How to Comply With GDPR for Email Marketing

Does GDPR Apply to Your Business

GDPR applies if you collect or process personal data from anyone in the European Union or United Kingdom. Personal data includes email addresses, names, IP addresses, and any other information that identifies a person. If your website is accessible to EU residents and you collect their email addresses, GDPR applies to you even if your business is based in the United States, Australia, or anywhere else outside the EU.

In practice, this means most businesses with an online presence need to follow GDPR rules for at least some of their subscribers. If you cannot distinguish between EU and non-EU subscribers at the point of collection, the safest approach is to apply GDPR-level protections to your entire list. This is actually easier than maintaining different rules for different subscribers.

Key GDPR Requirements for Email Marketing

Explicit, Affirmative Consent

Unlike CAN-SPAM, which allows sending until someone opts out, GDPR requires consent before you send. The consent must be freely given, specific, informed, and unambiguous. A pre-checked checkbox does not count. The subscriber must actively check the box or click a button that clearly says they agree to receive marketing emails. The signup form must explain what they are consenting to: what type of emails, how often, and from whom.

Right to Access

Subscribers can request a copy of all personal data you hold about them. You must provide this within 30 days. This includes their email address, name, signup date, email engagement history, and any custom fields stored in their contact profile. On AI Apps API, contact data is stored in the broadcastData table and can be exported per contact to fulfill access requests.

Right to Erasure (Right to Be Forgotten)

Subscribers can request that you delete all their personal data. This goes beyond unsubscribing, it means removing their record entirely from your database, not just suppressing future sends. You must comply within 30 days. After erasure, you should have no record of that person except what is required for legal compliance (like keeping a record that they requested deletion).

Right to Rectification

Subscribers can request corrections to their personal data. If someone asks you to update their name, email address, or any other stored information, you must accommodate the request.

Data Minimization

Only collect personal data that you actually need for the stated purpose. If you only need an email address to send a newsletter, do not also require a phone number, date of birth, and physical address. Every field you collect must have a justified reason. This principle also means you should not retain data longer than necessary.

Record of Consent

You must be able to prove when and how each subscriber gave consent. Store the timestamp of signup, the specific form or page they used, the IP address, and the text of the consent notice they agreed to. If a regulator asks you to demonstrate that a subscriber consented, you need this evidence. This is why double opt-in is strongly recommended under GDPR, as the confirmation email click provides an additional layer of documented consent.

Practical Steps for GDPR Compliance

• Use explicit opt-in. No pre-checked boxes. Use clear language like "I agree to receive marketing emails from [Business Name]." Make it a separate checkbox from terms of service or other agreements.
• Add a privacy policy link. Your signup form should link to a privacy policy that explains what data you collect, how you use it, who you share it with, and how subscribers can exercise their rights.
• Use double opt-in. Send a confirmation email requiring the subscriber to click a link to verify their signup. This provides documented proof of consent and produces a cleaner list.
• Make unsubscribe easy. Include a clear unsubscribe link in every email, just like CAN-SPAM requires. Process unsubscribes immediately.
• Have a process for data requests. Know how to export, modify, and delete subscriber data when requested. Test this process before you need it.
• Do not share lists. Never sell, rent, or share your email list with third parties without explicit consent for that specific sharing.

GDPR vs CAN-SPAM: Key Differences

• Consent: CAN-SPAM is opt-out (you can send until they unsubscribe). GDPR is opt-in (you must get consent first).
• Scope: CAN-SPAM applies to emails sent in the US. GDPR applies to data of EU/UK residents regardless of where you send from.
• Data rights: CAN-SPAM gives the right to unsubscribe. GDPR gives rights to access, correction, deletion, and data portability.
• Penalties: CAN-SPAM fines up to $50,000+ per email. GDPR fines up to 20 million euros or 4% of revenue.