Marketing consent: email, WhatsApp, retargeting — what are you still allowed to do?

Your newsletter, promotional emails, retargeting pixels — they all need a valid consent basis. Here are the concrete rules per channel.

Marketing and GDPR intersect on three points: how you make contact, on what basis, and how someone can opt out.

Email

\n
• Opt-in required for non-existing customers. A pre-checked box does not count.
\n
• Existing customers ("soft opt-in"): permitted for similar products. 12 months after the last purchase is the cut-off.
\n
• Unsubscribe link in every email. One-click must work.
\n
• Consent log: when, on which URL, and with what wording.
\n

WhatsApp / SMS

\n
• Explicit opt-in required — no assumptions.
\n
• Channel-specific consent — a WhatsApp opt-in does not equal an email opt-in.
\n
• Opting out must be straightforward.
\n

Phone / cold calling B2C

Checking the Do Not Call registry is mandatory. Penalty for non-compliance: €10,000+.

Phone / cold calling B2B

Permitted to a limited extent. After an opt-out: record it and do not call again.

Retargeting / cookies

See cookie consent. No pixels before consent.

Social media targeting

Custom audiences from an email list: only permitted with consent for that specific processing purpose. Lookalike audiences are a different matter (aggregated data).

What doesn't work

\n
• Buying a list and emailing it.
\n
• "You can unsubscribe" without an opt-in.
\n
• Cold-emailing B2B contacts using "legitimate interest" without proper grounds.
\n

See also: GDPR overview.