Newsletters and GDPR: consent, double opt-in, existing customers

Two laws, two tests

Two sets of rules apply to newsletters side by side. Competition law (UWG, the German Act against Unfair Competition) governs whether you may send someone advertising by email. Data protection law (GDPR) governs whether you may process the address and other data for this purpose. A campaign must pass both tests.

Under § 7 (2) no. 2 UWG, advertising by electronic mail is always an unacceptable nuisance if the recipient has not given prior express consent. This applies to consumers and businesses alike. In addition, § 7 (2) no. 3 UWG prohibits marketing emails in which the sender is concealed or no valid address for unsubscribing is given.

Under data protection law, you generally base sending on consent under Art. 6(1)(a) GDPR. Recital 32 makes clear that silence, pre-ticked boxes or inactivity do not constitute consent. So a pre-selected checkbox in the checkout is not enough.

Consent and the obligation to prove it

Art. 7 GDPR sets out four requirements that are directly relevant to newsletters:

• Proof: the controller must be able to demonstrate that the person has consented (para. 1).
• Separation: if consent is given in a text that also covers other matters, it must be clearly distinguishable from them, intelligible and easily accessible (para. 2).
• Withdrawal: the person can withdraw consent at any time, must be informed of this beforehand, and withdrawing must be as easy as giving consent (para. 3).
• Freely given: account must be taken of whether a contract is made conditional on consent that is not necessary for that contract (para. 4).

In competition law, too, the advertiser bears the burden of proof. In its ruling "Double-opt-in-Verfahren" (10.02.2011, I ZR 164/09), the Federal Court of Justice (BGH) ruled that the advertiser must set out and prove the consent of the specific recipient. To do so, consent given electronically must be stored and be printable at any time.

Double opt-in: how the proof works

With double opt-in, the person signs up and receives an email with a confirmation link. Only after clicking it are they added to the mailing list. In the ruling mentioned above, the BGH held that once the confirmation has been received, it can be assumed that the sign-up actually came from the owner of the address. Consent to email advertising is thus generally sufficiently documented. If the recipient disputes having given the confirmation themselves, it is up to them to substantiate this.

Is the confirmation email itself unlawful advertising? The Higher Regional Court (OLG) of Munich took this view in 2012. The OLG Celle (15.05.2014, 13 U 15/14) expressly did not follow it and does not consider the request for confirmation to be unlawful advertising. The practical consequence: the confirmation email should contain only the confirmation, without offers, vouchers or product images.

For every sign-up, store at least:

• the time of sign-up and of confirmation
• the form or source (e.g. pop-up on the home page, checkout)
• the wording of the consent text in the version valid at the time
• the IP address or a comparable technical identifier, if your system records it

The existing-customer exemption under § 7 (3) UWG

Without consent, you may only email customers if all four conditions of § 7 (3) UWG are met at the same time:

1. You received the email address from the customer themselves in connection with the sale of goods or a service.
2. You use the address for direct marketing of your own similar goods or services.
3. The customer has not objected to this use.
4. When the address is collected and each time it is used, the customer is clearly and unambiguously informed that they can object at any time, without incurring any costs other than transmission costs at basic rates.

The law refers to a sale. Under its wording, a mere registration or an abandoned cart is not a sale. Caution is also advisable with the word "similar": advertise products that meet the same need as the purchase, not your entire range. Build the notice of the right to object permanently into the checkout and into the footer of every email.

Under data protection law, direct marketing to existing customers can be based on legitimate interests (Art. 6(1)(f) GDPR, Recital 47). If the person objects, all processing for marketing purposes must stop under Art. 21(2) and (3) GDPR.

Prize draw or discount in exchange for signing up

Many stores offer a ten percent discount or a chance to win for signing up to the newsletter. This touches on the prohibition on tying under Art. 7(4) GDPR. The legal position is not uniform:

• The OLG Frankfurt (27.06.2019, 6 U 6/19) considers it permissible to make participation in a prize draw conditional on consent to advertising. What matters, it says, is that consent is given voluntarily and that it is clear which advertising from which company is covered.
• The data protection authority of North Rhine-Westphalia (NRW) considers consent in this case not to be freely given, but permits the model as a contract of "chance to win in exchange for the newsletter". The offer must then not be presented as free of charge, and all conditions must be stated openly (summary at Dr. Datenschutz).

If you want to play it safe, state the exchange openly ("10% discount for signing up to our newsletter"), describe the content and frequency of the emails, and allow unsubscribing at any time without retrospectively withdrawing the discount.

Unsubscribe link and tracking pixels

Every marketing email needs a clearly visible unsubscribe link. This follows from § 7 (2) no. 3 and (3) no. 4 UWG and from Art. 7(3) GDPR. There are also technical requirements: Google requires senders of more than 5,000 messages a day to Gmail addresses to offer one-click unsubscribe via the List-Unsubscribe header under RFC 8058, and a spam rate below 0.3 percent.

Open rates are measured via an invisible pixel, clicks via redirected links. Under § 25 TDDDG (the German Telecommunications Digital Services Data Protection Act), storing information on the end device or accessing it is generally only permitted with consent. Whether and how this applies to email pixels has not yet been conclusively settled by German courts and authorities. In April 2026, the French data protection authority CNIL published a recommendation on tracking pixels in emails. It generally requires consent and only allows narrowly defined exceptions, such as measuring deliverability in order to remove inactive recipients.

The cautious approach for Germany: expressly include the measurement of opens and clicks in the consent text and log that version.

Checklist for your newsletter

• Sign-up form without a pre-selected checkbox, with information on content, frequency, withdrawal and tracking
• Double opt-in active, confirmation email without advertising
• Log per contact: timestamps, source, text version
• Existing customers only with a link to a purchase, only similar products, notice of the right to object in the checkout and in every email
• Discount or prize draw promotions worded transparently
• Unsubscribe link in every email, one-click header for large sending volumes
• Unsubscribes and objections take effect immediately and go onto a suppression list, so the address is not accidentally re-imported
• Sender clearly identifiable in every email, nothing concealed

Minotaurus sets up sign-up flows, double opt-in and consent logs in Klaviyo and Shopify. This does not replace a legal review of your texts.

Sources

1. § 7 UWG (dejure.org, German)
2. Art. 7 GDPR (dejure.org, German)
3. Regulation (EU) 2016/679 (GDPR), EUR-Lex
4. BGH, judgment of 10.02.2011, I ZR 164/09 (dejure.org, German)
5. OLG Celle, judgment of 15.05.2014, 13 U 15/14 (dejure.org, German)
6. OLG Frankfurt, judgment of 27.06.2019, 6 U 6/19 (dejure.org, German)
7. Dr. Datenschutz: LDI NRW on prize draws in exchange for a newsletter subscription (German)
8. § 25 TDDDG (dejure.org, German)
9. CNIL: Recommandation sur les pixels de suivi dans les courriels (14.04.2026, French)
10. Google: Email sender guidelines