Is a company GDPR compliant if user A is able to subscribe for advertisments using an email of user B, if the company does not verify the ownership of the email and still send advertisments?


The GDPR regulations do not really care about the exact technical means. To use personally identifiable information (such as an email address) of person B, you need consent from person B (as no other ground would allow this). You don't have consent, so you're not compliant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.