Decide when customer email marketing can rely on the Article 13 soft opt-in exception instead of fresh prior consent.
This checklist helps test the existing customer relationship, similar-product limit, opt-out mechanics, sender identity, suppression evidence, GDPR overlap, and Member State implementation caveats.
Structured answer sets in this page tree.
Cited legal and guidance references.
is the (2) exception that permits the same natural or legal person that obtained a customer's electronic contact details in the context of a sale to use those details for marketing of its own similar products or services. Use it only when every condition is met. The customer must receive a clear, distinct, free, and easy opportunity to object when the details are collected and in every message, unless the customer refused initially. Purchased, scraped, partner, affiliate, group-company, prospect, and non-sale lists do not enter this exception merely because the recipient knows the brand. Otherwise, prior consent is the EU baseline for electronic mail direct marketing, subject to the applicable national law. The Commission withdrew its proposed replacement ePrivacy Regulation on 6 October 2025, so this checklist applies Directive 2002/58/EC as amended and the relevant national implementing law. Reassess after a sender, product scope, recipient country, channel, CRM source, or opt-out mechanism changes.
Approve a campaign only when every condition is true. Treat one failed condition as a move back to the (1) prior-consent rule or to the applicable national rule for that channel.
The exception is tied to electronic contact details obtained from customers in the context of a sale. Purchased lists, scraped contacts, prospect leads with no qualifying sale context, partner lists, and contacts collected by a different legal person do not satisfy that condition. Do not treat an abandoned checkout, account registration, free download, inquiry, or event signup as a qualifying sale without a national-law source supporting that conclusion.
is not a one-time list label. It is a continuing control: the collection notice, CRM consent or preference state, email template, unsubscribe endpoint, suppression process, and campaign selection rules must all match the conditions.
The objection path should be visible in the collection journey and in each email. Do not require login, payment, a sales call, or a complex preference flow before stopping the marketing use covered by the objection.
Keep campaign evidence at the audience-rule level. A compliant template alone does not prove that each recipient met the customer-sale and similar-product conditions.
Suppression records should prove who was removed because they objected, unsubscribed, or were excluded by a country-specific rule. A delivery bounce is an operational suppression event, not an objection, so keep bounce status distinct from the recipient's marketing preference.
under ePrivacy does not answer every GDPR question. The ePrivacy Directive particularises and complements GDPR for electronic communications, and EDPB guidance recognises that some processing can fall within both instruments. Teams still need a GDPR lawful basis, transparency, data minimisation, retention, and rights handling for the personal-data processing around the campaign.
leaves several points to Member State implementation, including the approach for direct-marketing cases outside Article 13(1) and 13(2). It requires Member States to protect the legitimate interests of subscribers other than natural persons, but does not create one EU-wide B2B rule. Record the country rule check instead of assuming that one playbook covers every recipient or channel.
Review this final check before enabling an audience, lifecycle automation, newsletter segment, win-back campaign, or sales-assisted email sequence that relies on .
If the answer is uncertain, pause the send for the affected segment rather than diluting the rule across the full list.
Not from (2) alone. The exception is tied to customer electronic contact details obtained in the context of the sale of a product or service, so prospect lead capture needs another cited route before marketing email is sent.
Every message must give the customer a clear, distinct, free, and easy opportunity to object if the customer has not already refused the use. A working unsubscribe link is the usual way to evidence that requirement for email.
Do not assume so. (2) refers to the same natural or legal person using the contact details it obtained, so group-company, reseller, affiliate, and partner campaigns need separate legal review and should not be marked by default.
Sorena can help convert the Article 13 conditions on this page into audience rules, collection notices, unsubscribe tests, suppression evidence, and country-check records for EU campaigns.
Ask questions tied to cited sources about Article 13, soft opt-in eligibility, opt-outs, sender identity, and evidence records using the cited sources on this page.
Review your customer email marketing workflow, suppression records, source gaps, and national-law caveats with Sorena.
"when they are collected"
"own similar products or services"
"the same natural or legal person"
"free of charge and in an easy manner"
"choice between these options"
"subscribers or users"
"demonstrate that valid consent was obtained"
"particularise and complement"
"existing customer relationship"