EU ePrivacy Directive direct-marketing consent checklist

Start by deciding whether the campaign uses automated calling systems without human intervention, fax, electronic mail, or another unsolicited direct-marketing channel. The Directive defines electronic mail broadly enough to cover text, voice, sound, or image messages sent over a public communications network and stored until collection.

Record the product, service, audience, country coverage, sender entity, sending platform, and whether the journey also stores or accesses information on the recipient's device, such as tracking pixels, link identifiers, cookies, or app identifiers.

For automated calling systems without human intervention, fax, and electronic mail used for direct marketing, the default Article 13 route is prior consent. Do not treat a generic privacy-policy acknowledgement, passive account creation, or pre-ticked preference as enough consent evidence.

For electronic mail sent to existing customers, Article 13(2) supports a narrower route when the same sender collected the contact details in the context of a sale, markets its own similar products or services, and gave a clear, distinct, free, easy chance to object both when details were collected and in each later message.

Every electronic-mail marketing message relying on the existing-customer route needs a free and easy objection path in the message. The same opt-out control should also be checked for consent-based campaigns because withdrawal must be easy and the sender needs reliable suppression evidence.

Article 13 separately prohibits direct-marketing electronic mail that disguises or conceals the sender identity, lacks a valid address for stop requests, or sends recipients to websites that contravene the e-commerce information rule referenced in the Directive.

Close the checklist only when the campaign record proves the selected route for each recipient segment. The record should let a reviewer see why a send happened, why a recipient was suppressed, and which jurisdiction-specific caveat still needs local validation.

The ePrivacy Directive particularises and complements the GDPR, and Member States implement and enforce national ePrivacy rules through national law. Avoid adding country-specific rules, penalties, authority names, or limitation periods unless those facts are separately supported by an official source for the country.