Article 13 of the ePrivacy Directive sets the EU baseline for electronic mail direct marketing: prior consent is the default, with a narrow existing-customer exception for a seller's own similar products or services.
This page helps separate consent-based campaigns from soft opt-in campaigns, preserve opt-out evidence, prevent disguised sender practices, and flag points that still depend on Member State law.
Structured answer sets in this page tree.
Cited legal and guidance references.
Article 13 makes prior consent the EU baseline for direct marketing by automated calling systems without human intervention, fax, and . Electronic mail includes text, voice, sound, or image messages sent over a public communications network and stored in the network or recipient's terminal equipment until collection. A narrow existing-customer exception can cover electronic mail for the same sender's own similar products or services. Other channels, corporate subscribers, penalties, and enforcement routes require the applicable Member State law.
Treat direct marketing as opt-in by default. Article 13 allows automated calling systems, fax, or electronic mail for direct marketing only for subscribers or users who have given prior consent, unless the existing-customer exception in Article 13(2) applies.
Because GDPR Article 94 treats references to the repealed Data Protection Directive as references to GDPR, the GDPR consent standard now supplies the consent conditions used by ePrivacy. Records should show a freely given, specific, informed, and unambiguous choice, the information presented at the time, and a withdrawal route as easy as the consent route.
Article 13(2) creates a narrow exception for electronic contact details collected from customers in the context of selling a product or service. The same natural or legal person may use those details for direct marketing of its own similar products or services only if the customer had a clear, distinct, free, and easy opportunity to object when the details were collected and in every later message.
Do not expand this exception to purchased lists, third-party promotions, unrelated product lines, or contacts collected outside a sale unless national implementation and a fresh cited-source review support that route. The artifact should state why the product or service is similar and why the sender is the same person or entity that collected the details.
Soft opt-in campaigns require an opportunity to object at two points: when the electronic contact details are collected and on the occasion of each message. Consent-based campaigns also need an easy withdrawal route under GDPR consent standards. In both cases, the marketing system needs a suppression control that prevents future sends after an objection or withdrawal.
A suppression list should be limited to what is needed to honor the cease request, but it must be operationally effective. Keep enough information to match future campaign audiences against opted-out recipients, including the channel, brand or sender scope, date, source of opt-out, and any country or entity scope applied under national implementation.
Article 13 separately prohibits direct-marketing that disguises or conceals the sender identity or lacks a valid address for cease requests. This is not optional formatting; it is a pre-send compliance gate.
Run this check on the campaign brief and the final rendered message. The sender name, reply handling, unsubscribe address, landing-page URL, and on-page commercial information should all align with the entity on whose behalf the communication is made.
The ePrivacy Directive particularises and complements GDPR. Where Article 13 sets a special rule for sending unsolicited communications, do not skip that rule because personal-data processing also has a GDPR lawful-basis analysis. GDPR still matters for consent quality, transparency, records, downstream processing, rights handling, and data minimisation around contact data and suppression lists.
Article 13 also leaves implementation choices to Member States for direct-marketing cases outside the prior-consent and customer-soft-opt-in provisions. It requires Member States to protect the legitimate interests of subscribers other than natural persons, but it does not create one EU-wide B2B email rule. Check the national law for the recipient market before relying on a call, fax, live-call, B2B, corporate-subscriber, enforcement, or penalty conclusion.
Review this checklist before a direct-marketing email, SMS, or similar send reaches production. It is designed to catch the legal questions that Article 13 makes material, not to replace national-law review where the Directive leaves choices to Member States.
The campaign record should let a reviewer reconstruct why every recipient was eligible, how each recipient can stop future messages, and which source supported the chosen route.
Only if the Article 13(2) customer exception is satisfied: the contact detail was obtained in the context of a sale, the same sender markets its own similar products or services, and the customer had a clear, distinct, free, easy opt-out at collection and in every message.
No. Where Article 13 requires prior consent for direct marketing, a GDPR lawful-basis analysis does not remove that ePrivacy send rule. GDPR still governs consent quality, records, transparency, and later personal-data processing.
Keep the campaign route, consent or soft opt-in basis, source form, sale context if used, sender identity approval, unsubscribe test, suppression-list application, final creative, landing-page URL, target countries, and national-law caveats.
Sorena can turn the direct marketing rules on this page into cited send-permission checks, owner assignments, suppression-list tests, and reusable evidence requests for EU marketing operations.
Ask questions tied to cited sources about Article 13, soft opt-in conditions, unsubscribe evidence, and national-law caveats using the cited sources on this page.
Review your direct marketing workflow, suppression-list controls, source gaps, and next implementation steps with Sorena.
"disguise or conceal the identity of the sender"
"national legislation"
"Unsolicited communications"
"demonstrate that valid consent has been obtained"
"special rules contained in the ePrivacy Directive"
"complements General Data Protection Regulation"