Home / Insight / GDPR / Consent


The GDPR stipulates that declared consent will only be considered valid if the person giving consent has been informed about all details with regard to his or her declaration. 

Consent as an obstacle – what you should take into consideration

Sending promotional messages is generally not permissible if those messages are being sent without the consent of the recipient or, if the number of recipients exceeds 50 and the sender does not maintain a business relationship with the recipients. Explicit consent is not required, if

1. the recipient has disclosed his or her address to the sender in the course of a business process; and
2. the sender solely uses the contact address for advertising further products and services he or she offers; and
3. the recipient has the option to decline at any time in the course of the communication process and free of charge to receive further promotional emails.

Identify yourself
Do not forget to use the company’s official email address and place a clearly visible “unsubscribe” link in your promotional email to allow the recipient to opt out from receiving further messages at any time. Also keep in mind that every newsletter or promotional email has to be marked as such, for example, by clearly indicating this in the subject line. Also remember that the sender has to be clearly identifiable at any time with the help of a legal notice on the website and an email signature containing further contact information.

The dilemma of “yes, I do” 
In practice, data subjects usually give consent to receiving newsletters or promotional emails via an opt-in. Opt-in means that the data subjects give their consent to receive emails on a regular basis (e.g. newsletters) in advance. Also, bear in mind that the checkbox must not be pre-selected. A best-practice solution is to ask users to click a checkbox accompanied by a text that could be drafted as follows:

“I hereby grant the XY company permission to process my data [i.e., ... (exact and exhaustive list) ...] pursuant to the Privacy Policy [insert URL to the Privacy Policy] for the purpose of receiving promotional materials for the XY products of the company. This permission granted to XY GmbH is voluntary and can be revoked at any time via email to [email protected]

Please note that the Privacy Policy must also comply with the stipulations of the GDPR.

Other aspects to consider when sending emails
Similarly to the Robinson list used in the context of advertising via postal mail, private persons as well as companies may block advertising via email with the help of the so-called ECG list. In practice this means that you have to check and ensure that none of the email addresses in your mailing list is also listed in the ECG list before sending promotional emails. The Austrian Regulatory Authority for Broadcasting and Telecommunications (in German “RTR GmbH”) offers technical support for ECG list checks.