Email marketing is one of the most effective channels a small business has, and one of the most regulated. In the EU, two sets of rules apply at once: the ePrivacy rules decide whether you may send a marketing email at all, and the GDPR governs how you handle the personal data involved. On top of that, Gmail and Yahoo now enforce technical rules that decide whether your email reaches the inbox. This guide covers all three, in practical terms, for teams without a legal department.
Rule 1: You generally need consent first
Under Article 13 of the ePrivacy Directive, as implemented in each EU country, sending marketing emails to individuals generally requires their prior consent. That consent must meet the GDPR standard:
- Freely given. Not a condition of something unrelated, such as downloading a price list you’d give anyway.
- Specific. For marketing emails, separate from agreeing to terms or a privacy policy.
- Informed. People know who will email them, about what, and roughly how often.
- Unambiguous. An active step, such as ticking an unticked box. Pre-ticked boxes aren’t valid consent; the EU Court of Justice confirmed this in 2019.
You must also be able to prove consent: when it was given, how, and what the person was told. And withdrawing consent must be as easy as giving it.
The exception: existing customers (“soft opt-in”)
Article 13(2) allows you to email existing customers without separate consent, if all of these are true:
- you got their email address in the context of a sale of a product or service;
- you’re marketing your own similar products or services;
- you gave them a clear, free and easy way to object when you collected the address, and you give them that option in every email.
In November 2025, in the Inteligo Media case, the EU Court of Justice clarified two things. A “sale” can include signing up for a free account that also offers paid features. And where the soft opt-in conditions are met, no separate GDPR legal basis is needed for that marketing. But the exception remains narrow: it doesn’t cover people who only made an enquiry, bought lists, or products unrelated to what the customer bought.
What about business contacts (B2B)?
This is where EU countries differ most. The ePrivacy consent rule protects individuals, and member states decide how far it extends to company email addresses. Some countries treat a named work address, such as [email protected], much like a personal one. Germany, for example, is strict and generally requires consent even for B2B marketing emails. Others are more permissive for corporate addresses.
A named work email is still personal data under the GDPR, so the GDPR’s requirements (transparency, a legal basis, the right to object) apply either way. The safe approach: check the rules in each country you email into, and when in doubt, get consent.
Rule 2: Handle the data properly
- Tell people what happens. Your sign-up form should link to a privacy policy explaining what you collect, why, who processes it (your email platform) and how long you keep it.
- Sign a data processing agreement with your email platform. Reputable providers offer one as standard.
- Check where data goes. If your platform stores data outside the EEA, for example in the US, make sure transfers are covered, such as by the EU-US Data Privacy Framework or Standard Contractual Clauses.
- Collect only what you use. An email address and a first name are enough for most newsletters.
- Clean your list. Remove people who unsubscribe (immediately), and consider removing long-term inactive subscribers after a re-engagement attempt.
- Respect rights requests, such as access, correction and deletion, within the legal time limits.
A note on open tracking
Most email platforms track opens with an invisible pixel. In spring 2026, France’s data protection authority, the CNIL, published a formal recommendation: except for narrow purposes such as security, tracking pixels in emails need the recipient’s prior, separate consent, even when the email itself may be sent without consent. Other authorities may follow.
Open rates have also become unreliable, because Apple’s Mail Privacy Protection loads pixels automatically. Many teams now rely on clicks and conversions instead. If you keep pixel tracking, ask for consent to it at sign-up, separately from consent to receive emails, and explain it in your privacy policy. This is required for French recipients and sensible elsewhere.
Rule 3: Meet the inbox requirements
Since 2024, Gmail (and Yahoo, with similar rules) requires senders to meet technical standards. If you don’t, your emails go to spam or are rejected:
| Requirement | All senders | Bulk senders (5,000+ per day to Gmail) |
|---|---|---|
| SPF or DKIM authentication | At least one | Both |
| DMARC | Recommended | Required (policy can be “none”) |
| From: domain aligned with SPF or DKIM | Recommended | Required |
| One-click unsubscribe | Recommended | Required for marketing emails |
| Spam complaint rate (Postmaster Tools) | Below 0.3% | Below 0.3% |
Your email platform provides the DNS records for SPF and DKIM. Add them to your domain, add a DMARC record, and send from your own domain rather than a free email address.
Building a list the right way
- Never buy or rent lists. The people on them haven’t consented to hear from you, and bought lists destroy deliverability.
- Offer something genuinely useful in exchange for a subscription, such as a guide, a checklist or early access, and say clearly that they’ll receive marketing emails.
- Use double opt-in (a confirmation email with a link). The GDPR doesn’t strictly require it, but it’s the best proof of consent, keeps typos and fake addresses off your list, and some countries’ courts effectively expect it.
- Add a marketing checkbox at checkout, unticked, or rely on the soft opt-in for existing customers, with the objection option shown at checkout.
- Keep a consent record: date, time, source form, the wording shown, and the confirmation.
What every marketing email needs
- A clear sender name and your company’s identity and address.
- A visible unsubscribe link that works in one click, without a login.
- Content that matches what people signed up for.
- A sending domain that’s authenticated with SPF, DKIM and DMARC.
A quick compliance checklist
- Sign-up forms use an unticked, separate consent box, with clear wording and a privacy policy link.
- Double opt-in is enabled, and consent records are stored.
- Soft opt-in is used only for existing customers and similar products, with an objection option at collection.
- B2B rules are checked for each country you email into.
- A data processing agreement is signed with the email platform, and international transfers are covered.
- SPF, DKIM and DMARC are set up, and one-click unsubscribe works.
- Unsubscribes are processed immediately, and inactive contacts are reviewed regularly.
- Open tracking is disclosed, or replaced with click-based measurement.
Sources and further reading
- EUR-Lex: ePrivacy Directive 2002/58/EC (Article 13)
- EUR-Lex: General Data Protection Regulation (GDPR)
- Irish Data Protection Commission: Rules for electronic and direct marketing
- Timelex: The CJEU clarifies the soft opt-in (2025)
- CNIL: Recommendation on tracking pixels in emails (2026, PDF)
- Google: Email sender guidelines
This article is general information, not legal advice. Email marketing rules are implemented nationally and differ between EU countries, so confirm the rules for your markets with legal counsel. Status as of September 2026.