Many companies I have registered with or interacted with sign me up to their email newsletters without my providing my consent.

For example, I created an account using my email and hired a bike from a bike sharing company through their app. Now I am on their email newsletter.

Does the company have the right to send me marketing emails based on the fact that I purchased something from them even though I didn't give my explicit consent for my data to be processed in that way?

Is consent assumed for every kind of processing/communication based on one reason (a purchase or making an account)? Can I withdraw my consent for marketing specifically?

  • What country is the recipient in? Laws vary, particularly if a national law such as PECR applies, rather than the multi-national GDPR. Sep 17, 2019 at 22:18

2 Answers 2


Under the GDPR, consent is not the only legal basis that allows processing of your personal data. Other legal bases such as legitimate interest exist as well. So the question is: does the company have a legitimate interest to send you these emails?

The answer is that this case is more about direct marketing, less about personal data. The circumstances under which direct marketing emails can be sent are covered by the ePrivacy directive, which is implemented in the UK via PECR (Privacy and Electronic Communications (EC Directive) Regulations 2003).

PECR and ePrivacy introduce a concept known as soft opt-in:

where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message in case the customer has not initially refused such use.

(ePrivacy Directive, Art 13(2))

In plain language, they are allowed to send unsolicited marketing emails to existing customers, under the following restrictions:

  • this only applies to customer relationships
  • the marketing must be for similar products or services
  • you must be able to object to further messages, i.e. unsubscribe
  • upon collection of contact details you were given the opportunity to opt out
  • So PECR is the justification for legitimate interest under GDPR?
    – Tom
    Sep 17, 2019 at 14:53
  • 1
    @Tom not quite. GDPR is a very general law about personal data and allows for processing under a legitimate interest. PECR/ePrivacy are much more specific laws that discuss unsolicited marketing communications. A marketer will have to comply with both laws and in particular needs a legal basis per GDPR Art 6, but ePrivacy indicates that there's a legitimate interest in this case, and lists more detailed requirements. Since ePrivacy is older than GDPR the concepts don't fit perfectly.
    – amon
    Sep 17, 2019 at 15:09

GDPR is not the right framework anti-spam laws are

Details vary, for example, you do not need permission to send marketing emails in the US but you do in Australia and in both jurisdictions you must provide an easily accessible opt-out.

  • 2
    " a business can only contact you without permission for a legitimate reason" in what country is this terue, and under what law? it is not true in all countries. Sep 17, 2019 at 22:20
  • @DavidSiegel Australian law
    – Dale M
    Sep 18, 2019 at 3:11
  • Interesting. by "and under what law' I was asking for a citation, or at least the name of a specific law. In any case this is not the case under US law, and is not I think that broadly the case under EU law. I don't know about other places. I see that you have greatly revised the answer I was commenting on. Sep 18, 2019 at 3:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .