GDPR Newsletter Marketing Guide for Non-EU Businesses

Email newsletter marketing to EU subscribers is one of the most common GDPR compliance gaps for non-EU businesses. Between the ePrivacy Directive’s opt-in requirements and GDPR’s consent standards, sending marketing emails to EU addresses requires careful compliance.

Consent Requirements

Under the ePrivacy Directive and GDPR, sending marketing emails to EU individuals generally requires opt-in consent. Key requirements:

• Opt-in: Pre-ticked consent boxes are invalid. GDPR Article 7 requires a clear affirmative action (unticked box)
• Granular: Separate consent for different types of marketing (newsletter vs partners offers)
• Double opt-in: Not legally required but strongly recommended as evidence of consent
• Revocation: Unsubscribe link must be clearly visible and functional within seconds
• Records: Store the timestamp, method, and wording of consent given

Soft Opt-In Exception

The “soft opt-in” (Article 13(2) ePrivacy Directive) allows email marketing to existing customers for similar products — but only if the customer’s email was collected in the context of a sale or negotiation. This does not apply to new newsletter signups or B2B cold emails.

Newsletter Platforms and DPAs

Mailchimp, ConvertKit, MailerLite, ActiveCampaign, SendGrid — these are data processors under Article 4(8). You need a valid DPA with your email platform. Many offer GDPR-compliant terms, but verify they include: processor obligations, data subject assistance, breach notification, and deletion upon contract termination.

Newsletter Data + Article 27

Even if you only send newsletters (no product sales), you process subscriber personal data. If any subscriber is in the EU, you need an EU Representative under Article 27. This is often overlooked because newsletter-only operations don’t seem “risky” — but it’s a legal requirement.

Compliance Checklist

1. Appoint EU Shield as EU Representative
2. Review consent mechanisms — implement double opt-in
3. Store consent records (timestamp, IP, method)
4. Sign DPA with email platform
5. Include EU Rep contact in Privacy Policy
6. Add EU Rep contact and processing details to newsletter signup form

Get started →