WorkflowEU

EU ePrivacy Directive soft opt-in marketing review workflow

Use this workflow before sending electronic-mail direct marketing without fresh consent under the Article 13 soft opt-in.

The review focuses on proof of an existing customer relationship, own similar products or services, collection-time and message-level opt-out, sender identity, suppression records, approval gates, and national transposition caveats.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

Article 13 of the ePrivacy Directive starts from prior consent for electronic-mail direct marketing, then allows a narrow existing-customer exception for a sender's own similar products or services when the customer received a clear, free, easy opportunity to object at collection and with each later message. This workflow turns that exception into an approval record for marketing, product, privacy, CRM, and regional operations teams.

Section 1

Gate 1: confirm the customer relationship and collection context

Start with the contact-detail event, not the campaign brief. The soft opt-in is tied to electronic contact details obtained from customers in the context of a product or service sale, with the later 2009 amendment text referring to the same customer relationship logic for Article 13.

Approve this gate only when the CRM record can show what was sold or negotiated, when the address was collected, which legal entity collected it, the privacy notice or checkout screen shown at collection, and whether the person objected at that moment.

Evidence to collect: order, subscription, trial, renewal, quote, or negotiation record; contact-detail source; collection timestamp; country or regional store; collecting legal entity; and screenshot or versioned copy of the opt-out language shown at collection.
Reject or escalate: purchased lists, scraped addresses, event badge scans without a sale or negotiation record, contacts imported from another group company, or addresses collected by a partner that is not the sending entity.
Approval gate: CRM owner certifies the source record, privacy/legal confirms the Article 13 basis is available for the contact source, and marketing operations locks the approved segment before creative review.
Record format: one campaign-level decision plus a sampled contact-evidence pack, with a link to the suppression query used to exclude objectors.

Sources for this answer

Directive 2002/58/EC, Article 13

Supports the baseline Article 13 rule that prior consent is required for electronic-mail direct marketing, with a limited customer-relationship exception.

Directive 2009/136/EC amendments to Directive 2002/58/EC

Shows the amended Article 13 wording used to review the soft opt-in conditions after the 2009 changes.

EDPB Guidelines 05/2020 on consent under GDPR

Used for the fallback path where the Article 13 soft opt-in is unavailable and the sender must rely on valid consent instead.

Section 2

Gate 2: test own similar products or services

The campaign must market the same sender's own similar products or services. Treat this as a product-scope review, not a copywriting preference: the product owner must explain why the offer is adjacent to what the customer bought or negotiated for, and why the sending entity is the same natural or legal person that obtained the address.

Use a short similarity matrix before audience upload. Compare the original purchase category, intended customer use, pricing model, delivery channel, brand or legal entity, and whether a reasonable customer would recognize the new message as related to the earlier relationship.

Approve: replenishment, renewal, compatible add-ons, upgrades, service extensions, or closely related replacements from the same sender when the relationship evidence and opt-out gates also pass.
Escalate: unrelated product lines, third-party offers, affiliate campaigns, cross-sell by a different legal entity, or campaigns where similarity depends only on broad customer-interest profiling.
Document: product owner rationale, legal/entity check, campaign objective, audience source, creative summary, and the reason each borderline product category is included or excluded.
Control: block campaign cloning into new countries, brands, or entities until the similarity and national-law checks are repeated.

Sources for this answer

Directive 2002/58/EC, Article 13

Provides the Article 13 condition that the contact details may be used only for direct marketing of the sender's own similar products or services.

Commission ePrivacy future-proof framework overview

Commission material frames ePrivacy as the sector-specific privacy framework for electronic communications, supporting a channel-specific review rather than a generic GDPR-only check.

Section 3

Gate 3: verify opt-out, sender identity, and suppression controls

The opt-out must exist twice: at collection and on each marketing message if the customer did not initially refuse. The send must also avoid disguised or concealed sender identity and provide a valid address or mechanism for requests to stop further communications.

Marketing operations should test the unsubscribe path before approval, then prove suppression after the test. The record should show that an objection entered through the campaign link, reply route, preference center, or support channel reaches the same suppression store used by the sending platform.

Collection-time check: clear and distinct objection wording, no charge for refusal, easy action, and stored evidence of whether the customer refused.
Message-level check: visible marketing identity, sender identity on whose behalf the message is sent, valid stop-contact address or link, and no creative or routing pattern that hides the sender.
Suppression check: global and campaign-level suppression lists applied before send, unsubscribe test completed, bounced or manual opt-out channels mapped, and objectors excluded from retargeting uploads based on the same campaign.
Closeout check: export campaign audience count, suppression count, test unsubscribe evidence, final creative, approval log, and the query or segment version used for the live send.

Sources for this answer

Directive 2002/58/EC, Article 13

Supports the collection-time and each-message opportunity to object, plus the prohibition on concealed sender identity or missing stop-contact address.

Directive 2009/136/EC amendments to Directive 2002/58/EC

Confirms the post-amendment Article 13 wording for clear, free, easy objection and sender-identity controls.

EDPB Guidelines 05/2020 on consent under GDPR

Used for the consent fallback: if soft opt-in fails and consent is used instead, the consent mechanism must be free, specific, informed, unambiguous, and withdrawable.

Section 4

Gate 4: national-law caveat and final approval

Do not convert this EU-level workflow into a country-rule database. Article 13 is implemented through national provisions, and the ePrivacy/GDPR relationship can affect enforcement and documentation. Before launch, the regional owner should confirm whether the target country implementation changes the practical result for the channel, audience type, timing, or objection mechanism.

If a national-law answer is missing, record the issue as blocked for that country instead of guessing. The campaign can proceed only for countries whose legal, product-similarity, opt-out, sender-identity, and suppression gates are approved.

Country caveat checklist: target country or countries, B2C or legal-person audience classification if relevant to the local implementation, channel type, opt-out wording language, timing since sale if the local review requires it, and whether a local reviewer approved or blocked the send.
Approval order: CRM source owner, product owner, privacy/legal owner, marketing operations owner, regional owner, then final campaign approver.
Reopen triggers: new product category, new sending entity, imported audience, changed unsubscribe flow, preference-center migration, expansion to another country, complaint spike, or a material change to national transposition guidance.
Blocked outcome: use fresh consent or suppress the audience until the missing customer-relationship, similarity, opt-out, sender-identity, suppression, or national-law evidence is complete.

Sources for this answer

Commission ePrivacy future-proof framework overview

Supports treating ePrivacy as a continuing EU privacy framework for electronic communications rather than a one-time marketing-policy note.

Directive 2002/58/EC, Article 15a

Supports the national-law caveat because Member States lay down rules and penalties for national provisions adopted under the Directive.

Recommended next step

Review the send before the audience leaves CRM

Sorena can help convert the Article 13 checks on this page into campaign approval gates, segment evidence, suppression tests, and reusable regional review records.

Research workflow

Open Research Copilot for EU ePrivacy

Ask cited questions about customer relationship evidence, similar products, opt-out controls, sender identity, and soft opt-in campaign approval.

Explore next step

Talk to Sorena

Talk through implementation

Review a proposed electronic-mail marketing send, source gaps, and national-law caveats before launch.

Explore next step

Primary sources

References and citations

Commission ePrivacy future-proof framework overview

digital-strategy.ec.europa.eu

Referenced sections

Supports treating ePrivacy as a continuing EU privacy framework for electronic communications rather than a one-time marketing-policy note.

"online privacy"

Directive 2002/58/EC, Article 13

eur-lex.europa.eu

Referenced sections

Supports the collection-time and each-message opportunity to object, plus the prohibition on concealed sender identity or missing stop-contact address.

"on the occasion of each message"

Directive 2002/58/EC, Article 15a

eur-lex.europa.eu

Referenced sections

Supports the national-law caveat because Member States lay down rules and penalties for national provisions adopted under the Directive.

"Member States shall lay down the rules on penalties"

Directive 2009/136/EC amendments to Directive 2002/58/EC

eur-lex.europa.eu

Referenced sections

Confirms the post-amendment Article 13 wording for clear, free, easy objection and sender-identity controls.

"valid address to which the recipient may send a request"

EDPB Guidelines 05/2020 on consent under GDPR

edpb.europa.eu

Referenced sections

Used for the consent fallback: if soft opt-in fails and consent is used instead, the consent mechanism must be free, specific, informed, unambiguous, and withdrawable.