The rule.
“At the latest at the time of the first communication with the data subject”
Verbatim extract, read on 4 November 2026 from the source below. Everything else on this page is NorthPoint’s plain-English reading.
What it requires.
- The right to object is explicitly brought to the person's attention, at the latest at the time of the first communication.
- It is presented clearly and separately from any other information.
Who it applies to.
Controllers whose processing is subject to the right to object — including all direct marketing.
Common violations in marketing copy.
Right to object mentioned on page 9 of the privacy policy
Not brought to attention, and not separate from other information.
Tiny unsubscribe text merged into the legal footer
Not presented clearly and separately.
Non-compliant vs compliant.
“Welcome aboard! (no mention of the right to object or how to stop)”
“Welcome aboard. You can object to our marketing at any time — one click here stops it: [link].”
Related rules.
-
GDPR Article 21(2)–(3) · European Union
-
GDPR Article 13(1)–(2) · European Union
-
ePrivacy Directive Article 13(1) · European Union
-
GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive 2002/58/EC.
Source.
| Instrument | Regulation (EU) 2016/679 (General Data Protection Regulation) |
|---|---|
| Provision | GDPR Article 21(4) |
| Primary source | https://www.legislation.gov.uk/eur/2016/679/article/21/adopted |
| Official text | https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng |
| Read from | legislation.gov.uk's as-adopted copy of the Official Journal text (/eur/2016/679/article/N/adopted) |
| Checked |
This page is general, sourced information for marketing teams, not legal advice. The examples are written by NorthPoint to illustrate the rule; for a binding view on your own promotion, retain qualified counsel in the jurisdiction concerned.