Sending marketing emails to existing customers is a popular practice. Without explicit consent, such mailings are only permitted under strict conditions. The relevant provision in this regard is Article 13 of the e-Privacy Directive in conjunction with the respective national implementations in the EU Member States.

From the Complaints Office’s practical experience and work, we know that the conditions for the existing customer exception frequently raise questions. This blog post deals with the prerequisite: the existence of a customer relationship.

First of all: what is Article 13 of the e-Privacy Directive all about?

This EU regulation is a special provision with priority of application and deals with unsolicited messages. According to Article 13(1) of the Directive, electronic mail for the purposes of direct marketing, i.e. advertising emails and newsletters, is only permitted with prior consent. Article 13(2) of the Directive contains an exception to this principle: a natural or legal person may, if they have obtained a customer’s email address in connection with the sale of a product or service, use it for direct marketing of their own similar products or services. However, the customer must be given a clear and unambiguous opportunity to object to such use, free of charge and without difficulty, at the time of collection and on each occasion the email address is used. Furthermore, the customer must not have objected to this use prior to the sending of the marketing email.

Prerequisite: An existing customer relationship

The applicable legal framework stipulates as a prerequisite that the email address used or to be used was collected in connection with the sale of a product or service. In short, a customer relationship must exist.

The CJEU also addressed the requirements for a potential customer relationship, as well as the relationship between the e-Privacy Directive and Article 6 of the GDPR, in the Inteligo Media case (C-654/23).

What had happened? A user had set up a free account on the online platform of the publisher of an online media outlet. This account gave the user the right to access a certain number of the outlet’s articles free of charge, to receive a daily newsletter by email free of charge, and to access additional articles and analyses from the outlet for a fee. The newsletter contained a summary of the legislative developments covered in the outlet’s articles, including hyperlinks to those articles.

In this context, the CJEU examined the concept of a sale. It first noted that, according to the general definition, the payment of a price or remuneration is required. In the next step, the CJEU applies its reasoning to the e-Commerce Directive¹: the remuneration for a service provided by a provider in the course of its economic activity is not necessarily paid by those who benefit from it. This is particularly the case where a provider provides a service free of charge for advertising purposes for goods or services it offers. The costs of this activity are then incorporated into the selling price of these goods or services. In other words: money does not necessarily have to have changed hands between the recipient and the sender of the marketing email. A free service, refinanced through advertising, is regarded as a customer relationship.

This interpretation is also consistent with the objective pursued by Article 13(2) of the e-Privacy Directive, which is to allow an exception in cases where the contact information has been obtained in the context of a – not further specified – customer relationship.

The facts of the case at hand therefore fall under Article 13(2) of the e-Privacy Directive. The email address was obtained ‘in connection with the sale of a product or service’, and the sending of the newsletter constitutes the use of email “for direct marketing” of “similar products or services” within the meaning of Article 13(2) of the e-Privacy Directive.

Conclusion:

Consent is not always required for sending marketing emails and newsletters. Under certain conditions, existing customers may be contacted with marketing emails even without consent (existing customer exception). However, the application of the existing customer exception is subject to strict conditions:

• an existing customer relationship,
• direct marketing of the sender’s own similar products or services,
• a notice regarding the right to object at any time (upon collection and every use of the email address), and
• no objection.

In practice, however, compliance often fails due to a lack of the necessary information on the right to object and the similarity of products.

The CJEU has confirmed that Article 13(2) of the e-Privacy Directive is a specific provision which takes precedence over the general provisions of the GDPR. When using an email address to send a marketing message in accordance with Article 13(2) of the e-Privacy Directive, there is therefore no need for an (additional) assessment of the lawfulness of the processing of personal data under Article 6(1) of the GDPR. Consequently, no additional consent is required. However, the sender cannot base the sending of a marketing email on any legitimate interest under Article 6(1)(f) of the GDPR either.

Information on the existing customer exception can also be found in the CSA Certified Senders’ Guidelines for Permissible Email Marketing, which you can access at https://certified-senders.org/email-directive/1-foreword/.

[1] Judgment of 15 September 2016, Mc Fadden, C‑484/14, EU:C:2016:689, paragraphs 41 and 42, and the case law cited therein