I originally posted this on another Stack Exchange website but was advised this might be a better place for it. Original is here: https://security.stackexchange.com/questions/215300/is-it-ok-to-assume-a-user-has-opted-in-to-receive-emails-in-an-application-where/

I'm working on a web application where the main purpose/functionality is notifying users when there have been changes to regulations in a particular industry. The content of the email is always related to specific legal changes that have occurred. The users are not being "sold" anything from the content of the email, it contains factual information only.

The application is subscription based, i.e. you have to pay for an account and using it is a choice. Any email addresses for accounts we hold are active users and we do not harvest this data from anywhere. So all email addresses we have are for real users who actively use the software.

We are designing a setup wizard which allows users to set preferences on what information they receive.

One of the settings is yes or no as to whether the application should send notifications via email. This raised debate as to what the default setting should be.

The argument for "no" was that users should explicitly give their permission to receive automated emails and therefore this was the correct default.

The argument for "yes" was that the users have implied consent because they are using an application whose sole purpose is to inform them about changes, and email delivery is the primary way of doing this.

The application is still usable if the user doesn't receive emails because the data which is present in the emails is visible inside a web-based interface. The disadvantage of using the application in this way is that - unless the user logs in - they will not necessarily be aware of any updates. Therefore defaulting email opt-in is preferable.

The pre-sale marketing material for the application makes it clear that email delivery is the main delivery method for the information and getting it directly to your inbox is an advantage of using the system.

The application allows the user to change their settings at any time. So if they opt-in to receive emails today, they can opt-out tomorrow, and vice versa. They can change their preferences at any time.

What are people's thoughts on this? We are based in the UK but deal with customers worldwide. Is this covered or referred to by GDPR?

  • Would it be feasible to force the user to decide yes or no at the first login? Aug 14, 2019 at 13:14
  • @cbeleites that is the intention of the setup wizard. The users are reviewing what information they want to receive and choosing whether or not to receive it via email. The question is what the default setting for emails should be: either they're on or off by default.
    – user27122
    Aug 14, 2019 at 13:19
  • I was thinking of e.g. radio buttons "( ) no email ( ) email" with both options initially un-selected or a drop list with default "please choose whether you'd like to receive emails" as default which requires another selection for submission rather than a toggle switch. Aug 14, 2019 at 13:28
  • If you're asking what the default should be when you are setting up their account, then "Yes" is a perfectly reasonable answer. However, if your asking what the default should be if they don't finish the wizard, then that is when I think the answer needs to be "No".
    – conman
    Aug 14, 2019 at 14:10

1 Answer 1


GDPR does not require consent. It requires a legal basis. Consent is only one legal basis among many. Some other legal bases are:

  • legitimate interest (implying an opt out solution)
  • necessity for performance of a contract

If your customers pay you to deliver email updates, that contract is the legal basis for sending email updates. The only wrinkle is that as you describe your service, the emails aren't an essential part of the service.

Alternatively, you might assert that there's a legitimate interest to deliver updates via email so that updates aren't missed. In that case you must allow the users to object, e.g. via ab unsubscribe link in the email and via their account settings. Because a prior business relationship exists, there's a strong case for legitimate interest – even if this were marketing emails (!). Legitimate interest requires you to balance the legitimate interest with the data subject's rights and freedoms though.

Your updates are most likely not marketing, so any advice you might read relating to marketing emailings is irrelevant.

GDPR applies because you are established in the EU. The regulation applies in relation to all your users, not just EU users. If and when Brexit happens you will still be covered by the Data Protection Act, which transcribes the GDPR's requirements into UK law. However, processing data from EU users will then count as an international transfer which requires extra compliance work, at least until the EU issues an adequacy decision for the UK.

  • This is the correct analysis, and I don't see the wrinkle. If the customer enters into a contract for email delivery, sending the email is a necessity. If the customer enters into a contract for web access only, there is no issue at all.
    – MSalters
    Aug 15, 2019 at 9:59

You must log in to answer this question.