Newsletter consent: GDPR, PECR, soft opt-in and double opt-in explained

Newsletter consent under the GDPR comes down to two questions: did this person agree to receive your newsletter, and can you prove it? For individuals in the EU and the UK, both answers must be yes before the first issue, with two exceptions: existing customers under the soft opt-in and, in some countries, business addresses.

One objection I hear from clients about cold emailing is that it is illegal. In B2B it usually is not, and the same rules decide who may receive your newsletter. This guide is part of my guide to funnels and newsletters.

It is general information, not legal advice: the last section says when a lawyer is worth calling.

Two layers of law: the email rule, then the GDPR

The email marketing rule decides whether you may send at all. In the EU, it is Article 13 of the ePrivacy Directive: marketing emails to individuals need their prior consent unless the soft opt-in applies. Each country writes it into its own law; in France, that is article L34-5 of the Code des postes et des communications électroniques (CPCE). In the UK, it is regulation 22 of PECR, the Privacy and Electronic Communications Regulations, amended by the Data (Use and Access) Act 2025 (here is what that Act changed).

The GDPR decides what valid consent is. The ePrivacy Directive points to its definition, and the UK GDPR plays the same role for PECR.

These rules follow your readers, not your company. A Swiss consultancy, a Canadian software firm or a Moroccan agency whose newsletter offers its services to readers in France or Belgium comes under the GDPR through Article 3(2), and the safest course is to follow the email rules of the country where each reader lives. My GDPR guide covers the rest of the regulation.

Newsletter consent under the GDPR: what makes it valid

Consent must be “freely given, specific, informed and unambiguous”, shown by a statement or “a clear affirmative action” (GDPR Article 4(11)). On a sign-up form, that means six things.

1. The person acts. Recital 32 rules out silence, pre-ticked boxes and inactivity, and the EU Court of Justice confirmed in Planet49 (case C-673/17, 1 October 2019), a ruling on cookie consent, that a pre-ticked box is not valid consent. On a form whose only purpose is the newsletter, typing an address and pressing Subscribe is a clear action. On a checkout, a contact form or a quote request, the newsletter needs its own unticked box.
2. It stands apart from your terms. A consent request inside a document about other matters must be clearly distinguishable (Article 7(2)), and the ICO is explicit that accepting a privacy policy is not consent to marketing.
3. It is specific. Consent to your newsletter covers your newsletter, not partners’ offers or text messages.
4. It is informed. Say who you are, what you will send and how often, and link to your privacy policy.
5. It is free. Under Article 7(4) and Recital 43, consent is presumed not to be free when a service depends on it without needing it. A free guide sent only to people who join your list comes close to that line: the safe course is to send the guide to everyone who asks and offer the newsletter as a separate box.
6. It is as easy to withdraw as to give (Article 7(3)): one click in every issue, not an email to your support address.

A sign-up line that meets all six can be this plain:

[ ] Send me the [Your business] newsletter: one email a month with new guides and offers.
    Unsubscribe in one click from any issue. How we use your data: [privacy policy]

The soft opt-in: emailing your customers without a tick box

The soft opt-in is the exception for your own customers, in Article 13(2) of the ePrivacy Directive, PECR regulation 22(3) and article L34-5 in France. You can email someone without a consent box when all three conditions are met:

1. You collected the address from that person, during a sale. In the UK, “negotiations for the sale” are enough: someone who asked for a quote or started a free trial counts, someone who only browsed your site does not.
2. You write about your own similar products or services, never a partner’s offer.
3. They could refuse, simply and free of charge, when you collected the address, and every email lets them opt out.

A UK bike shop can email past buyers about servicing and accessories, but needs consent for people who never bought anything or asked for a quote. The refusal at collection is usually a clearly worded box at checkout: customers who were never offered that choice are not covered.

B2B newsletters: business addresses follow other rules

UK. PECR’s consent rule covers individuals, sole traders and partnerships outside Scotland. Limited companies, LLPs, Scottish partnerships and public bodies can be emailed without consent, but every message must name the sender and give a valid address to opt out (regulation 23). An address that names a person, such as jane.smith@example.co.uk, is still personal data under the UK GDPR. An address alone does not show whether it belongs to a company or a sole trader: when in doubt, the ICO’s business-to-business guidance says to treat it as an individual’s.

France. The CNIL allows marketing emails to professionals without prior consent when the message relates to their job (its example: software offered to an IT director), provided they were told their address would be used and can object simply and free of charge. Generic addresses such as contact@ count as the company’s details and fall outside these rules.

Elsewhere in the EU. Article 13(5) of the ePrivacy Directive leaves the protection of companies to national law, and Germany, for one, requires prior consent for marketing emails to businesses too.

Even where the law allows it, adding business contacts who never asked is a poor trade: people who did not expect your newsletter report it as spam more readily, and Gmail and Yahoo count those complaints against you (my guide to newsletter deliverability gives the thresholds). My cold email GDPR checklist covers the B2B rules line by line.

Double opt-in: not required, but the best proof

Double opt-in means the person signs up, receives an email with a confirmation link and joins your list only after clicking it. Neither the GDPR nor PECR requires it. The GDPR does require proof: you must “be able to demonstrate” consent (Article 7(1)). A form submission shows that someone typed an address; the click shows that the owner of the inbox agreed.

In Germany, the Federal Court of Justice accepted in a judgment of 10 February 2011 (I ZR 164/09) that a sign-up confirmed by email can be assumed to come from the owner of the address, and double opt-in is the prevailing practice there.

It also keeps the list clean: no typos, no colleague or rival signed up as a joke, fewer bots and spam traps. The cost is that some people never click, so your thank-you page should tell them to check their inbox.

Newsletter tools do most of the work:

• MailerLite switches double opt-in on by default for new forms; editing the confirmation email needs a paid plan, and sign-ups that arrive through the API or integrations have a separate switch under Account settings > Subscribe settings.
• Brevo offers a double confirmation email at the form’s settings step, and its logs keep the sign-up, the confirmation email and the time of the click.

My newsletter tools comparison covers the rest.

What to record for every subscriber

If a reader complains, the burden of proof is yours. For each subscriber, keep:

Your newsletter tool logs most of this. The wording is the part people lose: when you change a form, save the old text with the dates it was live, and when you change tools, export the consent fields, not only the addresses.

Every issue: sender, unsubscribe link, suppression list

• Say who you are. Hiding the sender is banned in the EU (ePrivacy Article 13(4)), the UK (PECR regulation 23) and France (article L34-5), and each email needs a valid address for opting out.
• Put an unsubscribe link in every email. An objection to direct marketing has no exceptions (GDPR Article 21(3)), so stop at once.
• Add one-click unsubscribe if you are a bulk sender. From about 5,000 messages a day to personal Gmail accounts, Google requires one-click unsubscribe headers and a visible link in the body, with unsubscribes processed within two days; Yahoo asks for the same.
• Keep a suppression list. Unsubscribed and complaining addresses go on a do-not-email list, so a later import never brings them back. The CNIL recommends keeping what you need to honour an objection for at least three years.

Importing an old list: ask again, the right way

Phone contacts, business cards, LinkedIn connections, old enquiries, a list bought from a broker: none of these people agreed to your newsletter. Before importing, sort them: customers offered a way to refuse may fall under the soft opt-in, business addresses follow the B2B rules above, and everyone else needs consent, which you cannot ask for by email.

Invite those contacts through channels you already use: the sign-up link on your website, your printed invoices and receipts, your email signature, your social profiles, a QR code on the counter. My guide to your first 100 subscribers covers these channels, without buying a list.

For contacts in France, mind the clock too: under the CNIL’s reference framework for customer and prospect management, a prospect’s data is kept three years at most from collection or from the last contact that came from them, such as a click or a request (opening an email does not count). When that time is up, you may ask once whether they still want to hear from you, if you could lawfully email them; without a clear yes, delete their details.

Newsletter consent checklist, and when to get help

1. Sign-up form: a dedicated newsletter form, or an unticked box on any other form, with plain wording and a privacy link.
2. Double opt-in on, including for sign-ups that arrive through integrations.
3. Checkout: a clear way to refuse marketing, if you rely on the soft opt-in.
4. Records: date, source, wording version and confirmation for every subscriber.
5. Every issue: your name, a contact address, an unsubscribe link and, for bulk senders, one-click headers.
6. A suppression list, checked before every import.
7. Old contacts imported only with consent, the soft opt-in or a B2B rule that covers them.

A lawyer or a data protection officer is worth the fee when your list spans many countries, when the newsletter touches health or other sensitive data, when your readers may be children, or when a complaint or a regulator’s letter arrives. Sign-up forms, consent boxes and privacy pages are part of the websites I build.