Suppose a nonprofit wishes to contact some EU-based employees of an EU-based company in an effort to get that company to use a free service it is offering, and is considering doing so via LinkedIn. Per Article 13 of the ePrivacy Directive - i.e. Directive 2002/58/EC:

  1. The use of automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may only be allowed in respect of subscribers who have given their prior consent.

And, per Article 2(h), 'electronic mail' would include social media messages such as LinkedIn messages:

"electronic mail" means any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient

'Direct marketing' is not defined in the ePrivacy Directive, but the UK Information Commissioner's Office gives the following guidance (my emphasis):

Direct marketing is defined in section 122(5) of the Data Protection Act 2018 as:

“the communication (by whatever means) of advertising or marketing material which is directed to particular individuals”.

This covers all advertising or promotional material, including that promoting the aims or ideals of not-for-profit organisations – for example, it covers a charity or political party campaigning for support or funds. The marketing must be directed to particular individuals. In practice, all relevant electronic messages (eg calls, faxes, texts and emails) are directed to someone, so they fall within this definition.

Genuine market research does not count as direct marketing. However, if a survey includes any promotional material or collects details to use in future marketing campaigns, the survey is for direct marketing purposes and the rules apply.

From this, it seems that:

  • (a) Prior consent would be required to send messages to specific individuals to promote the nonprofit's offering, including via LinkedIn.
  • (b) A simple message asking if a person would be interested in learning more, or otherwise trying to obtain their consent, would itself be considered direct marketing, so itself require prior consent...

If this is correct, how could the nonprofit legally contact the relevant stakeholders? I am confused about what should be done in this case. It seems very strange that a person at a company who might be interested in using the nonprofit's services cannot even be sent a one-line opt-in request to receive more details on LinkedIn. Any thoughts gratefully appreciated.

Some solutions I have considered:

  1. Take advantage of the difference between 'corporate subscribers' and 'individual subscribers' in the UK's implementation of the ePrivacy Directive (PECR), which allows direct marketing to employees' corporate email addresses. Only applies to the UK and probably does not apply to LinkedIn.
  2. Phone the individual concerned to obtain consent prior to sending a message. Requires knowing the phone number and is time-consuming.
  3. Contact the company's official email address (e.g. [email protected]) instead. Impractical as reply rate is very low from such addresses.
  • 1
    "Standard ads won't work" - you mention LinkedIn, is it possible you could buy and target a LinkedIn ad? They are able to market to users because of their T&Cs. See this and this Jun 2, 2023 at 10:23
  • 4
    Can I ask why this is surprising to you? I mean, you want to send out spam, the fact that you are non profit doesn't change that you want to send unsolicited email promoting a product. For what it's worth, I make a point of refusing to use anything that I learn about through this kind of spam. Even if the tool is good and I might have been interested otherwise, if you just cold-email me to tell me about it, I will refuse to use it as a matter of principle. I don't want to reward spamming, no matter how good the intentions of the organization doing the spamming.
    – terdon
    Jun 2, 2023 at 12:44
  • 1
    "how could the nonprofit legally contact the relevant stakeholders?" You seem to be assuming that the stakeholders give consent to specific senders. I think the expectation is that LinkedIn has a general setting "I'm willing to be contacted by third parties", and you must obey that setting.
    – Barmar
    Jun 2, 2023 at 14:44
  • You talk in a comment below about "a person ... who [the marketer] believes would benefit". I think an analogy can be made here to religious evangelism or proselytism: a religious believer may believe they are doing a favour by preaching the Gospel, or the path to enlightenment, but a non-believer may be annoyed by the intrusion on their time and space. Similarly, if a marketer is enthusiastic about their product, they may believe they are doing a favour by telling people about it, but for the recipient it is just another unsolicited message taking up their limited time.
    – IMSoP
    Jun 2, 2023 at 17:49

2 Answers 2


You seem to have a solid understanding of the ePrivacy implications, but lack a fundamental insight: your organization does not have a right to achieve its mission or a right to disseminate unwanted marketing. But other people do have a right to not be subject to excessive marketing.

Of course, reality is more complex, so it's probably not entirely impossible to do marketing.

  • In your point 1, you note that some EU/EEA/UK countries distinguish ePrivacy protections between consumer and business subscribers. You can research the exact rules in the potential customer's country. This may allow you to email corporate/business accounts.

    I would strongly advise against messaging via Linkedin if there is a chance that the person is using that account for personal purposes like networking or hunting jobs, not just for conducting official company business.

  • ePrivacy has markedly different rules for email marketing vs phone marketing. Whereas there are pretty strict rules for electronic messages and robocalls, manual cold calling can be OK from an ePrivacy perspective. However, many EU/EEA/UK countries have rules that go beyond ePrivacy, and may have a kind of do-not-call registry that you must respect. Of course manual calls take more effort than spamming emails, but recall the above point that you don't have a right to spam other people.

    Phone calls are probably the most appropriate approach when the company lists individuals' phone numbers on its website. This will at least give you a few seconds of attention with a real human, more than you can expect from an email that is likely to be caught by spam filters.

  • Marketing via physical mail tends to have very lax rules. Note that every company/business that has a website will have to disclose its contact details including an address there, so this information is easy to acquire. However, chances are low that anyone would seriously engage with that marketing.

  • You can consider alternatives to direct marketing, so that interested companies eventually come to you. Things like press releases, writing guest articles in industry publications, speaking at relevant conferences, working on search engine optimization, buying ads.

On the GPDR aspects: GDPR and ePrivacy overlap, and it is necessary to comply with both sets of rules (GDPR likely applies here via Art 3(2)(a)). But where they potentially contradict each other, ePrivacy as the more specific law has precedence. For example, ePrivacy overrides the default GDPR legal basis rules when it comes to email marketing to existing customers (opt-out basis, no consent needed) or to using cookies (needs consent unless strictly necessary).

Information that relates to corporations is not personal data, but information that relates to individual employees or to sole proprietors would typically be personal data. Since you are unlikely to obtain consent for using this data, you would need an alternative GDPR legal basis such as a "legitimate interest".

Relying on a legitimate interest requires that you conduct a balancing test, weighing your interests like marketing against the recipient's interests, rights, and freedoms. Core question in this context is whether the data subject can reasonably expect their personal data to be used like this, taking into account the nature of their relationship with you. Since there is no pre-existing relationship, claims of a legitimate interest are weak to start with. However, it may be possible to argue that when a company makes employee contact details available via its website (not LinkedIn!) then relevant marketing can be reasonably expected. I would rather not rely on such arguments, though.

  • 4
    most important part: just because you're a non-profit doesn't mean you're exempt from the law.
    – jwenting
    Jun 2, 2023 at 6:58
  • I understand this, @jwenting But I'm confused about what this means for 'prospecting' in general. Suppose a marketer identifies a person (prospect) who she believes would benefit from some product. Traditionally, I think the practice was to send a personalised message asking if the prospect would be interested. It seems very strange if her only options are to post mail, maybe phone, or create content in public channels and just hope the prospect finds her company. Jun 2, 2023 at 9:25
  • 3
    @CarrotsHamster You can use the company's contact information for unsolicited business inquiries, that's what they're for. That's how you do business, with the company, not with a random employee. Jun 2, 2023 at 10:18
  • 2
    What OP wants to do would in generally be considered advertising. The fact that the company is a non-profit and that the product is given out for free don't change that. The usual rules and restrictions for advertising still apply.
    – quarague
    Jun 2, 2023 at 10:59
  • 2
    @CarrotsHamster you're no different from any other spammer wanting to use a shotgun approach to advertising by ramming it down peoples' collective throats. The law is designed specifically to stop behaviour like that. Of course you can choose to not adhere to the law and get your organisation the ire of the world for that, that's your choice.
    – jwenting
    Jun 2, 2023 at 11:31

Ad 1: E-mail

Private E-mails are PII and need to be handled under GDPR. You need either consent or legitimate interest to work with those. Marketing without previous engagement is not a legitimate interest.

Ad 2: calling

Private phone numbers are PII and you need GDPR consent or a legitimate interest to work with those. Marketing without previous engagement is not a legitimate interest.

Also, you can not use an automated calling machine, as that is explicitly called out. Also marketing calling in itself has strict rules.

Ad 3: official e-mail

Re low reply rates are because typically, marketing mails are filtered and deleted before anyone actually reads them. That is not a question of law though.

Ad 4: Informational message

Informing someone you have no relation to that a service is available is advertisement, no matter if it is a service for free or pay.

  • @peter88 that would be legal advice, which is banned on the site. Do note that I said private in both cases.
    – Trish
    Jun 1, 2023 at 18:56
  • My apologies. What I wanted to know were plausible alternative ways to contact a person at a company without breaking the law - is there a way to request possible methods, even hypothetically, while being clear that I am neither soliciting nor expecting formal legal advice? Also, what do you mean exactly by 'private' - do you mean to distinguish private personal emails ([email protected]) from private corporate emails ([email protected])? Jun 1, 2023 at 18:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .