In short. Article 13(2) permits email marketing of a seller’s own similar products or services to customers whose details it collects during a sale, subject to clear, free and easy opt-outs at collection and in each message.
Definition: Article 13(2) of the ePrivacy Directive permits a seller to use customers' email contact details collected in the context of a sale to market its own similar products or services. Customers must receive a clear, free and easy opportunity to object when their details are collected and in each message, and any initial refusal must be respected.
Key facts
- The ePrivacy Directive, Article 13(2), limits the exception to the same person or company that collects the details and its own similar products or services.
- In its guidance dated 10 June 2026, France's data protection authority, CNIL, says that an online account without a sale or service does not qualify for the customer exception.
- The General Data Protection Regulation (GDPR), Article 21(3), requires processing for direct marketing to stop when the individual objects.
Which customer relationship qualifies?
EUR-Lex's consolidated ePrivacy Directive dated 19 December 2009 sets prior consent as the rule for marketing email in Article 13(1). Article 13(2) supplies an exception where the seller obtains the customer's electronic contact details in the context of selling a product or service. The same seller may use them for direct marketing of its own similar products or services.
Recital 41 explains that this permission concerns an existing customer relationship and use by the same company that obtains the details. Marketing another company's products falls outside the exception's requirement for the seller's own products or services.
Article 17 requires Member States to implement the Directive through national provisions. In France, CNIL's email marketing guidance gives an online shopping account as an example: account creation alone is insufficient when no sale or service takes place.
When must the shop offer an opt-out?
An opt-out is an opportunity to refuse the marketing use of an email address. Under Article 13(2), this opportunity must be clear and distinct, easy to exercise and free of charge. It must be available when the contact details are collected, then on each message if the customer has not initially refused that use.
An unsubscribe option added only to later emails leaves the collection-stage condition unmet. Recital 41 also requires clear information about the intended further use for direct marketing when the details are obtained.
Article 13(4) additionally prohibits marketing email that conceals the sender's identity or lacks a valid address for requesting that the communications cease.
What happens after an objection?
Under the GDPR, Article 21(2), an individual may object at any time to processing personal data for direct marketing, including related profiling. Article 21(3) requires that processing for those purposes cease following an objection.
Article 21(4) requires the right to object to be brought explicitly to the individual's attention, clearly and separately from other information, by the first communication at the latest.
Related terms
- When does the ePrivacy Directive require consent for marketing email?
- GDPR right to object
- GDPR lawful basis for web data
FAQ
Can I rely on this exception for a partner's offers?
Article 13(2) of the ePrivacy Directive restricts the exception to your own similar products or services. Partner offers fall outside that condition.
Does an unsubscribe option in every email cover collection too?
Article 13(2) requires an opportunity to object both at collection and in each subsequent message. The message-stage option fulfils only the latter requirement.
Must I stop if an existing customer objects?
Yes. Under GDPR Article 21(3), you must stop processing that person's data for direct marketing purposes following their objection.
Sources
- EUR-Lex, "Directive 2002/58/EC on privacy and electronic communications", consolidated text dated 19 December 2009
- CNIL, "La prospection commerciale par courrier électronique, SMS-MMS et automate d’appel", 10 June 2026
- EUR-Lex, "General Data Protection Regulation", 27 April 2016
Check how a page reads to answer engines. Open the GEO score analyzer