GDPR for newsletters: what you actually need
Last updated · 3 min read
If you send a newsletter to people in the EU, the GDPR applies, and so do national rules on email marketing. This checklist covers what matters in practice.
1. Consent you can prove
Marketing emails in the EU generally need prior consent. The ePrivacy Directive sets this rule and each country implements it, in Germany for example in § 7 of the Unfair Competition Act (UWG). Under the GDPR, consent has to be freely given, specific, informed and unambiguous (Art. 4(11)), and you must be able to prove it (Art. 7(1)).
The common way to get proof is double opt-in: after signing up, people confirm with a click in an email. You store the time of signup and confirmation, the IP address or a shortened version, and the exact consent wording they saw. Our double opt-in generator writes the texts for you.
2. Clear information at the form
Next to the signup form, say who sends the newsletter, what is in it, how often it comes, that people can unsubscribe at any time, and where your privacy policy is. Keep every field except the email address optional.
3. A newsletter section in your privacy policy
Your privacy policy needs to explain the purpose, the legal basis (consent, Art. 6(1)(a)), which data you store and for how long, which service sends the emails and whether you measure opens and clicks.
4. A data processing agreement
Your email service processes subscriber data on your behalf. You need a data processing agreement under Art. 28 GDPR that lists the subprocessors and says where the data is stored. If the service or its subprocessors are outside the EU, the transfer needs a legal basis under Art. 44 and following, such as the EU-US Data Privacy Framework or standard contractual clauses.
5. Sender details and unsubscribe in every email
Every email should identify the sender with name, postal address and contact details. In Germany this is required by § 5 of the Digital Services Act (DDG), in the US by CAN-SPAM, and in Canada by CASL. Every email also needs a working unsubscribe link. Gmail and Yahoo additionally require bulk senders to support one click unsubscribe through the List-Unsubscribe header (RFC 8058).
6. Tracking only with consent
Open tracking uses an invisible image, click tracking uses redirected links. German data protection authorities consider this access to the user's device under § 25 TDDDG, which needs consent. Other EU regulators take similar views. The clean solution is a separate, optional checkbox for tracking and no tracking for everyone else.
7. Subscriber rights
People can ask what you store about them (Art. 15) and ask for deletion (Art. 17). You should be able to find a contact, export the data and delete it quickly. Keep unsubscribed addresses on a suppression list so a later import does not add them back.
8. No bought lists
Bought or rented lists come without consent given to you. They break marketing law and hurt deliverability, because many of those addresses are dead or are spam traps.
Short version
- double opt-in with stored time, IP and consent wording
- clear information at the form and in the privacy policy
- a data processing agreement with your email service
- sender details and unsubscribe in every email, one click unsubscribe
- tracking only with separate consent
- access, export, deletion and a suppression list
Sendmora has these built in: double opt-in with a record, a required footer, tracking off by default, a DPA in one click, and data stored in the EU.
Not legal advice. This checklist does not replace advice from a lawyer for your situation.