The UK ICO documentation on GDPR definition of legitimate interest says that emails/text messages to existing customers – obtained using ‘soft opt-in’ are allowed.
From ICO Direct Marketing Guidance:
The term ‘soft opt-in’ is sometimes used to describe the rule about existing customers. The idea is that if an individual bought something from you recently, gave you their details, and did not opt out of marketing messages, they are probably happy to receive marketing from you about similar products or services even if they haven’t specifically consented. However, you must have given them a clear chance to opt out – both when you first collected their details, and in every message you send.
For 'hard opt-in' GPDR specifies strict requirements for opt-in, e.g. no pre-ticked checkboxes.
For soft opt-in on the other hand, the requirements seem looser and I cannot find any exact specification for what is needed. "Did not opt out" (and indeed the very concept of soft opt-in) implies that an explicit opt-in was not needed. In the case of my own customers each email sent contains an unsubscribe link, and while the original signup did not contain an opt out it clearly stated that opting out was possible by clicking unsubscribe on any email sent.
Rather than sending an email at the present time (pre GDPR start date) that requires explicit opt-in, is it acceptable instead to send an email reiterating that opt-out is possible at this stage?
