The customer exception, all four conditions.

The rule.

Verbatim extract, read on 4 November 2026 from the source below. Everything else on this page is NorthPoint’s plain-English reading.

What it requires.

• The contact details were obtained from the customer in the context of the sale of a product or service, and are used by the same business for its own similar products or services.
• The customer is given a clear and distinct, free and easy opportunity to object when the details are collected — and in every message after that, if they did not object at first.

Who it applies to.

A business that obtained a customer's email in the context of the sale of a product or service. Applies through each Member State's national law.

Common violations in marketing copy.

Non-compliant vs compliant.

The United Kingdom counterpart.

PECR reg. 22(3): the UK soft opt-in, three conditions →

Side by side: Email marketing consent: EU ePrivacy vs UK PECR

Related rules.

• ePrivacy Art. 13(1): prior consent for marketing email →

  ePrivacy Directive Article 13(1) · European Union

• ePrivacy Art. 13(4): sender identity and a working opt-out →

  ePrivacy Directive Article 13(4) · European Union

• PECR reg. 22(3): the UK soft opt-in, three conditions →

  PECR regulation 22(3) · United Kingdom

• GDPR Art. 7(3): unsubscribing as easy as subscribing →

  GDPR Article 7(3) · European Union

• GDPR Art. 21(2)-(3): the absolute right to stop marketing →

  GDPR Article 21(2)–(3) · European Union

• Every GDPR rule record →

  GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive 2002/58/EC.

Source.

This page is general, sourced information for marketing teams, not legal advice. The examples are written by NorthPoint to illustrate the rule; for a binding view on your own promotion, retain qualified counsel in the jurisdiction concerned.