What GDPR and ePrivacy requires#
GDPR requires a lawful basis (usually consent) for marketing email and documented consent records.
What email consent management is#
Consent is the documented permission a recipient gives to receive marketing email. Laws differ on whether it must be express (opt-in) or may be implied (existing relationship), and on how long it lasts.
Why it matters#
Consent is the legal basis for marketing mail in most jurisdictions and the practical basis for good deliverability: people who asked for mail rarely complain.
How email consent management supports GDPR and ePrivacy compliance#
Regulators and recipients need to identify who sent a message and trust that opt-out mechanisms work. Email consent management contributes by consent is the legal basis for marketing mail in most jurisdictions and the practical basis for good deliverability: people who asked for mail rarely complain.
Implementation steps#
- Use an unchecked checkbox or a dedicated signup form; never pre-tick.
- Record timestamp, IP, source, and the exact wording shown at consent.
- Use double opt-in for marketing lists where feasible.
- Separate consent for different purposes (newsletter vs partner offers).
- Refresh consent for contacts older than two years with no engagement.
Frequently asked questions#
Is double opt-in required by law?
Not explicitly in most jurisdictions, but it is the easiest way to prove consent under GDPR and CASL and it improves list quality.