Electronic Direct Marketing: When Is Consent Required?

Electronic direct marketing is a key part of sales and customer communications for many companies. However, newsletters, promotional emails and marketing automation only work when there is also a valid legal basis for sending them. Recently, automated marketing calls have attracted particular attention in supervisory practice. In practice, a company should answer three questions before sending a message: who is the recipient, does the message constitute marketing or customer communication, and what is the legal basis for sending it? Electronic direct marketing includes emails, text messages, multimedia messages, voice messages and automated calls used to market products or services to the recipient. The format of the message is not decisive. What matters is its purpose and content. If the objective is to promote the sale of a product or service, the message will generally constitute direct marketing.

A newsletter will usually constitute direct marketing if it contains offers, presentations of services, invitations to events, campaigns or other content intended to promote sales. Even content that appears purely informative may constitute marketing if its main purpose is to encourage the recipient to make a purchase, book a demonstration, download sales materials or attend a commercial event.

However, not every message sent to customers constitutes direct marketing. Order confirmations, delivery notifications, service interruption notices and other messages relating to the performance of a contract or the provision of a service are generally considered customer communications. If sales-oriented content is added to the message, it may nevertheless become direct marketing. For example, adding an offer to “upgrade to the premium version” to a service interruption notice may change how the message is assessed.

Marketing to a personal address generally requires prior consent

As a general rule, electronic direct marketing may only be sent to a natural person if they have given their prior consent. This is the main rule for electronic direct marketing aimed at consumers. The same applies, for example, to automated calling systems. Marketing through automated calls requires the recipient’s prior consent.

Consent must be freely given, specific, informed and unambiguous. In practice, the recipient must take an active step themselves, such as ticking a box to subscribe to a newsletter. A pre-ticked box, silence or the fact that the individual has not specifically objected to marketing does not constitute valid consent.

The requirement that consent be freely given does not necessarily prevent direct marketing consent from being linked to participation in a voluntary prize draw. The Finnish Data Protection Ombudsman has considered that consent to direct marketing requested as a condition for participating in a prize draw may be valid if participation is genuinely voluntary, choosing not to participate causes no detriment and the prize draw is not connected to a service that is essential to the data subject. However, the assessment must always be made on a case-by-case basis.

Separate consent is not always required. If a customer has purchased a product or service from a company and provided their electronic contact details in connection with the purchase, the company may, subject to certain conditions, market its own similar products or services to that customer.

However, this exception cannot be treated as a general authorisation for all marketing. It requires that the contact details were obtained directly from the customer in connection with a sale, that the marketing concerns the same company’s own products or services, and that the products or services being marketed are similar to the customer’s previous purchase. For example, if a customer has purchased a particular software service, it may, depending on the circumstances, be permissible to market additional features within the same service package or other similar services to them. The same contact details do not, however, permit the marketing of services offered by an entirely different group company, products offered by a business partner or products belonging to a completely different category.

The customer must also be given an easy and free opportunity to object to marketing both when their contact details are collected and in every subsequent marketing message.

In B2B marketing, it is not enough that the recipient works for a company

In business-to-business marketing, the assessment depends on the type of address to which the message is sent and the recipient’s role. As a general rule, electronic direct marketing may be sent without prior consent to general company addresses, such as info@company.com or sales@company.com. However, the message must still provide an opportunity to object to further marketing.

If the message is sent to a named individual, such as firstname.lastname@company.com, the sender must assess whether the product or service being marketed is materially related to the recipient’s professional duties. For example, marketing financial administration services to a person responsible for financial decision-making may be justified. The same message cannot, however, be sent as a precaution to every individual whose contact details can be found at the company.

The essential point is that the recipient’s role and the content being marketed must correspond with one another. A mere assumption that the recipient might be interested is not enough. In B2B marketing, it is also important to remember that a personal work email address does not become a freely available marketing channel simply because the address is publicly available or can be found on LinkedIn, a website or an event participant list. The sender must still be able to explain why the message sent to that particular person relates to their professional duties and why the marketing has been appropriately targeted.

Companies must be able to demonstrate consent

A company must be able to demonstrate the basis on which it sends electronic direct marketing. If the marketing is based on consent, the documentation should indicate at least when the consent was given, through which channel it was given, the type of marketing to which it applies and the information provided to the recipient when consent was requested.

Every electronic direct marketing message must include an easy and free method of objecting to the marketing or withdrawing consent, such as a functioning unsubscribe link. Withdrawing consent must be as easy as giving it. In practice, recipients should not be required to contact customer service separately or log in to a complicated system merely to unsubscribe from a newsletter.

Electronic direct marketing usually involves the processing of personal data, which means that the requirements of the General Data Protection Regulation also apply. The recipient must therefore be clearly informed about how their personal data is processed.

In practice, a company should ensure that its privacy notice explains who processes the personal data, the purposes for which the data is used, the legal basis for the processing, the source of the data, how long the data is retained and how the recipient can exercise their rights.

The regulation of electronic direct marketing does not prevent effective marketing, but it does require companies to handle the fundamentals carefully. Before launching a campaign, a company should verify where the recipients’ contact details came from, the legal basis for sending the messages and how marketing objections and withdrawals are implemented in practice.

Lila Kallio

Counsel

lila.kallio@legalfolks.fi

+358 41 465 1365

To receive our articles directly in your inbox, subscribe to the Folks newsletter here.