GDPR day one: consent, re-permission and your email list

GDPR replaces the 1995 Data Protection Directive and raises the ceiling on fines to 20 million euros or 4 percent of global annual turnover, whichever is higher. It does not change the basic mechanics of email: you still need a lawful basis, you still need an unsubscribe link, you still need to honor requests promptly. What it tightens is the definition of consent and the proof you must keep.

The consent test, in plain language:

• Freely given. No bundling consent into a purchase, download or terms acceptance. A separate, unticked box.
• Specific. Consent to "marketing emails about our products" is specific. Consent to "communications from us and selected partners" is not.
• Informed. The person knows who is collecting the data, what it will be used for, and that they can withdraw at any time.
• Unambiguous. A clear affirmative action. Pre-ticked boxes, silence and inactivity do not count.
• Recorded. You can show who consented, when, how, and what they were shown.
• As easy to withdraw as to give. One click to unsubscribe, honored without delay.

Legitimate interest is the other basis people are discussing for B2B email. It is a real option for existing customer relationships and for business contacts where the message is relevant to their role, but it requires a documented balancing assessment and it does not override the existing e-privacy rules in individual member states, several of which already require opt-in for electronic marketing. For a consumer list, do not rely on it.

Before sending anything, segment your database by how each address was collected. Most businesses end up with four groups.

The mistake several well-known brands have made this spring is sending a re-permission email to the entire list. Every person who already consented properly and ignores the email is now lost, because you asked a yes-or-no question and silence means no. One major UK retailer is reported to have cut its list by more than two thirds this way. Only ask the people whose consent you cannot prove.

Expect 10 to 30 percent of recipients to re-opt in. The range is wide, and where you land depends on the relationship and the execution.

1. Start with a clean send. Remove hard bounces and anyone who has not opened in 18 months first. They will not respond, and their presence drags down deliverability for the people who might.
2. Write the subject line as a benefit, not a legal notice. "Keep getting our Tuesday deals" outperforms "Action required: GDPR consent update."
3. One ask, one button. The email exists to get a click on a button that records consent. Keep it to three short paragraphs.
4. Send a sequence, not a single email. Three sends over two to three weeks to non-responders, with different subject lines, typically doubles the final yes rate compared with one send.
5. Land on a page that confirms consent and records it. The confirmation page is where the timestamp, IP address and consent text are written to the record. If your email tool does not do this natively, use its GDPR-enabled form.
6. Add a reason to say yes. A discount, a useful download, or early access gives fence-sitters a push. Keep it modest; the aim is a genuine yes.
7. Set a hard deadline and honor it. After the final send, suppress everyone who did not respond. Keep a minimal suppression record so they are not accidentally re-added later.

For a mid-sized US retailer with 60,000 EU addresses of mixed provenance, a realistic outcome is a list of 8,000 to 18,000 who re-consented plus whatever portion of the base already had valid consent. Revenue per send usually holds up better than the headline numbers suggest, because the people who stayed are the people who read.

The re-permission campaign is a one-time clean-up. The permanent work is in how new addresses arrive.

Forms. Every signup form needs an unticked consent checkbox or, for a form whose only purpose is a newsletter signup, a clear statement that submitting subscribes you. Link to a privacy notice written in plain language. Separate consent for separate purposes: newsletter, product updates and partner offers are three boxes, not one.

Double opt-in. Not strictly required by the regulation, but it produces a clean record and keeps bots and typos out of the list. Most major email platforms turned it on by default for EU-facing forms this year. Accept the small drop in signups.

Checkout. A purchase does not imply marketing consent. Add a checkbox at checkout, unticked, with a plain description. The soft opt-in rules in some countries allow marketing to customers for similar products, but the checkbox removes the ambiguity and gives you a record.

Lead magnets and gated content. Giving someone a PDF in exchange for an email address does not entitle you to add them to the newsletter. Deliver the PDF, offer the newsletter as a separate choice.

Events and sales conversations. A business card is not consent. Follow up with a single email that asks, then stop if there is no reply.

Records. Your email platform should store the consent timestamp, the source form, the IP address and the exact wording shown. Export this periodically. If a regulator asks, you want to answer in an afternoon, not a month.

Email is one part of the regulation. The items that most often get missed in marketing teams:

• A privacy notice that actually describes what you collect through forms, analytics, pixels and your email platform, and how long you keep it.
• A data processing agreement with each vendor that touches personal data: email provider, CRM, analytics, ad platforms, your agency. Most major vendors published standard terms in April and May.
• A process for subject access requests and erasure requests, with a 30-day clock. Know how to find one person across every system and delete them.
• Cookie consent for tracking that is not strictly necessary. The rules here sit partly in the older e-privacy directive, and enforcement expectations vary by country, but a visible banner with a real choice is the current baseline.
• A named person responsible. A formal data protection officer is only mandatory for certain organizations, but someone has to own the questions.

Emailing the whole list to re-confirm. Covered above. It is the single most expensive error available.

Using legitimate interest as a loophole for consumer lists. It is not one, and the local e-privacy rules in Germany, Italy and elsewhere already require opt-in.

Treating US addresses as out of scope and EU addresses as toxic. Apply one standard. Consent-based lists perform better everywhere, and CAN-SPAM compliance is easier when the GDPR work is done.

Hiding the unsubscribe link. Withdrawal must be as easy as consent. A small grey link in a footer is tolerated; a login wall is not.

Deleting everything in a panic. Customers with a genuine recent relationship can usually be kept. Segment before you delete.

Consent is a growth question as much as a legal one, because the quality of the list determines what every email program can earn, and it touches brand, web and the systems behind them. Discover audits where every address came from, what the forms say, what the email platform records and which vendors hold data. Plan produces the segmentation, the re-permission sequence, the new form and checkout language, and a records process your team can run without us. Build implements the forms, the double opt-in flows, the preference center and the vendor agreements, and runs the campaign. Improve is the ongoing part: deliverability, segmentation and the automation that keeps a smaller, consented list producing more than the old bloated one did.

The content program engagement is the representative pattern. A publisher with a decade-old subscriber base of uncertain provenance needed to keep its European audience without exposing the business. We segmented by source, ran a three-step re-permission sequence only to the addresses that needed it, rebuilt every capture point with granular consent and double opt-in, and set up a preference center so readers could choose topics instead of leaving entirely. The list shrank, open and click rates rose sharply, and the editorial team gained a clear picture of what each segment actually wanted to read.