In forceLegalIn force 31 Oct 2003Verified 1 Aug 2026

EU marketing email needs prior consent, with one narrow customer exception

Q: Do I need opt-in consent to send marketing emails in the EU?

Article 13 of the ePrivacy Directive requires prior consent for marketing email. The one exception, usually called soft opt-in, lets you email existing customers about your own similar products, but only if you obtained the address in the context of a sale and you offer an opt-out both at collection and in every message.

Q: In plain English?

EU ePrivacy rules mean commercial email needs consent first. Soft opt-in is the narrow exception: your own customers, similar products or services, address collected during a sale, and an easy opt-out offered then and later. Bought lists and “legit interest for everyone” are not the same thing.

Q: Who does this apply to?

Anyone sending marketing email into the EU. Because ePrivacy is a Directive rather than a Regulation, the detail lives in national law and genuinely differs between member states.

Q: What happens if you do not?

Actively enforced, and usually about consent quality rather than the absence of consent. Recent examples include a 400,000 euro Garante fine in November 2025 for continuing to message people who had objected and for bundling marketing consent into quote requests, and a 1.8 million euro Norwegian fine in June 2026 over invalid customer-club consent.

Do I need opt-in consent to send marketing emails in the EU?

European Union

How email works

In one sentence

In the EU, marketing email needs a yes — is only for your own similar products after a sale, with at capture.

Emailrules interpretation

EU rules mean commercial email needs first. is the narrow exception: your own customers, similar products or services, address collected during a sale, and an easy offered then and later. Bought lists and “legit interest for everyone” are not the same thing.

Why it matters. US-style “mail until ” on EU contacts is how teams get complaints, fines risk, and blocked campaigns.

Dotted words open definitions. See how email actually works.

What to do

Your move — not a lecture

Part platform, part you

The platform covers the mechanical bit. The judgement is still yours.

Your records when and where each address was collected and honours unsubscribes. That is the mechanical half, and it is genuinely done.

Your part: Whether the was ever valid. No platform checks whether your signup form bundled marketing consent into a quote request, and bundling is precisely what regulators fine people for.

What to do first

Open your highest-volume signup form and check that marketing is its own unticked box, not folded into accepting terms.

You can skip this if: You only email outside the EU.

Who this applies to

Anyone sending marketing email into the EU. Because is a Directive rather than a Regulation, the detail lives in national law and genuinely differs between member states.

Checklist

01Record where and when each address was collected, and whether a purchase actually happened.
02Keep to your own similar products. A different brand in the same group does not qualify.
03Put an in every single message, not just the first.
04For B2B in France, note that legitimate interest can cover profession-related contact, and generic addresses such as info@ fall outside because they identify a legal entity.

That’s enough to act. The exact wording, the enforcement record and every primary source sit under Proof & sources, for counsel, bosses, or AI tools that need a citation. Not legal advice.

Proof

Exact position, enforcement, sources

For records and people who will check you. Skip if Monday’s move is already clear.

Source fact

Article 13 of the Directive requires prior for marketing email. The one exception, usually called , lets you email existing customers about your own similar products, but only if you obtained the address in the context of a sale and you offer an both at collection and in every message.

What happens if you do not

Actively enforced, and usually about quality rather than the absence of consent. Recent examples include a 400,000 euro Garante fine in November 2025 for continuing to message people who had objected and for bundling marketing consent into quote requests, and a 1.8 million euro Norwegian fine in June 2026 over invalid customer-club consent.

Sources

Directive 2002/58/EC (ePrivacy), Article 13, consolidated text
Published 19 Dec 2009Read primary source
CNIL, La prospection commerciale par courrier électronique
Published 10 Jun 2026Read primary source

History of this page

12 Jun 2026Added CNIL's B2B and generic-address guidance.
2 May 2026Added.

In France, tracking email opens needs its own consentIn force

Take this with you

GET https://emailrules.today/rules/eprivacy-email-consent-soft-optin?format=json

Same URL, same answer, every field including the ones behind the Proof tab. An Accept: application/json header on the plain URL does the same thing. All the endpoints.