15 GDPR and ePrivacy provisions behind email marketing, sign-up forms and cookies — consent, objection, soft opt-in — each with its source and the fix.
Each record is one provision of the GDPR or the ePrivacy Directive that a marketing team meets in a sign-up form, an email or a cookie banner.
15 records · European Union · regulator: EDPB and national data protection authorities · last reviewed 4 November 2026.
GDPR Article 4(11) defines consent: freely given, specific, informed and unambiguous, by a statement or clear affirmative action. What fails in signup forms.
GDPR Article 6(1)(a): processing is lawful when the person consented for one or more specific purposes. When marketing needs it and how to evidence it.
GDPR Article 6(1)(f): legitimate interests as a basis for marketing — the balancing test, the child-data warning, and why it does not replace ePrivacy consent.
GDPR Article 7(1): a controller relying on consent must be able to demonstrate the person consented. The record a marketing team needs per subscriber.
GDPR Article 7(2): a consent request in a written declaration must be clearly distinguishable, intelligible, easily accessible and in plain language.
GDPR Article 7(3): people can withdraw consent at any time, must be told so up front, and withdrawing must be as easy as giving consent.
GDPR Article 7(4): consent is not freely given when the service is made conditional on consent to processing the service does not need. The gated-download test.
GDPR Article 8(1): for online services offered directly to a child, consent is valid from 16 — Member States may set 13 to 15. Under that, a parent consents.
GDPR Article 13(1)-(2): what a sign-up form must tell people when it collects their data — identity, purposes, legal basis, recipients, retention and rights.
GDPR Article 21(2)-(3): people can object at any time to direct marketing, including related profiling — and the data is then no longer processed for it.
GDPR Article 21(4): the right to object must be explicitly brought to the person's attention by the first communication, clearly and separately.
ePrivacy Directive Article 13(1): direct marketing by email, fax or automated calls needs the recipient's prior consent. How it applies through national law.
ePrivacy Directive Article 13(2): when you may email existing customers without consent — own similar products, details from a sale, opt-out at collection and every email.
ePrivacy Directive Article 13(4): marketing email may not disguise the sender, must give a valid address to opt out, and must respect e-Commerce Article 6.
ePrivacy Directive Article 5(3): storing or reading information on a device needs consent after clear information — except strictly necessary storage.
EU ePrivacy Article 13 and UK PECR regulations 22–23 side by side: prior consent, the soft opt-in, sender identity and opt-out — plus the GDPR consent tests.
Long-form guides and trackers: the GDPR library.
General, sourced information for marketing teams — not legal advice. Each record names its primary source and the date it was read.
Paste a URL or your copy — the full verdict lands in seconds. Free, no signup.