Data privacy for marketers: consent and cold outreach

Data protection is the part of marketing regulation most often treated as paperwork and most likely to produce a fine. The reason is that the obligations attach to ordinary marketing activity — building a list, sending an email, running an analytics script — rather than to anything exotic.

The two models, and why the difference matters

Most regimes fall into one of two shapes, and the shape decides whether your existing list is usable at all.

Consent-based. Marketing requires prior, informed consent, and the consent must be specific to marketing by that channel. This is the default shape in the European Union under the GDPR, with the ePrivacy rules governing electronic marketing on top.

Opt-out-based. Marketing is permitted to existing customers and sometimes to others, provided an unsubscribe is offered and honoured. This is closer to the shape in the United States, where sectoral rules and state privacy laws apply rather than a single federal standard.

What valid consent requires

The standard is demanding and it is usually not met by the design that collects most sign-ups.

• Freely given. Not a condition of using the service where the service does not depend on it, and not bundled with terms acceptance.
• Specific. Consent to receive a newsletter is not consent to receive partner offers, and a pre-ticked list of purposes is not consent.
• Informed. Who is collecting, for what purpose, and what happens to the data.
• Unambiguous. A positive action. Silence, inactivity or a preselected box does not qualify.
• Withdrawable. As easy to withdraw as to give. An unsubscribe that requires an email to a human is not as easy.

Cold outreach

This is where the regimes diverge most sharply, and where a small team is most likely to be acting unlawfully without knowing.

In the European Union, electronic marketing to individuals generally requires prior consent, with a narrow existing-customer exception that national law may tighten. In the United Kingdom the Privacy and Electronic Communications Regulations apply a similar consent test to unsolicited electronic marketing, enforced by the Information Commissioner.

In the United States, unsolicited commercial email is lawful with conditions — an accurate header, a truthful subject line, a physical postal address, and a working opt-out — under the CAN-SPAM Act, and state privacy laws add obligations above a threshold size.

For business-to-business outreach the position varies further. Some regimes treat a corporate address as personal data; others explicitly exclude it. The question to ask before any campaign is whether the recipient is an individual or an organisation in the destination market, because the answer changes the regime.

The rights you must be able to service

Four obligations appear in almost every modern regime and are the ones that audits actually test.

1. Access. A person can ask what data you hold about them and get it.
2. Erasure. A person can ask to be deleted, and deletion includes the marketing list as well as the record.
3. Objection. A person can require you to stop processing for marketing, and that must be absolute rather than balanced against your interest.
4. Portability and rectification. Data provided by the person can be obtained in a usable form, and inaccuracies corrected.

None of these is served by an inbox nobody reads. The practical requirement is a stated route, a named owner, and a response within the statutory period.

Analytics, cookies and tracking

Placing analytics or advertising identifiers on a device is usually governed separately from the marketing itself, and in the European Union the ePrivacy rules require consent for non-essential storage before it is set, not after.

The practical consequence is that a consent banner which loads the tracking before the choice is made has not obtained consent. Several national authorities in the European Union have assessed exactly this and found it non-compliant.

The general question of where the regimes differ is also treated in sponsorship disclosure, which follows a similar split. For how a list should be built, see defining your audience.

Cookies and consent, stated precisely

The distinction that matters is between storage that is strictly necessary and storage that is not. A session cookie that keeps a shopping basket working is generally exempt; an analytics or advertising identifier is not, and in the European Union the ePrivacy rules require consent before it is set.

The practical consequence is that a banner which fires the tracking script before the choice is recorded has not obtained consent, whatever it displays. Several national authorities have assessed exactly this design and found it non-compliant.

A defensible implementation records the choice, withholds non-essential storage until it is made, and offers a refusal as prominently as an acceptance. The last of these is the one most banners fail.