ChecklistEU

EU ePrivacy Directive direct-marketing consent checklist

Check each campaign against Article 13 before sending automated calls, fax, email, SMS, stored messages, or similar electronic direct-marketing communications.

Use the checklist to record channel scope, sender identity, consent proof, existing-customer soft opt-in logic, opt-out handling, suppression records, and Member State caveats.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 26, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 26, 2026

Overview

Article 13 of the ePrivacy Directive is the starting point for EU electronic direct-marketing checks. Treat each campaign as a channel-specific decision: identify the communication method, confirm whether prior consent or a narrow existing-customer email exception is available, make the sender clear, provide an easy free opt-out, and keep proof that the chosen route was available before the message was sent.

Section 1

1. Classify the channel and message scope

Start by deciding whether the campaign uses automated calling systems without human intervention, fax, electronic mail, or another unsolicited direct-marketing channel. The Directive defines electronic mail broadly enough to cover text, voice, sound, or image messages sent over a public communications network and stored until collection.

Record the product, service, audience, country coverage, sender entity, sending platform, and whether the journey also stores or accesses information on the recipient's device, such as tracking pixels, link identifiers, cookies, or app identifiers.

Channel: automated call, fax, email, SMS, in-app stored message, or another national-law direct-marketing channel.
Purpose: direct marketing only, service notice only, or mixed service-and-marketing content.
Recipient type: subscriber, user, existing customer, prospect, business contact, or unclear.
Technical access: whether the message or landing journey stores or accesses terminal-equipment information.
Country caveat: do not assume one EU-wide rule for channels outside Article 13(1) and 13(2); Member State law determines the consent-or-opt-out choice for other cases.

Sources for this answer

Directive 2002/58/EC Article 13 - unsolicited communications

Article 13 supplies the channel-specific direct-marketing rule, including prior consent for automated calling systems, fax, and electronic mail.

Directive 2002/58/EC definition of electronic mail

Article 2(h) supports treating stored text, voice, sound, or image messages over public communications networks as electronic mail.

EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive

Use this source when the marketing message or landing page includes pixels, cookies, local storage, SDKs, or other terminal-equipment access.

Section 2

2. Choose the lawful send route before launch

For automated calling systems without human intervention, fax, and electronic mail used for direct marketing, the default Article 13 route is prior consent. Do not treat a generic privacy-policy acknowledgement, passive account creation, or pre-ticked preference as enough consent evidence.

For electronic mail sent to existing customers, Article 13(2) supports a narrower route when the same sender collected the contact details in the context of a sale, markets its own similar products or services, and gave a clear, distinct, free, easy chance to object both when details were collected and in each later message.

Prior consent route: keep the consent text, channel, purpose, sender identity, timestamp, source form or preference center, country, and version shown to the recipient.
Existing-customer soft opt-in route: confirm there was a sale of a product or service, the same legal person collected the electronic contact details, and the campaign covers that sender's own similar products or services.
No route: suppress the recipient when consent proof is missing, the soft opt-in facts are incomplete, the products are not similar, the sender changed, or the contact previously objected.
GDPR consent quality: consent used for ePrivacy must remain freely given, specific, informed, unambiguous, and demonstrable.

Sources for this answer

Directive 2002/58/EC Article 13 - prior consent and soft opt-in

Article 13(1) sets the prior-consent rule; Article 13(2) supports the existing-customer electronic-mail exception for own similar products or services.

Directive 2009/136/EC amendments to Article 13

The 2009 amendment text confirms the updated Article 13 wording on users, prior consent, existing-customer email marketing, and opt-out opportunities.

EDPB Guidelines 05/2020 on consent

EDPB consent guidance supports the consent-quality and proof checks where Article 13 relies on consent.

Section 3

3. Make opt-out and sender identity non-negotiable

Every electronic-mail marketing message relying on the existing-customer route needs a free and easy objection path in the message. The same opt-out control should also be checked for consent-based campaigns because withdrawal must be easy and the sender needs reliable suppression evidence.

Article 13 separately prohibits direct-marketing electronic mail that disguises or conceals the sender identity, lacks a valid address for stop requests, or sends recipients to websites that contravene the e-commerce information rule referenced in the Directive.

Sender identity: show the legal or trading sender on whose behalf the communication is made; do not hide behind the platform, agency, or group brand.
Stop address: include a valid address or working unsubscribe mechanism that receives requests to stop communications.
Opt-out cost: make refusal free of charge apart from ordinary transmission costs and easy enough for the recipient to use without account login friction.
Per-message check: include the opt-out opportunity on each message when the customer has not already refused.
Suppression action: move opt-outs, withdrawals, bounces that indicate stop requests, and manual complaints into the suppression process before the next send.

Sources for this answer

Directive 2002/58/EC Article 13 - opt-out and sender identity

Article 13(2) supports the free and easy objection check; Article 13(4) supports the identity and valid-address checks.

Directive 2009/136/EC amendments to Article 13

The amendment text adds the prohibition on messages that encourage visits to websites contravening the referenced e-commerce information rule.

EDPB Guidelines 05/2020 on consent

Use this source to test whether withdrawal from consent-based marketing is available and operational.

Section 4

4. Keep proof, suppression, and national-law notes

Close the checklist only when the campaign record proves the selected route for each recipient segment. The record should let a reviewer see why a send happened, why a recipient was suppressed, and which jurisdiction-specific caveat still needs local validation.

The ePrivacy Directive particularises and complements the GDPR, and Member States implement and enforce national ePrivacy rules through national law. Avoid adding country-specific rules, penalties, authority names, or limitation periods unless those facts are separately grounded for the country.

Consent proof fields: consent statement, purpose, channel, sender, capture method, timestamp, source URL or form, locale, policy version, and withdrawal path shown.
Soft opt-in proof fields: sale record, collecting legal person, collection notice, initial refusal option, product-similarity rationale, and per-message objection mechanism.
Suppression fields: recipient identifier, reason, date received, source system, campaign affected, operator if manual, and downstream systems updated.
Review triggers: new sender entity, new product category, new country, new channel, new tracking technology, changed unsubscribe flow, list import, or acquisition of another customer base.
Blocked facts: leave penalties and country-by-country marketing rules out unless supported by jurisdiction-specific source material.

Sources for this answer

Directive 2002/58/EC Article 13 - national-law caveat

Article 13(3) leaves the consent-or-opt-out choice for other direct-marketing cases to national legislation.

EDPB Guidelines 05/2020 on consent

EDPB consent guidance supports keeping records that demonstrate valid consent and operational withdrawal.

European Commission ePrivacy framework overview

Commission material supports treating ePrivacy as the EU privacy framework for electronic communications alongside GDPR modernization work.

Recommended next step

Use this EU ePrivacy checklist before marketing sends

Sorena can help convert campaign facts into a cited Article 13 send record, consent-proof gap list, opt-out control check, and country-law validation queue.

Research workflow

Open Research Copilot for EU ePrivacy

Ask source-linked questions about direct-marketing consent, Article 13 scope, soft opt-in facts, and evidence records using the cited sources on this page.

Explore next step

Talk to Sorena

Review an EU direct-marketing campaign

Check sender identity, consent proof, suppression handling, and national-law caveats before a marketing send.

Explore next step

Primary sources

References and citations

Directive 2002/58/EC Article 13 - national-law caveat

eur-lex.europa.eu

Referenced sections

Article 13(3) leaves the consent-or-opt-out choice for other direct-marketing cases to national legislation.

"determined by national legislation"

Directive 2002/58/EC Article 13 - opt-out and sender identity

eur-lex.europa.eu

Referenced sections

Article 13(2) supports the free and easy objection check; Article 13(4) supports the identity and valid-address checks.

"disguising or concealing the identity"

Directive 2002/58/EC Article 13 - prior consent and soft opt-in

eur-lex.europa.eu

Referenced sections

Article 13(1) sets the prior-consent rule; Article 13(2) supports the existing-customer electronic-mail exception for own similar products or services.