0

I live in the United States. I am helping someone who just started an online store selling tee shirts. In my research to come up with a plan regarding cold call email marketing, I came across GDPR. Her target market is the US, but she is not opposed to selling to anyone in the EU either. She wants to send advertisements via email to potential customers to introduce her store. In reading about GDPR, I understand the fines can be astronomical for contacting someone who is a citizen of a country governed by GDPR. That is the scenario, here are my questions:

If her intent is to market to US based customers only and has a disclaimer on the ad, will that protect her from violating GDPR? Her disclaimer would look something like this:

"GDPR Disclaimer - This advertisement is intended to introduce potential US based customers to XYZ company...yada yada yada. If you have received this email and if you reside in a country controlled by the GDPR law, this email was not intended for you and was sent to you in error. There is nothing you have to do, you are not subscribed on any list and you will not receive any further contact".

She has obtained a list of hundreds email addresses from the internet. She has no idea who owns a given email address nor what country they reside in. Cold calling (not spamming) is allowed here in the United States. The fact that GDPR strongly discourages it (or outlaws it...not really sure which one when it comes to GDPR) should not preclude her from trying to reach potential customers in her own country. There are some domain extensions she would avoid entirely (such as "de" for Germany) as she would have the assumption any email in that domain would be for Germany and thus controlled by GDPR. Other domains are not that clear cut. The "com" domain is mainly US commercial, but "gmail.com" is a email provider which is global. How can I know if a given email address (for instance "jsmith@gmail.com" is for a person in the United States, Europe, Australia, Japan or wherever? "jsmith" doesn't even really have to belong to someone with a first initial of "j" and a last name of "smith". It could be an alias for someone else. My point and my question is this. My friend doesn't want to violate GDPR, but at the same time she doesn't want to be precluded from marketing to potential customers in the US. How does she know if an email address is controlled by GDPR. It seems to me that there would have to be a way to know this or it cannot be enforced up to the point when it is discovered. Does this make sense? Is there any repository (online database) that would tell me is a given email address is owned by person who is in a country that is controlled by GDPR? It seems to me that there should be. She should be able to comply with the law by submitting her (say 500) list of email addresses in a query to a GDPR database and it kicking back the 20 or 30 addresses that are protected. In that way, she knows who she can market to and who she can't. As I understand it, there is no such repository so she has to guess which email addresses she can use and which she cannot. That is really unfair and it would essentially block her from reaching out to her intended audience out of fear she should send to someone in a GDPR protected country without intending to or knowing it.

1
  • 5
    You might say its not spam, but yeah its spam. Don't do it. – Moo Apr 27 at 23:06
6

That GDPR Disclaimer is no protection in some jurisdictions: the applicable laws to that situation in for example don't care about the GDPR:

Cold calling, mailing, or e-mailing private people to advertise services all is handled by the same law: Without the consent it is expressly illegal under §7 of the law against unfair competition (Gesetz gegen unlauteren Wettbewerb UWG) and such cases are rather Slam-Dunk if the origin can be made out. The punishment can be a 300.000 € fine.

The fact that to email someone you need their e-mail address and that e-mail addresses and private addresses are by default considered personally identifiable information is making it worse for the advertizer: Without either an exception (there is none available to cold-emailing) or special allowance of the person the data belongs to, you violate §4 of the federal data protection law (Bundesdatenschutzgesetzes BDSG) just by handling their e-mail address. That's a separate crime from the UWG one, adding up to another 300.000 € fine under §43 BDSG - or even up to 2 years in prison under §44 BDSG!

Oh, and if the email does not contain a proper sender's address, that's another chance for a huge fine under the UWG...

So, GDPR is your least trouble, if you violate the marketing laws of a country, or their own data privacy laws. A disclaimer means nothing as the act of sending the mail, even to an unintended addressee, is what is illegal and the law as written does not give a damn about 'I didn't want to advertise to that person' when in fact you sent them unwanted advertisements.

Oh, and the very repository you suggest? It would violate the very same §4 BDSG and be illegal for processing private data if it was not actively asked to do that by the end user. As a result, that database is useless: It does kick back all people not in its database. Its database is incomplete because only few people give their address to that database as people not aware of the database never add their data on their own. So it regularly violates §4 BDSG with every German citizen's e-mail address it gets and kicks back, and claiming those addresses would be OK, it throws the company trying to check the database under the bus because they rely on data that is impossible to be reliable.

tl;dr

Don't do cold-(e)-mail marketing. You throw yourself into boiling oil with a lit torch in hand.

further reading

Other laws banning such behavior I had listed here, and I quote myself:

The US has the CAN-SPAM-Act, which illegalizes sending unsocialised advertisements. You may NOT send a mail if any of the following is true:

  • it has no opt-out
  • the email was gained by 'harvesting'
  • contains a header not matching the text
  • contains less than one sentence
  • the adressee does not have any relation to you

In fact, you are liable for a 5-digit fine per infringing e-mail in the US. The FTC itself suggests to never buy e-mail lists - as E-mail harvesting or generating any possible e-mail adress itself is illegal.

8
  • 3
    @JustinBoulder there’s nothing “fundamentally wrong” with a law banning spam. Many countries have them. – Dale M Apr 27 at 21:39
  • 3
    @JustinBoulder “Cold call emails” are not a very legitimate marketing strategy to start with. Buying email lists and hoping for the best isn't just a violation of many anti-spam acts, but also has low conversion rates. But email marketing can be done well. Even Germany (and all of EU+UK) do allow email marketing if either (a) the recipients have given their prior consent, or (b) you have an existing business relationship with the recipient, and they were given a chance to opt-out when their address was obtained. Maybe traditional online ads would be better at this growth stage. – amon Apr 27 at 21:53
  • 3
    @JustinBoulder The laws in the EU protect the consumer, and YES, you are essentially banned from cold-emailing a consumer in Germany. You need to have an already established connection of either consent or business to mail a private person as a company. Cold mailing is a violation of german law the moment the recipient is in Germany. And it does not matter that you don't know where they are - you should have known that you catch people that you may not mail, which makes it deliberate and thus you can get maximum fines. – Trish Apr 27 at 22:43
  • 1
    @JustinBoulder Thing is: if a company does any business in the EU, a fine for noncompliance from any EU state can be used to seize the assets of the company. You can't even mail customers if they liked the service without them having agreed to that prior, as that is an advertisement according to OLG Dresden v. 24.4.2016, Az. 14 U 1773/13. – Trish Apr 27 at 23:06
  • 1
    @JustinBoulder Also, §7 UWG is tested so often in court, that several such cases went up to the highest court in Germany: in 48 out of 50 cases I looked at, the company lost when they have been slapped around in various instances of the German court system, including the BGH. The 2 cases were companies prevailed? VERY nieche, both relying on someone that owned the mail address before asking for the newsletter and then giving up the mail address, then someone else picking it up. – Trish Apr 28 at 9:53
2

Trish's answer is by and large correct for the German law for the German market. But it does not address the real question: In which cases is German competition law and the GDPR applicable?

§ 7 II Nr. 3 UWG

In the German legal system the prohibitions of the competition law (UWG, Gesetz gegen den unlauteren Wettbewerb) is a type of tort/non-contractual obligation belonging to private law (and not criminal law). The application of the UWG depends on the rules about conflicts of laws. For non-contractual obligation this is the Rome II-Regulation, art. 6 I says:

The law applicable to a non-contractual obligation arising out of an act of unfair competition shall be the law of the country where competitive relations or the collective interests of consumers are, or are likely to be, affected.

It is impossible to affect the competitive relations or the collective interests of consumers in Germany by advertising a product not sold in Germany. An advertising practice only affects the market in the country the advertisement is aimed at. So the affected market is the one of the United States and the US competition law applies.

So: § 7 II Nr. 3 UWG prohibits cold call emails for advertisement but is not applicable to a case of advertisement aiming at the US.

GDPR

The GDPR prohibits cold call email advertising - this is clear (data procession without consent or another legal ground). But is the GDPR applicable?

Art. 3 GDPR regulates the territorial scope of the regulation. Primarily it applies to data controllers established in the EU, but also art. 3 II a):

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union;

The mentioned shop is not established in the EU and does not offer goods to subjects in the Union either. So the GDPR does not apply to it. A disclaimer like the proposed may make this clear; the shop has to refuse any orders in the EU anyway received.

Result

The prohibition on cold call emailing by the German UWG and the GDPR do not apply on the mentioned case, a disclaimer like the proposed seems fine. I don't know of the competition law of other EU member states, but suspect they work similar to the UWG and are esp. subject to art. 6 I Rome II (this regulation applies to all the EU without Denmark).

Trish mentions in their other answer an US-law on this subject, so look at this too. Personally I think it is right to prohibit cold call emailing, but each country has to decide this for its own market.


This is a complicated question that might be worthy to ask a real expert.

2
  • They still process E-mails against the BDSG – Trish Apr 28 at 17:14
  • 2
    Note that, if the OP's business sells or markets any product to anyone in the EU at any time, then this analysis fails and they immediately become responsible for full GDPR compliance. The question states that "[the owner's] target market is the US, but she is not opposed to selling to anyone in the EU either." So the owner probably needs to make up her mind about whether or not she wants to do business in the EU. – Kevin Apr 28 at 21:14
1

Is there any repository (online database) that would tell me is a given email address is owned by person who is in a country that is controlled by GDPR? It seems to me that there should be.

I don't think there is one either and I suspect such a repository could, in itself, be somewhat questionable under the GDPR. The safest way not to violate the GDPR is to apply the same standard and, among other things, collecting as little personal data as possible, keeping it only as long as strictly necessary, using it only for the purpose it was intended, and securing proper consent as needed. The law is clearly not structured to give you easy ways out like filtering out EU subjects (as you hope to do) or including overly broad consent or waiver clauses in general terms and conditions.

Realistically, geofencing your site and not selling anything in the EU/delivering to EU addresses should also shield a small business from practical consequences but if you do want to trade in Europe, then the regulation has real teeth and it will be difficult to discriminate and keep doing questionable things elsewhere.

In that way, she knows who she can market to and who she can't. As I understand it, there is no such repository so she has to guess which email addresses she can use and which she cannot. That is really unfair and it would essentially block her from reaching out to her intended audience out of fear she should send to someone in a GDPR protected country without intending to or knowing it.

I don't know how much of this really result from a deliberate plan and how much is overreach and unintended consequences but I have heard at least once that the extraterritorial impact was very much desired. That it could make some business models illegal, impose onerous requirements on foreign businesses, or establish a new worldwide standard would therefore be a feature, not a bug.

Many people have the same reaction when they realise this but ignoring the EU market entirely can cost a lot. The idea is therefore to leverage the EU's size and economic power to ensure that it is not only at the receiving end of US regulations like the Foreign Corrupt Practices Act (FCPA) or the Foreign Account Tax Compliance Act (FATCA) but pushes back with regulation of its own. I can tell you that many executives in the EU do feel the FCPA is very unfair (or cynically meant to interfere with their business).

4
  • I can assure you that Germany's blanket ban on unsolicited email marketing via the s7 UWG is planned to be that far and ban any and all such marketing. – Trish Apr 29 at 10:08
  • @Trish Not sure I understand your comment, what's the relation to my answer? – Relaxed Apr 29 at 10:10
  • That GDPR is only the latest rule, and it's predecessors (UWG) and follow up national laws are indeed written to expressly prohibit such mailing. – Trish Apr 29 at 10:12
  • @Trish That's not really the point though. Forbidding this or that is quite common, the key property of the GDPR I was highlighting is its extraterritorial scope and enforcement at the EU level. National law doesn't have the same reach. The GDPR also comes from a completely different source, its predecessors are the 1995 data protection directive, the Bundesdatenschutzgesetz and similar statutes in other countries. It's only tangentially related to UWG. – Relaxed Apr 29 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.