Direct Marketing

Legal Framework

Direct marketing processing sits at the intersection of two legal regimes. Under the GDPR, Article 21(2) grants data subjects an unqualified right to object to direct marketing processing, while Article 21(3) makes that right absolute — no balancing test applies. The ePrivacy Directive's Article 13 imposes a consent requirement that is stricter and more specific, governing the channel through which marketing reaches the data subject.

The ePrivacy regime operates as lex specialis for electronic communications. Article 13(1) requires prior consent for marketing via automated calling systems, fax, or electronic mail. The soft-opt-in exception in Article 13(2) permits a controller to market its own similar products to existing customers using contact details obtained during a sale, provided an opt-out is offered at collection and in each subsequent message.

"for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent."
— ePrivacy Art. 13(1)

Under the GDPR, the controller must inform the data subject of the right to object at the latest at the time of the first communication, clearly and separately from other information.

Key Developments

The CJEU's January 2025 ruling in Mousse (C‑394/23) confirmed that direct marketing can constitute a legitimate interest under Article 6(1)(f), but this does not displace the absolute objection right in Article 21(2)–(3):

"the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest"
— CJEU, Mousse, C‑394/23, ¶54

Dutch courts have reinforced that once a data subject objects, the controller cannot override that objection by invoking promotional interests. In a 2024 enforcement case, the court accepted that promotional and advertising interests are equivalent to "direct marketing," triggering the absolute objection right:

"Derde-partijen wijzen erop dat zij, als betrokkenen, een absoluut recht van bezwaar hebben ten aanzien van de verwerking ten behoeve van direct marketing."
— Rechtbank, AVG-handhaving, ¶8.2

The EDPB's consent guidelines further clarify that consent bundled with service delivery — such as a bank conditioning account access on marketing consent from third parties — is invalid, because refusal must not trigger denial of service or fee increases.

Status of the Debate

This topic is actively contested in court. The core framework — consent under ePrivacy, legitimate interest under GDPR, and the absolute objection right — is well established. What remains disputed is the boundary between lawful interest-based marketing and unlawful processing, particularly where controllers attempt to reclassify marketing as service-related communication to avoid the consent requirement. The Mousse ruling narrows but does not fully resolve this question. A future CJEU reference directly addressing whether relationship management communications fall outside "direct marketing" would clarify the perimeter. Meanwhile, DPAs are enforcing aggressively, with fines issued for both consent failures and inadequate opt-out mechanisms.

Practical Guidance

• Map your channels to the correct legal basis: Electronic mail and automated calls require prior consent under Article 13(1) ePrivacy; the soft-opt-in under Article 13(2) applies only to your own similar products sold to existing customers.
• Implement absolute opt-out: Under Article 21(3) GDPR, an objection to direct marketing must halt all processing for that purpose immediately — no balancing test, no exceptions.
• Disclose the objection right at first contact: Article 21(4) requires explicit, clearly separated notice of the right to object no later than the first communication with the data subject.
• Do not bundle marketing consent with service delivery: If refusal to consent to marketing results in denied service or higher fees, the consent is not freely given and is invalid.
• Never swap lawful bases mid-stream: If consent obtained under prior legislation does not meet GDPR standards, refresh it compliantly or cease processing — switching to legitimate interest is not permitted.