In short. The ePrivacy Directive requires prior consent for marketing email to individual subscribers, subject to its customer exception and national implementation.
Definition: The ePrivacy Directive sets prior consent as the rule for direct marketing email to subscribers who are natural persons, meaning individuals. Article 13(2) provides a conditional exception for existing customers, while national legislation implements the Directive and determines protection for corporate subscribers.
Key facts
- The ePrivacy Directive, Article 13(1), requires consent before electronic mail is used for direct marketing.
- Under Article 288 of the Treaty on the Functioning of the European Union, directives bind Member States as to their result and leave national authorities the choice of form and methods.
- The General Data Protection Regulation (GDPR), recital 32, excludes silence, inactivity and pre-ticked boxes as consent.
- In its June 2026 email marketing guidance, France's data protection authority, CNIL, distinguishes marketing to individuals from marketing addressed to professionals in connection with their work.
What is the EU rule and its customer exception?
Article 13(1) of the ePrivacy Directive covers electronic mail used for direct marketing, alongside automated calling systems and fax. Article 13(5) applies the prior-consent provision to subscribers who are natural persons. It requires Member States to protect the legitimate interests of other subscribers through applicable national legislation.
Article 13(2) permits the same seller to use customer email details obtained in the context of a sale for marketing its own similar products or services. Customers must receive an easy, free opportunity to object when the details are collected and in every message, unless they have already refused the use.
In its guidance, CNIL specifies that creating an online account alone, without a sale or service, is insufficient for this customer exception.
Why must a sender check national implementation?
Article 288 of the Treaty on the Functioning of the European Union explains the legislative structure: Member States implement a directive through national measures. A newsletter assessment therefore involves the applicable national implementation of the EU requirements.
For example, CNIL's French guidance says marketing to professionals may rely on the sender's legitimate interest when the message concerns the recipient's profession. It requires information about the marketing use and a simple, free way to object. CNIL gives the example of software promoted to a company's IT director.
The Directive's Article 13(3) separately allows national legislation to choose between consent and an objection regime for unsolicited marketing communications outside paragraphs 1 and 2. That choice concerns the other communications covered by paragraph 3.
What counts as valid newsletter consent?
The ePrivacy Directive, Article 2(f), refers to the consent definition in the former Data Protection Directive. The GDPR, Article 94(2), directs that references to that repealed directive be read as references to the GDPR.
GDPR Article 4(11) defines consent as freely given, specific, informed and unambiguous, expressed through a statement or clear affirmative action. Article 7(1) requires the organisation responsible for processing to demonstrate consent. Under Article 7(2), a written consent request covering other matters must remain clearly distinguishable, accessible and intelligible.
Article 7(3) allows withdrawal at any time and requires withdrawal to be as easy as giving consent. Recital 32 expressly excludes pre-ticked boxes and inactivity.
Related terms
- When can a shop email existing customers under the ePrivacy Directive?
- GDPR lawful basis for web data
- GDPR right to object
FAQ
Can accepting website terms count as newsletter consent?
CNIL's guidance says acceptance of general terms of use is insufficient. It describes a dedicated checkbox that is unticked by default as an example of the positive, specific action required.
Does a previous purchase always permit marketing email?
The Directive's Article 13(2) limits the exception to the same seller's own similar products or services and requires opportunities to object at collection and with each message.
Can someone withdraw newsletter consent later?
Yes. GDPR Article 7(3) gives the person a right to withdraw at any time; withdrawal must be as easy as giving consent.
Sources
- EUR-Lex, "Directive 2002/58/EC", consolidated text dated 19 December 2009
- EUR-Lex, "Treaty on the Functioning of the European Union, Article 288", 7 June 2016
- EUR-Lex, "Regulation (EU) 2016/679 (General Data Protection Regulation)", 27 April 2016
- CNIL, "La prospection commerciale par courrier électronique, SMS-MMS et automate d’appel", 10 June 2026
Check how a page reads to answer engines. Open the GEO score analyzer