GDPR Consent Rules for Email Marketing

GDPR impacts how businesses worldwide handle email marketing, especially when targeting EU residents. This regulation requires clear, informed, and voluntary consent for data collection and email communication. Non-compliance can lead to fines of up to €20 million or 4% of global revenue. Here's what you need to know:

• Consent Standards: No pre-checked boxes or bundled agreements. Consent must be explicit, with an easy withdrawal process.
• Email Types: Even corporate email addresses (e.g., john.smith@company.com) are considered personal data under GDPR.
• Legal Bases: Two key options for email marketing:
• Consent: Required for individual subscribers (e.g., sole traders).
• Legitimate Interest: Permissible for corporate subscribers but must pass a balancing test.
• Record-Keeping: Maintain detailed logs of who consented, when, and how.
• Unsubscribes: Must be simple and immediate, like a one-click link.

For compliance, design transparent signup forms, consider double opt-in for proof of consent, and use tools like Breaker for managing subscriber data. Proper adherence builds trust and improves email performance.

What are GDPR requirements for email marketing consent?

GDPR Consent Rules for Email Marketing

When it comes to GDPR, there are two types of consent to consider, and for email marketing, explicit consent is non-negotiable. This kind of consent requires a clear and deliberate action - like ticking an unchecked box on a signup form - to show agreement. On the other hand, implied consent, such as simply providing an email address during a transaction without explicitly opting in for marketing, doesn't meet GDPR standards.

The European Commission emphasizes this point:

Consent should be given by a clear affirmative act... such as by ticking a box when visiting an internet website.

Explicit vs Implied Consent

Explicit consent involves a clear, affirmative action by the subscriber, such as clicking a confirmation link, ticking an empty checkbox, or signing a form. This level of consent is critical, especially when dealing with sensitive data, and is the safest route for B2B email marketing. For example, handing over a business card or completing a form for a quote does not count as explicit consent unless the individual has clearly agreed to receive marketing communications.

This distinction is key to understanding the two main legal bases for email marketing under GDPR.

Legal Bases: Consent vs Legitimate Interest

GDPR provides specific legal bases for processing data in email marketing, with consent and legitimate interest being the two most relevant for B2B campaigns. The choice between these depends largely on the type of recipient.

Under the UK Privacy and Electronic Communications Regulations (PECR), recipients fall into two categories: corporate subscribers and individual subscribers.

• Corporate subscribers - including limited companies, LLPs, and government bodies - don’t require prior consent for marketing emails. Instead, you can rely on legitimate interest, as long as you meet a three-part test: identify your legitimate interest, prove that processing is necessary, and ensure the individual’s rights are not overridden.

The Information Commissioner’s Office explains:

The PECR rule on direct marketing by electronic mail does not apply to corporate subscribers. For example, this means you can send B2B direct marketing emails or texts to any corporate body. You do not need their consent under PECR.

• Individual subscribers, such as sole traders and certain partnerships, are treated like private consumers and generally need explicit consent. However, the soft opt-in rule allows you to market to existing customers if:
• Their details were collected during a sale or negotiation.
• The marketing is for similar products or services.
• A clear opt-out was provided at the point of data collection and in every subsequent message.

Even though PECR doesn’t require consent for corporate subscribers, GDPR still applies if the email address identifies a specific individual (e.g., john.smith@acmecorp.com). In such cases, you must have a lawful basis for processing and always include clear opt-out options in your emails.

Legal Basis

Requirement

Best For

Control

Consent

Active opt-in required

Individual subscribers and new prospects

Individuals can withdraw consent anytime

Legitimate Interest

Must pass balancing test

Corporate subscribers and existing customers

Individuals can object to processing

Before launching any B2B email campaign, carefully review your contact list to determine whether your recipients are corporate entities or sole traders. This step is crucial to selecting the appropriate legal basis and avoiding potential GDPR violations, which can lead to hefty fines.

How to Obtain GDPR-Compliant Consent

Designing GDPR-Compliant Signup Forms

Signup forms play a key role in ensuring GDPR compliance. One essential element is using an unchecked checkbox to request consent - this keeps it active, specific, and transparent. As the Information Commissioner's Office explains: "Consent requests need to be prominent, concise, easy to understand and separate from any other information such as general terms and conditions".

It's important to keep consent requests separate from your terms of service. For example, users shouldn't have to agree to receive marketing emails just to download a whitepaper or access a free resource. If you're collecting data for multiple purposes - like sending newsletters and product updates - offer separate checkboxes for each. This way, subscribers can decide exactly what they want to opt into.

Your signup form should clearly state who you are and how you plan to use the data. Avoid legal jargon - stick to plain, straightforward language. Include a brief note about the subscriber's right to withdraw consent at any time, and make your full privacy policy easy to find. A helpful tip? Add short, timely privacy reminders that pop up when someone enters their email address. This approach keeps users informed without overwhelming them.

Once your form is compliant, the next step is choosing the right opt-in method to strengthen your consent process.

Single Opt-In vs. Double Opt-In

With single opt-in, users are added to your list immediately after submitting their information. Double opt-in, on the other hand, adds an extra step - they receive a confirmation email with a link they must click to verify their subscription. While GDPR doesn't mandate double opt-in, many consider it the best practice for proving consent.

Single opt-in may lead to higher conversion rates, but double opt-in offers verified consent and often results in better engagement. Statistics show double opt-in subscribers have higher open rates (35.72% vs. 27.36%) and click rates (4.19% vs. 2.36%).

Another advantage of double opt-in is the audit trail it creates. It records the exact time, date, and IP address when someone confirms their subscription - meeting GDPR's record-keeping requirements. As Robert Brandl, founder of EmailToolTester, explains: "While double opt-in generally isn't a legal requirement, I'd still recommend using it... it is definitely considered a best practice for improving email list quality, deliverability, and clearly confirming that subscribers genuinely want to receive your emails".

If you're ready to simplify this process, platforms like Breaker can help.

Using Breaker for Subscriber Consent Management

Breaker makes managing consent easy by automating key tasks like timestamping signups, recording IP addresses, and maintaining detailed audit trails. These features align with GDPR's requirements, ensuring clear documentation and effortless withdrawal options.

The platform also focuses on high-quality leads, targeting subscribers who genuinely want your content. With Breaker, you can customize consent language, provide granular opt-in choices, and seamlessly link to your privacy policy - all directly within your signup forms. Plus, its email validation feature keeps your list clean by catching typos and invalid addresses before they affect deliverability.

For B2B marketers running multiple campaigns or managing client accounts, Breaker’s unlimited user access is a game-changer. Your entire team can easily access consent records and subscriber preferences from one centralized location. This is particularly useful during audits or when responding to data subject access requests. And with integrations for major CRMs, Breaker ensures that consent data flows smoothly into your existing workflows without creating unnecessary silos.

Managing and Documenting GDPR Consent

Consent Record-Keeping Requirements

GDPR Article 7(8) makes it clear: you need to go beyond simply keeping an email list to prove genuine consent. Detailed records are a must.

Your records should include four key elements: who gave consent (name, email, or session ID), when they gave it (a timestamp with date and time), what they were told (a copy of the signup form and the version of the privacy policy), and how they consented (e.g., by clicking a checkbox or confirming via email). It’s also crucial to document the withdrawal status - tracking if and when someone opts out.

"Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data." – Article 7(8), UK GDPR

Version control is another essential piece of the puzzle. Keep an archive of every signup form and privacy policy you’ve used, along with their effective dates, so you can confirm exactly what information was presented when someone signed up. Many email platforms simplify this by automatically recording timestamps when users click double opt-in confirmation links.

Once you’ve nailed down your consent records, the next step is making sure the withdrawal process is just as clear and efficient.

Handling Consent Withdrawal and Unsubscribes

Just like obtaining consent, withdrawing it should be simple and hassle-free. GDPR Article 7(4) emphasizes this point: if subscribing takes one click, unsubscribing should be just as easy - no logins, no lengthy forms. Including a one-click unsubscribe link in every email footer is the industry standard.

"It shall be as easy to withdraw as to give consent." – Article 7(4), UK GDPR

As soon as someone opts out, stop processing their data immediately. Automating this step can save time and ensure compliance. Importantly, you can’t shift from relying on consent to claiming a "legitimate interest" after someone unsubscribes. Doing so violates GDPR principles of fairness.

Instead of deleting unsubscribed contacts outright, move them to a suppression list (also known as a "do not contact" list). This prevents accidental re-addition through third-party sources or future campaigns. A study found that 50% of U.S. consumers have flagged emails as spam simply because they couldn’t find an easy way to opt out.

For large-scale withdrawal requests, the UK's Fundraising Preference Service (FPS) offers a helpful model. It allows individuals in England, Wales, and Northern Ireland to revoke consent for specific organizations through a single platform.

To take it a step further, consider creating a privacy dashboard where subscribers can manage their preferences at any time. And if you haven’t been in regular contact with your subscribers, the ICO advises refreshing consent every two years to ensure it stays valid.

B2B-Specific GDPR Rules and Compliance Tips

GDPR Legal Bases for B2B Email Marketing: Consent vs Legitimate Interest

Explicit Consent vs Legitimate Interest for B2B Email

When it comes to B2B email marketing under GDPR, the approach depends on the type of subscriber. The main difference lies in whether you're contacting a corporate entity (like a limited company or government body) or an individual (such as a sole trader or an unincorporated partnership). According to PECR, corporate subscribers don’t require prior consent. However, for sole traders and unincorporated partnerships, explicit consent is necessary, or the soft opt-in criteria must be met.

If you're emailing an address that identifies a specific person (e.g., john.smith@company.com), GDPR rules apply, regardless of whether the entity is a business or not. On the other hand, generic addresses like info@company.com are less likely to fall under these rules.

Feature

Explicit Consent

Legitimate Interest

Definition

Requires a clear affirmative action to receive emails

Allows marketing communications when aligned with business interests, provided they don’t override individual rights

Applicability to B2B

Needed for sole traders, unincorporated partnerships, and when required by PECR

Often used for corporate subscribers (such as companies and LLPs) or existing business relationships

Documentation Needs

Proof of opt-in consent must be securely stored

Requires a thorough Legitimate Interest Assessment (LIA) covering purpose, necessity, and a balancing test

Limitations

Pre-ticked boxes, silence, or inactivity don’t count; consent must be easy to withdraw

Recipients can object to direct marketing, and it’s unsuitable if the privacy impact is high or unexpected

"The PECR rule on direct marketing by electronic mail does not apply to corporate subscribers. For example, this means you can send B2B direct marketing emails or texts to any corporate body. You do not need their consent under PECR to send such messages." – Information Commissioner's Office (ICO)

Understanding these nuances is key to avoiding compliance missteps in B2B campaigns.

Common GDPR Violations to Avoid

Even after selecting the right legal basis, many businesses stumble over common GDPR mistakes. One frequent issue is the "public domain" fallacy - the incorrect assumption that publicly available business emails (e.g., from LinkedIn or a company website) automatically grant permission for marketing. GDPR requires a lawful basis and fairness assessment before processing such data.

Another common error is misclassifying subscribers. Treating sole proprietors and freelancers as corporate contacts has led to PECR penalties of up to £500,000 for unsolicited marketing.

Invalid consent mechanisms are also a major culprit. Using pre-ticked boxes, bundling consent with other agreements, or assuming public availability equals consent are all non-compliant practices. Similarly, relying on legitimate interest without a properly documented Legitimate Interest Assessment (LIA) can result in violations.

The soft opt-in exception is another area of confusion. This rule applies only to existing customers and must involve offers for similar products or services. It cannot be used for prospective leads, purchased email lists, or non-commercial communications. Additionally, inadequate opt-out options - like requiring users to log in to unsubscribe - are clear breaches of GDPR and PECR.

GDPR Compliance Checklist for B2B Campaigns

To ensure your B2B email campaigns comply with GDPR, use this checklist to align your legal basis - whether explicit consent or legitimate interest - with proper practices:

• Classify contacts as either corporate entities or individuals (sole traders or partnerships).
• Document your lawful basis - explicit consent or legitimate interest. If using legitimate interest, complete a three-part assessment covering purpose, necessity, and balancing individual rights.
• Verify soft opt-in eligibility for existing customers, ensuring the marketing relates to similar products or services.
• Provide clear privacy notices at the point of data collection or within one month if using third-party data.
• Include easy opt-out options in every communication, like an "unsubscribe" link or "reply STOP" instructions for texts.
• Clearly identify your business in the "From" field and email signature.
• Screen phone lists against the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS) before making B2B calls.
• Regularly audit your database to ensure only necessary personal data is retained, following data minimization principles.
• Verify purchased lists to confirm lawful data collection and proper disclosure to individuals.
• Maintain a suppression list and cross-check it before every campaign.

GDPR Consent Requirements for Purchased Email Lists

The question comes up in almost every B2B team: can we email a purchased list under GDPR? The short answer is almost never on the basis of consent, and only rarely on the basis of legitimate interest. Here is how the requirements break down.

Why consent from a purchased list rarely holds up

GDPR consent has to be freely given, specific, informed, and unambiguous, and it has to name the organisation that will do the marketing. A contact who ticked a box on a list broker's site did not consent to hearing from you specifically, so the broker's consent does not transfer. Under Article 14 you would also have to tell every contact where you obtained their data, within one month and no later than the first email. Most purchased-list campaigns fail both tests.

What you would need to prove

• Named-recipient consent: the original consent wording listed your company, or a clearly defined category you fall into, as a recipient.
• A documented audit trail: date, source, wording, and method of consent for each contact, obtained from the seller before you send.
• An Article 14 notice: a first-contact message explaining who you are, where the data came from, your lawful basis, and how to object.
• A legitimate interest assessment: if you rely on legitimate interest for corporate contacts, a written balancing test showing the recipient would reasonably expect your email and that ePrivacy rules in their country permit it.
• Suppression checks: the list screened against your unsubscribe list and any national opt-out registers before the first send.

Scenarios, from low to high risk

• Beginner: role-based corporate addresses (info@, sales@) bought for account research rather than bulk sending. Lowest risk, because they usually do not identify a person.
• Intermediate: event attendee lists shared by an organiser. Usable only if attendees were told at registration that sponsors would contact them.
• Intermediate: partner list sharing. Needs the partner's consent wording to name you as a recipient, plus a data sharing agreement.
• Advanced: enrichment of contacts you already hold. Adding job title or company data to consented contacts is generally fine; using the enrichment vendor's own contacts is not.
• Avoid: bulk B2B lists from brokers with no per-contact consent records. Regulators in the UK, France, and Italy have fined senders for exactly this.

What to do instead

Build the list yourself. Our guide to how to find business email addresses covers compliant prospecting, B2B email list building strategies covers opt-in growth, and the GDPR email list compliance checklist gives you the audit steps to run on any list before it goes near a campaign.

Conclusion

GDPR Compliance as a Growth Opportunity

GDPR compliance isn't just about avoiding penalties - it's an opportunity to strengthen your email marketing strategy. By building your email list with subscribers who have explicitly opted in, you're laying a foundation of trust that directly impacts your results. The benefits? Fewer spam complaints, lower unsubscribe rates, and a stronger sender reputation, which means your emails are more likely to land in inboxes rather than being flagged as spam.

"We believe that GDPR improves your email campaign ROI. Apart from fewer spam complaints and people unsubscribing, we believe our clients will benefit from better open rates and improved KPIs." – William Sigsworth, Head of SEO, Pipedrive

A smaller, engaged list of subscribers who genuinely want to hear from you will always outperform a massive database filled with unverified leads. When people know exactly what they’re signing up for and can easily manage their preferences, they are more likely to open your emails, click through, and take action. Transparency fosters loyalty, and loyalty drives sustainable growth.

This advantage becomes even more impactful when paired with tools designed to make compliance simpler, like Breaker.

How Breaker Supports GDPR Compliance

Breaker takes the complexity out of GDPR compliance by automating consent management and providing a complete audit trail that aligns with Article 7 requirements - no manual tracking needed. Each subscriber is backed by documented proof of their opt-in, so you're always prepared if questions arise.

With features like unlimited email validations, GDPR-compliant signup forms, and one-click unsubscribe options, Breaker ensures you meet key compliance standards without compromising data quality. Add in precise audience targeting and real-time analytics, and you’ve got a tool that turns compliance into a competitive edge, allowing you to focus on subscribers who truly value your content.

FAQs

What’s the difference between explicit and implied consent under GDPR for email marketing?

Under the GDPR, explicit consent means individuals must actively opt in - like checking a box or clicking a button - to confirm they agree to receive communications. This type of consent must be given freely, be specific to the purpose, and properly recorded to ensure compliance.

On the flip side, implied consent relies on an existing relationship or a recent interaction, such as providing an email address during a purchase. However, this falls short of GDPR requirements for email marketing. The regulation emphasizes transparency and demands clear, explicit permission from subscribers.

How does GDPR impact using legitimate interest for B2B email marketing?

Under the General Data Protection Regulation (GDPR), legitimate interest is a lawful basis for processing personal data in B2B email marketing, alongside explicit consent. To rely on legitimate interest, you need to demonstrate that your marketing is necessary, that your interests don’t outweigh the recipient’s rights, and that you’ve carried out a balancing test. Legitimate interest often applies when you're communicating with existing customers or individuals who already have a relationship with your business. However, for cold outreach to prospects with no prior interaction, explicit opt-in consent is typically required.

Even when legitimate interest is applicable, GDPR emphasizes transparency. This means informing recipients about how their data is being processed, offering a simple way to opt out, and keeping records of your balancing test. Tools like Breaker can help B2B marketers stay compliant by managing consent, tracking preferences, and ensuring email campaigns align with GDPR while also maintaining strong deliverability rates.

What are the most common GDPR mistakes businesses make in email marketing?

Many businesses stumble over similar hurdles when trying to align their email marketing practices with GDPR requirements.

One major misstep is relying on implied consent - assuming that previous interactions, like a customer making a purchase, automatically justify sending marketing emails. GDPR, however, demands explicit and unambiguous opt-in consent for such communications. Another frequent issue is mishandling how consent is collected. For instance, using pre-checked boxes or bundling consent with other agreements violates GDPR’s rules, which require consent to be clear, specific, and freely given.

Another common oversight is failing to keep verifiable records of when and how consent was obtained. Without these records, businesses may find themselves unprepared to demonstrate compliance during an audit. Additionally, some companies neglect the GDPR-mandated right to withdraw consent, or they make opting out unnecessarily difficult - both of which can lead to non-compliance.

Tools like Breaker can make navigating these challenges much easier. By providing features for managing consent, maintaining clear audit trails, and offering simple unsubscribe options, Breaker helps businesses stay compliant while running effective email campaigns.

Related Blog Posts

• Ultimate Guide to Email List Compliance Audits
• GDPR vs. CAN-SPAM: Email Compliance Rules
• Checklist for GDPR Email List Compliance
• Common CAN-SPAM Violations and How to Avoid Them