I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service.
The UK ICO documentation on GDPR definition of legitimate interest says that emails/text messages to individuals – obtained using ‘soft opt-in’ are allowed.
From their direct marketing guidance:
The term ‘soft opt-in’ is sometimes used to describe the rule about existing customers. The idea is that if an individual bought something from you recently, gave you their details, and did not opt out of marketing messages, they are probably happy to receive marketing from you about similar products or services even if they haven’t specifically consented. However, you must have given them a clear chance to opt out – both when you first collected their details, and in every message you send.
(They go on to say that soft opt-in doesn't necessarily require a sale, merely e.g. a request for a quote, and that this only applies to commercial organizations, not charities).
This would appear to allow emailing existing customers, but then that is possibly contradicted by the following (from direct marketing guidance linked above)
The ICO recommends that organisations do not make consent to marketing a condition of subscribing to a service unless they can clearly demonstrate how consent to marketing is necessary for the service and why consent cannot be sought separately. It is also relevant to consider whether there is a choice of other services and how fair it is to couple consent to marketing with subscribing to the service.
Possibly when the service is free then it might be argued that it is necessary and fair to couple consent to marketing with subscription to the service. (Though remember I am aiming to define this activity as legitimate interest rather than consent if possible - so am confused as to why consent now applies). However they also say this
It is not enough to argue that processing is necessary because you have chosen to operate your business in a particular way.
Unfortunately this would appear to scupper the "free service in exchange for marketing" business model.
If the user is allowed to withdraw consent on signup (or afterwards) then they can obtain the free service without marketing - even though this may cost the company money which they could only justify spending if it generates a marketing lead
Requiring consent on signup also, obviously, might affect signups pre GDPR implementation
So the question - how can free-service-in-exchange-for-marketing be justified under GDPR (1) for commercial organizations? and (2) for nonprofits?