The General Data Protection Regulation (GDPR) was enacted by the European Union in 2018, and remains perhaps the world’s most stringent data privacy regulation. While the GDPR was designed to protect individuals’ rights and improve transparency in the EU, in practice it affects organizations all over the world.
Since July 2018, the total number of GDPR infractions and fines has been steadily increasing. Currently, the sum of fines totals a whopping €1.6 billion.
We’ve talked about how to create a foolproof compliance strategy to avoid violating GDPR, knowingly or otherwise. But there are other EU privacy data laws that need to be considered for marketing and advertising.
The Privacy and Electronic Communications Regulations (PECR) work in tandem with the GDPR to give individuals more control over their personal data. Under GDPR, the collection and use of all personally identifiable information is regulated to protect people, while PECR establishes more specific privacy rights on electronic communications. Complying with both the GDPR and PECR is essential to avoid fines and lawsuits.
Additionally, how each EU member enacts privacy laws differs from country to country. It’s recommended that your privacy policies adhere to the strictest measures, because it’s not always clear where your consumers reside.
We’ve broken down the differences from country to country (shown on our interactive EU Privacy Laws Map), along with what you need to keep in mind when doing business with these EU countries.
EU Privacy Details by Country
For each country, we looked at the following:
- Do you need informed consent to send marketing emails?
- Are opt-ins required to send marketing emails to a business email address?
- Are opt-ins required to send marketing emails to a generic email address?
A generic email address doesn’t relate to a specific person — for example, sales@zoominfo.com - Are soft opt-ins allowed? A soft opt-in is where an individual is considered to have provided implied consent to receive marketing emails when the email address was obtained in connection with the prior sale of goods or services, and the email address is used to market similar goods or services.
- There are exceptions for prior relationships based on the following:
1. An email address that was obtained from the individual in connection with a prior sale of goods/services.
2. An email address that is used to market similar goods/services.
3. The individual has not opted out of such use.
4. When the email address is collected and each time it is used, the individual is advised that he/she can opt out at any time. - Is an unsubscribe link required in all marketing and outreach emails?
Austria
Austria requires informed consent to send marketing emails to individuals. This consent, needed prior to outreach, must be free, informed, and unambiguous. Opt-in consent is required for sending emails for the purposes of direct marketing, or when an email is sent to more than 50 recipients. An unsubscribe link is required for all outreach and marketing emails. Soft opt-ins are allowed. Opt-ins are not required for collecting and sending to generic email addresses.
Belgium
Belgium requires informed consent when sending marketing emails. In cases of generic email addresses or existing customers, opt-in is not necessary. Soft opt-ins are permitted. All emails must contain an unsubscribe link.
Denmark
Informed consent is required in all cases, even for generic email addresses. Soft opt-ins are allowed. All emails must contain an unsubscribe link.
Finland
Informed consent is required when sending marketing emails. Direct marketing to generic email addresses is permitted if the recipient has not objected to or prohibited it. Prior consent isn’t required if the product or service advertised is substantially related to the recipient’s job title or description, like advertising a sales enablement tool to a salesperson. Soft opt-ins are permitted. All emails must have an unsubscribe link.
France
Informed consent is required when sending marketing emails, unless the marketed product or service is related to the individual’s profession and at the time the email address number was collected, the individual was informed their information would be used for marketing purposes and given an opportunity to opt out. Generic emails don’t require an opt-in. Soft opt-ins are allowed. All emails must have an unsubscribe link.
Germany
Germany requires double opt-in consent to send marketing emails to individuals. The individual’s consent should first be obtained through electronic means, such as checking a consent box in an online form, and then an email or similar notification should be sent to the individual requiring them to take an action to confirm their consent. Soft opt-ins are permitted. All emails must have an unsubscribe link.
Ireland
Informed consent is required to send marketing emails unless the email is sent to an email address used in the context of a commercial or official activity, and the message relates solely to that commercial or official activity. Soft opt-ins are allowed. All emails must have an unsubscribe link.
Italy
Informed consent and opt-in are required for all cases. Soft opt-ins are permitted. All emails must have an unsubscribe link.
Netherlands
Informed consent is required to send marketing emails, unless the email is sent to a person acting in the exercise of their profession or business and the sender is using contact information “intended and provided by the user” for such purposes. Soft opt-ins are allowed. Opt-in isn’t required for generic email addresses. All emails are required to have unsubscribe links.
Spain
Informed consent is required when sending marketing emails to individuals. Soft opt-ins are permitted. All emails must have an unsubscribe link.
Sweden
Informed consent is required when sending marketing emails to individuals. Opt-ins are not required for generic email addresses. Soft opt-ins are permitted. All emails must have an unsubscribe link.
Switzerland
Informed consent is required when sending marketing emails to individuals. Soft opt-ins are permitted. All emails must have an unsubscribe link.
United Kingdom
Informed consent is required when sending marketing emails to individuals, but some business emails do not require opt-ins. Emails to sole traders and some partnerships do require opt-in consent. Soft opt-ins are permitted. All emails must have an unsubscribe link.
ZoomInfo makes data privacy simple. For more information about EU privacy laws, the GDPR, and other resources for your go-to-market compliance, visit our privacy center.