When do you need customer consent for marketing and when can you do without it?

To understand whether a message may be sent, one thing has to be clarified first. Is the message a commercial communication or not?

If it is, the customer’s consent is required. If the message is not a commercial communication, there is no need to ask for consent.

There is, however, one exception, which is described below.

What is a commercial communication and what is not?

The definition is set out in the Law on Information Society Services. In everyday language, a commercial communication is also called a marketing message. It is a message that:

• directly or indirectly advertises a product or service,

• advertises the company itself or its image,

• encourages a person to buy something.

Such messages include discount offers, promotion announcements and newsletters.

Messages about a transaction that has already been concluded do not count as commercial communications:

• order confirmations,

• delivery notifications,

• appointment reminders,

• notices of changes to an existing service,

• invoices and payment confirmations.

Such notifications do not require separate consent.

The line is drawn where an offer is added to the message. If a delivery notification ends with a discount code for the next purchase, the message becomes a commercial communication.

When is consent not required for email messages?

The law provides for one exception that applies only to email addresses. To use it, all four conditions must be met at the same time:

• the address was obtained during a purchase,

• the offer concerns a similar product or service from the same company,

• the customer did not initially object to further use of their email address,

• every email includes an option to opt out.

If even one condition is not met, GDPR consent is required. This is the customer’s freely given and clearly expressed permission to receive specific messages through a specific channel.

The address must be obtained at the time of purchase. A business card received at a conference or a purchased customer database does not count.

A similar product means one from the same category. A customer who bought tires may be offered rims but not insurance.

The condition that the customer has not objected is the one most often misunderstood. Two opposite mechanisms are at work here that look almost identical on screen.

In the case of consent, the text “I want to receive news” appears next to the checkbox. The customer checks it and only then is sending allowed. If it is left unchecked, sending is not allowed.

In the case of the exception, opposite text such as “I do not want to receive offers” appears next to the checkbox. The customer checks it if they want the messages to stop. If it is left unchecked, the customer has not objected and sending is allowed.

In both cases, the checkbox is empty at the start. The only difference is the text next to it, which determines what the empty box means.

Why are the rules different for SMS marketing?

There is no such exception for phone numbers. The Data State Inspectorate has pointed out that the exception applies only to email addresses, while SMS messages always require consent.

After one purchase, the same customer may therefore receive an email offer but not an SMS with the same offer.

Marketing consent is separate for each channel. Consent to receive SMS messages does not cover emails, so a form needs a separate checkbox for each channel. These checkboxes must also not be combined with acceptance of the terms of use.

What must every commercial communication include?

Regardless of the channel, every commercial communication must include three things:

• a clearly recognizable indication that it is a commercial communication,

• clear identification of the company sending the message,

• an option to unsubscribe from further communications.

When a person opts out, it must take effect immediately, so unsubscribing from news must not be harder than signing up.

What if the recipient is a legal entity?

Everything above applies to messages addressed to a private individual. The law refers to such an individual as a natural person.

A commercial communication may be sent without prior consent to a legal entity’s email address, such as info@ or office@. The Data State Inspectorate has confirmed this.

However, two requirements still apply. The sender must use a valid address to which the recipient can send an opt-out request and that request must be honored. The requirements for what every commercial communication must include also remain in force.

If you are writing to a specific employee, the content of the offer is decisive. A fleet manager may be offered leasing for company cars because it relates to their job. Offering insurance for their personal car without consent is not allowed.

How can you prove that consent was given?

A company must be able to prove that the customer gave consent. If this cannot be proven, the consent is not considered to have been given.

That is why four things must be stored with each contact:

• the date and time consent was given,

• the channel it was given for,

• the text that was visible to the person at the time,

• the place where it was given, for example a website form or a pop-up window.

Without such a record, the lawfulness of processing personal data cannot be demonstrated. A privacy policy on the website is mandatory. It must state the purpose of processing and the data retention period.

What happens if there is no consent?

A message covered by neither the customer’s consent nor the email exception is spam.

Every such message sent is a separate breach.

Two authorities examine breaches:

• The Data State Inspectorate examines personal data protection breaches, both on its own initiative and on the basis of complaints.

• The Consumer Rights Protection Centre supervises commercial communication requirements and first explains them to the company instead of fining it immediately.

A fine is only part of the consequences. A complaint can trigger an inspection in which the company must prove the basis on which each contact entered its database.

Frequently asked questions

Is consent obtained before the GDPR still valid?

Yes, if it already met the requirements of the regulation at that time. Older consents rarely meet them because it was not recorded when and for what purpose they were given. If this cannot be proven, the contact may be used only if the conditions of the email exception are met.

Can you send offers to a purchased contact database?

Consent is given to a specific company, so it cannot be passed on. A purchased database means there is no consent for marketing messages, so commercial communications must not be sent to it.

Can you send offers to addresses collected through a contest?

Only if the person specifically agreed to this when signing up. Taking part in a contest is not in itself consent to marketing. If consent is collected together with the contest rules in a single checkbox, it is not valid.

 

This article is based on the Law on Information Society Services and the General Data Protection Regulation. It is a general explanation rather than a legal opinion on a specific situation.