EU ePrivacy Directive soft opt-in marketing review workflow

Trace the contact detail to its collection event before reviewing the campaign. The soft opt-in is tied to electronic contact details obtained lawfully from customers in the context of a product or service sale. For this workflow, electronic mail is broader than email: the Directive's definition covers stored text, voice, sound, or image messages sent over a public communications network, which includes SMS. Confirm the national rule for the channel being used.

Approve this gate only when the CRM record can show the product or service sale in whose context the address was collected, which legal entity collected it, the privacy notice or checkout screen shown at collection, and whether the customer objected at that moment. A quote, negotiation, trial, or abandoned transaction is not enough under the Directive's EU baseline unless the applicable national implementation supplies a separately sourced route.

The campaign must market the same sender's own similar products or services. The same brand, corporate group, shared CRM, or common marketing team does not by itself make two companies the same natural or legal person. Record the entity that obtained the contact detail and the entity on whose behalf the message will be sent.

The Directive does not define a universal similarity test. Use a short matrix before audience upload, then apply the relevant national law and regulator guidance. Compare the original purchase category and use with the advertised offer, its function, likely customer expectation, and whether it is supplied by the same legal person. Price, delivery channel, or shared branding may inform the review but cannot replace the own-similar-products condition.

The opt-out must exist twice: at collection and on each marketing message if the customer did not initially refuse. The send must also avoid disguised or concealed sender identity and provide a valid address to which the recipient may send a request to stop further communications.

Marketing operations should test the unsubscribe path before approval, then prove suppression after the test. The record should show that an objection entered through the campaign link, valid stop-contact address, preference center, or supported manual channel reaches the suppression store used by every platform sending marketing on behalf of that legal person. Keep service messages outside the marketing suppression rule only where their non-marketing purpose is documented.

Do not convert this EU-level workflow into a country-rule database. Article 13 is implemented through national provisions, and the ePrivacy/GDPR relationship can affect enforcement and documentation. Before launch, the regional owner should confirm whether the target country implementation changes the practical result for the channel, audience type, timing, or objection mechanism.

Passing Article 13 addresses the electronic-mail channel rule; it does not supply or replace the GDPR basis, transparency information, data minimisation, retention, or rights analysis for personal data used to select and contact the audience. In particular, Article 21 GDPR gives a person the right to object at any time to processing for direct marketing, after which the personal data may no longer be processed for that purpose.

If a national-law answer is missing, record the issue as blocked for that country instead of guessing. The campaign can proceed only for countries whose legal, product-similarity, opt-out, sender-identity, suppression, and GDPR gates are approved.