GDPR Newsletter Consent: Requirements, Double Opt-In and Examples

When consent is needed

The ePrivacy Directive (2002/58/EC, Article 13) requires prior consent for direct marketing email to individuals. It allows one exception, often called the soft opt-in: a business that obtained a customer's email address in the context of a sale may email that customer about its own similar products, as long as an easy opt-out is offered at collection and in every message. Member states implement these rules in national law, so details differ by country.

For a newsletter sign-up form, consent is the lawful basis under GDPR Article 6(1)(a).

What valid consent looks like

Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes, by a statement or a clear affirmative action. In practice:

• An unticked checkbox or a clearly labeled subscribe button. Recital 32 says silence, pre-ticked boxes or inactivity do not constitute consent.
• Plain wording that says what they will receive and who sends it, for example: "Yes, send me the monthly newsletter from Example Ltd. I can unsubscribe at any time."
• Newsletter consent kept separate from accepting terms of service or completing a purchase.
• A link to your privacy notice at the point of sign-up.

Proving consent and double opt-in

Article 7(1) says the controller shall be able to demonstrate that the data subject has consented. That means keeping a record of when and how each person subscribed and what wording they agreed to.

Double opt-in, where the subscriber confirms through a link sent to the address, is not written into the GDPR itself. It is the most common way to show that the owner of the address really asked to subscribe, and in Germany it is widely treated as the expected standard.

Withdrawal and erasure

Under Article 7(3), it shall be as easy to withdraw as to give consent, so every issue needs a working unsubscribe link. When consent is withdrawn and there is no other legal ground, the person can ask for their data to be erased (Article 17(1)(b)).

Fines

Infringements of the basic principles and conditions for consent (Articles 5, 6, 7 and 9) can lead to fines of up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (Article 83(5)). The United Kingdom applies very similar rules through the UK GDPR and PECR.