ChecklistEU

EU ePrivacy Directive direct-marketing consent checklist

Check each campaign against Article 13 before sending automated calls, fax, email, SMS, stored messages, or similar electronic direct-marketing communications.

Use the checklist to record channel scope, sender identity, consent proof, existing-customer soft opt-in logic, opt-out handling, suppression records, and Member State caveats.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 25, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 25, 2026

Overview

Article 13 is the EU starting point, but the send decision is channel-, recipient-, sender-, and country-specific. Prior consent is the baseline for automated calling systems without human intervention, fax, and used for direct marketing. The Article 13(2) soft opt-in is limited to electronic contact details obtained from customers in the context of a sale, used by the same natural or legal person for its own similar products or services, with a clear, free, easy objection opportunity at collection and in every message. National law controls other channels and the protection of legal persons.

Section 1

1. Classify the channel and message scope

Start by deciding whether the campaign uses automated calling systems without human intervention, fax, , or another unsolicited direct-marketing channel. The Directive defines electronic mail broadly enough to cover text, voice, sound, or image messages sent over a public communications network and stored until collection.

Record the product, service, audience, country coverage, sender entity, sending platform, and whether the journey also stores or accesses information on the recipient's device, such as tracking pixels, link identifiers, cookies, or app identifiers.

Channel: automated call, fax, email, SMS, in-app stored message, or another national-law direct-marketing channel.
Purpose: direct marketing only, service notice only, or mixed service-and-marketing content.
Recipient type: subscriber, user, existing customer, prospect, business contact, or unclear.
Technical access: whether the message or landing journey stores or accesses terminal-equipment information.
Country caveat: do not assume one EU-wide rule for channels outside Article 13(1) and 13(2); Member State law determines the consent-or-opt-out choice for other cases.

Sources for this answer

Directive 2002/58/EC Article 13 - unsolicited communications

Articles 2(h) and 13 supply the definition of electronic mail and the channel-specific direct-marketing rule, including prior consent for automated calling systems, fax, and electronic mail.

EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive

This source supports review when the marketing message or landing page includes pixels, cookies, local storage, SDKs, or other terminal-equipment access.

Section 2

2. Choose the lawful send route before launch

For automated calling systems without human intervention, fax, and used for direct marketing, the default Article 13 route is prior consent. Do not treat a generic privacy-policy acknowledgement, passive account creation, or pre-ticked preference as enough consent evidence.

For sent to existing customers, Article 13(2) supports a narrower route when the same sender collected the contact details in the context of a sale, markets its own similar products or services, and gave a clear, distinct, free, easy chance to object both when details were collected and in each later message.

Prior consent route: keep the consent text, channel, purpose, sender identity, timestamp, source form or preference center, country, and version shown to the recipient.
Existing-customer soft opt-in route: document how the electronic contact details were obtained from the customer in the context of a sale, confirm that the same natural or legal person collected and uses them, and show that the campaign covers that sender's own similar products or services. Check national law before deciding whether an uncompleted transaction or another borderline collection journey qualifies.
No route: suppress the recipient when consent proof is missing, the soft opt-in facts are incomplete, the products are not similar, the sender changed, or the contact previously objected.
GDPR consent quality: consent used for ePrivacy must remain freely given, specific, informed, unambiguous, and demonstrable.

Sources for this answer

Directive 2002/58/EC Article 13 - prior consent and soft opt-in

Article 13(1) sets the prior-consent rule; Article 13(2) supports the existing-customer electronic-mail exception for own similar products or services.

Directive 2009/136/EC amendments to Article 13

The 2009 amendment text confirms the updated Article 13 wording on users, prior consent, existing-customer email marketing, and opt-out opportunities.

EDPB Guidelines 05/2020 on consent

EDPB consent guidance supports the consent-quality and proof checks where Article 13 relies on consent.

Section 3

3. Make opt-out and sender identity non-negotiable

Every electronic-mail marketing message relying on the existing-customer route needs a free and easy objection path in the message. The same opt-out control should also be checked for consent-based campaigns because withdrawal must be easy and the sender needs reliable suppression evidence.

Article 13 separately prohibits direct-marketing that disguises or conceals the sender identity, lacks a valid address for stop requests, or sends recipients to websites that contravene the e-commerce information rule referenced in the Directive.

Sender identity: show the legal or trading sender on whose behalf the communication is made; do not hide behind the platform, agency, or group brand.
Stop address: include a valid address or working unsubscribe mechanism that receives requests to stop communications.
Opt-out cost: make refusal free of charge apart from ordinary transmission costs and easy enough for the recipient to use without account login friction.
Per-message check: include the opt-out opportunity on each message when the customer has not already refused.
Suppression action: move opt-outs, withdrawals, bounces that indicate stop requests, and manual complaints into the suppression process before the next send.

Sources for this answer

Directive 2002/58/EC Article 13 - opt-out and sender identity

Article 13(2) supports the free and easy objection check; Article 13(4) supports the identity and valid-address checks.

Directive 2009/136/EC amendments to Article 13

The amendment text adds the prohibition on messages that encourage visits to websites contravening the referenced e-commerce information rule.

EDPB Guidelines 05/2020 on consent

This source helps test whether withdrawal from consent-based marketing is available and operational.

Section 4

4. Keep proof, suppression, and national-law notes

Close the checklist only when the campaign record proves the selected route for each recipient segment. The record should let a reviewer see why a send happened, why a recipient was suppressed, and which jurisdiction-specific caveat still needs local validation.

The ePrivacy Directive particularises and complements the GDPR, and Member States implement and enforce national ePrivacy rules through national law. Avoid adding country-specific rules, penalties, authority names, or limitation periods unless those facts are separately supported by an official source for the country.

Consent proof fields: consent statement, purpose, channel, sender, capture method, timestamp, source URL or form, locale, policy version, and withdrawal path shown.
Soft opt-in proof fields: sale-context record, collecting and sending natural or legal person, collection notice, initial refusal option, product-similarity rationale, and per-message objection mechanism.
Suppression fields: recipient identifier, reason, date received, source system, campaign affected, operator if manual, and downstream systems updated.
Review triggers: new sender entity, new product category, new country, new channel, new tracking technology, changed unsubscribe flow, list import, or acquisition of another customer base.
Blocked facts: leave penalties and country-by-country marketing rules out unless supported by jurisdiction-specific source material.

Sources for this answer

Directive 2002/58/EC Article 13 - national-law caveat

Article 13(3) leaves the consent-or-opt-out choice for other direct-marketing cases to national legislation.

EDPB Guidelines 05/2020 on consent

EDPB consent guidance supports keeping records that demonstrate valid consent and operational withdrawal.

European Commission ePrivacy framework overview

Commission material supports treating ePrivacy as the EU privacy framework for electronic communications alongside GDPR modernization work.

Recommended next step

Review this EU ePrivacy checklist before marketing sends

Sorena can help convert campaign facts into a cited Article 13 send record, consent-proof gap list, opt-out control check, and country-law validation queue.

Research workflow

Open Research Copilot for EU ePrivacy

Ask questions tied to cited sources about direct-marketing consent, Article 13 scope, soft opt-in facts, and evidence records using the cited sources on this page.

Explore next step

Talk to Sorena

Review an EU direct-marketing campaign

Check sender identity, consent proof, suppression handling, and national-law caveats before a marketing send.

Explore next step

Primary sources

References and citations

Directive 2002/58/EC Article 13 - national-law caveat

eur-lex.europa.eu

Referenced sections

Article 13(3) leaves the consent-or-opt-out choice for other direct-marketing cases to national legislation.

"determined by national legislation"

Directive 2002/58/EC Article 13 - opt-out and sender identity

eur-lex.europa.eu

Referenced sections

Article 13(2) supports the free and easy objection check; Article 13(4) supports the identity and valid-address checks.

"disguising or concealing the identity"

Directive 2002/58/EC Article 13 - prior consent and soft opt-in

eur-lex.europa.eu

Referenced sections

Article 13(1) sets the prior-consent rule; Article 13(2) supports the existing-customer electronic-mail exception for own similar products or services.

"own similar products or services"

Directive 2002/58/EC Article 13 - unsolicited communications

eur-lex.europa.eu

Referenced sections

Articles 2(h) and 13 supply the definition of electronic mail and the channel-specific direct-marketing rule, including prior consent for automated calling systems, fax, and electronic mail.

"for the purposes of direct marketing"

Directive 2009/136/EC amendments to Article 13

eur-lex.europa.eu

Referenced sections

The amendment text adds the prohibition on messages that encourage visits to websites contravening the referenced e-commerce information rule.

"valid address"

EDPB Guidelines 05/2020 on consent

edpb.europa.eu

Referenced sections

EDPB consent guidance supports keeping records that demonstrate valid consent and operational withdrawal.

"demonstrate that consent was obtained"

EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive

edpb.europa.eu

Referenced sections

This source supports review when the marketing message or landing page includes pixels, cookies, local storage, SDKs, or other terminal-equipment access.