard plan; see the pricing section. For the US side of email compliance, read our CAN-SPAM compliance checklist, and for structuring the first emails new subscribers get, see How to Build a Welcome Email Series.

FAQ

Can I rely on legitimate interest instead of consent for my newsletter?
For unsolicited marketing email, the EDPB says the ePrivacy Directive requires prior consent, so legitimate interest can’t replace it. The exception is marketing your own similar products to existing customers under the conditions above.

Do I have to re-ask all my existing subscribers?
Not automatically. If you can show they gave consent that meets the GDPR standard, it remains valid. If you can’t show how or when they signed up, or the sign-up used a pre-ticked box, that consent is unlikely to hold.

Is a discount for subscribing allowed?
The EDPB says incentives aren’t ruled out, but you must be able to show that consent was still freely given. Withdrawing later must not cost the person anything.

Does the same apply to the UK?
The UK has its own GDPR and PECR, with a similar soft opt-in for existing customers. The ICO’s guidance is currently under review following the Data (Use and Access) Act, so check it before relying on details.

Sources

European Data Protection Board, “Guidelines 05/2020 on consent under Regulation 2016/679”: https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_202005_consent_en.pdf

European Data Protection Board, “Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR” (version for public consultation): https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202401_legitimateinterest_en.pdf

European Data Protection Board, “Process personal data lawfully” (data protection guide for small business): https://www.edpb.europa.eu/sme/be-compliant/process-personal-data-lawfully_en

European Commission, “Application of the GDPR”: https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/application-gdpr_en

European Commission, “Can data received from a third party be used for marketing?”: https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/legal-grounds-processing-data/can-data-received-third-party-be-used-marketing_en

European Commission, “Enforcement and sanctions”: https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/enforcement-and-sanctions_en

Information Commissioner’s Office (UK), “Electronic mail marketing”: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/