The rule.
Article 7 sets the conditions for consent. The companion Article 4(11) defines what consent actually is.
“‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”
“If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters …
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.”
The ePrivacy Directive layers on top: for email marketing specifically, prior consent is required (with a narrow soft-opt-in exemption for existing customers receiving similar product communications).
What it requires.
Five operational obligations.
Freely given. Consent has to be a real choice. If the consumer cannot complete signup without consenting to marketing, consent is not freely given.
Specific. Separate consents for separate purposes. One checkbox cannot cover “marketing emails, product analytics, third-party sharing, and SMS” all at once.
Informed. The consumer has to be told what they’re consenting to. Frequency of emails, types of content, identity of the controller, withdrawal mechanism.
Unambiguous. Active opt-in. Pre-ticked boxes fail. Inferring consent from inaction fails. Browser settings do not constitute consent.
Withdrawable as easily as given. Unsubscribe must be one click, no login required. The withdrawal mechanism has to be at least as easy as the consent mechanism.
Common violations.
Signup form: “[Checkbox] I agree to the Terms of Service, Privacy Policy, and to receive marketing emails about products and offers.”
One box covers Terms, Privacy, and marketing. Fails specificity. The marketing consent has to be separable.
Signup form: marketing-consent checkbox is pre-checked by default.
Fails unambiguity. The Planet49 case (CJEU C-673/17) is the definitive authority: a pre-ticked box is not consent.
“To use [exchange], you must agree to receive marketing communications.”
Service performance conditional on marketing consent. Article 7(4) specifically prohibits this when the marketing consent is not necessary for the service.
Unsubscribe link: “Sign in to manage your preferences.”
Withdrawal harder than giving. Fails Article 7(3) “as easy to withdraw as to give.” The fix: one-click unsubscribe with token-authenticated URL.
How to comply.
One checkbox for terms acceptance, a separate, unchecked checkbox for marketing consent. If you have multiple marketing channels (email, SMS, push), separate them or consolidate them under a single “product and offers email” checkbox.
Default state of every marketing-consent checkbox: unchecked. The consumer has to actively tick to consent. This is non-negotiable since Planet49.
Replace “agree to receive communications” with “Send me product updates and offers by email. About 2–4 emails per month. You can unsubscribe with one click.” Informed consent requires specifics.
Every marketing email contains a List-Unsubscribe header (RFC 8058) and a footer unsubscribe link that works in one click, no login, no captcha, no preference centre.
For every consent, record: timestamp, source form/URL, IP, version of the consent text. If the regulator asks, you can produce the evidentiary record. Most ESPs (Customer.io, Iterable, Klaviyo) support this natively.
Related rules.
-
Consent for marketing is upstream of automated decision-making for the same data subject.
-
The content of the marketing email is also governed by MiCA Article 88 when the firm is a CASP.