GDPR Email Consent

Under the GDPR, consent used as a lawful basis for processing personal information must be freely given, specific, informed, and unambiguous. A preselected checkbox, bundled agreement, or silent assumption is not a valid affirmative indication. A sign-up form should identify the sender, explain the relevant purpose, and make withdrawal straightforward; the organization should maintain a record of the consent it relies on.

However, "GDPR email consent" is not a complete legal rule for every marketing email. EU member states also apply electronic-communications and direct-marketing requirements, and rules can vary by recipient type, existing-customer relationship, and local implementation. Similar-looking UK email programs are governed by UK GDPR and PECR, including a limited soft opt-in for certain existing-customer marketing. A business should review the law of the markets it contacts and its actual processing basis rather than assume that every email requires the same checkbox.

Permission to send marketing messages is separate from permission for unrelated profiling or onward sharing. Clear unsubscribe routes and retention practices still matter after collection.