I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service.

The UK ICO documentation on GDPR definition of legitimate interest says that emails/text messages to individuals – obtained using ‘soft opt-in’ are allowed.

From their direct marketing guidance:

The term ‘soft opt-in’ is sometimes used to describe the rule about existing customers. The idea is that if an individual bought something from you recently, gave you their details, and did not opt out of marketing messages, they are probably happy to receive marketing from you about similar products or services even if they haven’t specifically consented. However, you must have given them a clear chance to opt out – both when you first collected their details, and in every message you send.

(They go on to say that soft opt-in doesn't necessarily require a sale, merely e.g. a request for a quote, and that this only applies to commercial organizations, not charities).

This would appear to allow emailing existing customers, but then that is possibly contradicted by the following (from direct marketing guidance linked above)

The ICO recommends that organisations do not make consent to marketing a condition of subscribing to a service unless they can clearly demonstrate how consent to marketing is necessary for the service and why consent cannot be sought separately. It is also relevant to consider whether there is a choice of other services and how fair it is to couple consent to marketing with subscribing to the service.

Possibly when the service is free then it might be argued that it is necessary and fair to couple consent to marketing with subscription to the service. (Though remember I am aiming to define this activity as legitimate interest rather than consent if possible - so am confused as to why consent now applies). However they also say this

It is not enough to argue that processing is necessary because you have chosen to operate your business in a particular way.

Unfortunately this would appear to scupper the "free service in exchange for marketing" business model.

  1. If the user is allowed to withdraw consent on signup (or afterwards) then they can obtain the free service without marketing - even though this may cost the company money which they could only justify spending if it generates a marketing lead

  2. Requiring consent on signup also, obviously, might affect signups pre GDPR implementation

So the question - how can free-service-in-exchange-for-marketing be justified under GDPR (1) for commercial organizations? and (2) for nonprofits?

1 Answer 1


You have to distinguish two related matters here:

  1. Permission
  2. Obtaining permission

The "opt-in" versus "opt-out" discussion is about the process by which you may gain permission for marketing. But either way, you may end up with customers that refuse to receive marketing.

Now there are cases in which it doesn't really make sense to talk about the distinction between marketing and the service itself. For instance, a cinema may have a newsletter announcing which movies will run on which date, with short descriptions of them. It's just not reasonable to expect that they put out a "marketing-free" newsletter stating the dates on which the cinema is open, omitting the actual movies! That's just silly. Permission for the newsletter includes permission for the embedded marketing of the movies. Still, that newsletter is independent from the actual cinema service itself.

In your case, it appears that there is no relation between the marketing and the actual service. That is to be expected. As such, the GDPR is aimed straight at you. And you guessed that from the last "how you've chosen to operate your business" quote. Non-profits fall under the GDPR as well.

PS. you mentioned the "legitimate interest". That's not at all relevant. A rental company has a legitimate interest in keeping track of their customers and sending them emails when the rentals are overdue, for instance. The legitimate interest in this case is the care for their property.

  • So your answer is that it's impossible to provide a free service in exchange for a marketing lead under GDPR? Commented May 22, 2018 at 9:23
  • @SideshowBob: To natural persons. B2B is another matter.
    – MSalters
    Commented May 22, 2018 at 9:27
  • 2
    @SideshowBob: Actually, it was an explicit goal of the GDPR to forbid such "service for data" deals. The Guidelines on consent under Regulation 2016/679 make this clear: "[...] there is a strong presumption that consent to the processing of personal data that is unnecessary, cannot be seen as a mandatory consideration in exchange for the performance of a contract or the provision of a service." (page 8).
    – sleske
    Commented May 25, 2018 at 20:46
  • What if you offered the same service for a fee, without the processing of data? So users have a genuine choice between paid-without-marketing or free-with-marketing? Would that make the latter legal? Commented May 29, 2018 at 16:07
  • @SiasdeshowBob: Get a lawyer for that - as you phrase it, it's illegal, but I think you can achieve the same by making the service paid (unconditionally) and offer a "separate" option to receive marketing in exchange for cash. That this cash just cancels out the fee for your service is a lucky coincidence.
    – MSalters
    Commented May 30, 2018 at 8:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .