GDPR: Receiving marketing as precondition for receiving a free service, legitimate interest?

Question

I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service.

The UK ICO documentation on GDPR definition of legitimate interest says that emails/text messages to individuals – obtained using ‘soft opt-in’ are allowed.

From their direct marketing guidance:

The term ‘soft opt-in’ is sometimes used to describe the rule about existing customers. The idea is that if an individual bought something from you recently, gave you their details, and did not opt out of marketing messages, they are probably happy to receive marketing from you about similar products or services even if they haven’t specifically consented. However, you must have given them a clear chance to opt out – both when you first collected their details, and in every message you send.

(They go on to say that soft opt-in doesn't necessarily require a sale, merely e.g. a request for a quote, and that this only applies to commercial organizations, not charities).

This would appear to allow emailing existing customers, but then that is possibly contradicted by the following (from direct marketing guidance linked above)

The ICO recommends that organisations do not make consent to marketing a condition of subscribing to a service unless they can clearly demonstrate how consent to marketing is necessary for the service and why consent cannot be sought separately. It is also relevant to consider whether there is a choice of other services and how fair it is to couple consent to marketing with subscribing to the service.

Possibly when the service is free then it might be argued that it is necessary and fair to couple consent to marketing with subscription to the service. (Though remember I am aiming to define this activity as legitimate interest rather than consent if possible - so am confused as to why consent now applies). However they also say this

It is not enough to argue that processing is necessary because you have chosen to operate your business in a particular way.

Unfortunately this would appear to scupper the "free service in exchange for marketing" business model.

1. If the user is allowed to withdraw consent on signup (or afterwards) then they can obtain the free service without marketing - even though this may cost the company money which they could only justify spending if it generates a marketing lead

2. Requiring consent on signup also, obviously, might affect signups pre GDPR implementation

So the question - how can free-service-in-exchange-for-marketing be justified under GDPR (1) for commercial organizations? and (2) for nonprofits?

Answer 1

You have to distinguish two related matters here:

1. Permission
2. Obtaining permission

The "opt-in" versus "opt-out" discussion is about the process by which you may gain permission for marketing. But either way, you may end up with customers that refuse to receive marketing.

Now there are cases in which it doesn't really make sense to talk about the distinction between marketing and the service itself. For instance, a cinema may have a newsletter announcing which movies will run on which date, with short descriptions of them. It's just not reasonable to expect that they put out a "marketing-free" newsletter stating the dates on which the cinema is open, omitting the actual movies! That's just silly. Permission for the newsletter includes permission for the embedded marketing of the movies. Still, that newsletter is independent from the actual cinema service itself.

In your case, it appears that there is no relation between the marketing and the actual service. That is to be expected. As such, the GDPR is aimed straight at you. And you guessed that from the last "how you've chosen to operate your business" quote. Non-profits fall under the GDPR as well.

PS. you mentioned the "legitimate interest". That's not at all relevant. A rental company has a legitimate interest in keeping track of their customers and sending them emails when the rentals are overdue, for instance. The legitimate interest in this case is the care for their property.