# REFERRAL PROGRAM — EU VARIANT

> **Region:** European Union + UK (UK post-Brexit similar but separate authority)
> **Email rules:** **GDPR opt-in MANDATORY** for all email referrals to non-customers
> **SMS rules:** **GDPR + ePrivacy Directive** — opt-in mandatory; auto-SMS to referee illegal without consent
> **Endorsement rules:** EU Consumer Protection Directive + national rules (Germany strict, France formal disclosure)
> **Privacy:** GDPR (max €20M / 4% revenue penalty)
> **Cash incentives:** Allowed; tax implications (national level)

---

## GDPR — The dominant framework for EU referrals

### What GDPR says about referral programs

GDPR treats the referee's data (email, phone) as personal data. Sending unsolicited messages to a referee is processing without lawful basis = violation.

**Lawful bases that COULD apply:**
- **Consent (Art. 6.1.a):** Hard to obtain at referral moment (referee doesn't see consent flow)
- **Legitimate Interest (Art. 6.1.f):** May apply if referrer is genuinely sharing personally — gray area, depends on national authority
- **Performance of contract (Art. 6.1.b):** Doesn't apply to non-customers

**Practical interpretation:**
- Referrer-initiated, native share button (uses referrer's own messaging app) = lower risk
- Auto-send from your platform to referee = NEEDS CONSENT
- Unique referral link sharing (no auto-message) = SAFE
- Bulk referral CSV import "of friends" = HIGH RISK without consent

### Penalty risk

GDPR fines: up to €20M or 4% global annual revenue (whichever higher).

National enforcement varies:
- **Germany (BfDI):** strictest, frequent fines
- **France (CNIL):** very active, often fines tech companies
- **Ireland (DPC):** EU's de facto enforcer for US tech
- **UK ICO:** post-Brexit but maintains GDPR-equivalent (UK GDPR + Data Protection Act 2018)

---

## Compliant referral program structures for EU

### Approach 1: Referral link only (SAFEST)

**How it works:**
1. Customer gets unique referral link
2. Customer shares link via THEIR OWN channels (email, WhatsApp, social)
3. Referee clicks → lands on your site → signs up → reward credits both

**Why safe:** No data leaves your platform. No auto-message to referee.

**Examples:**
- Dropbox: "Share your link" (the original)
- Revolut: "Invite friends" (UK/EU compliant)
- N26: similar pattern

### Approach 2: Native share button

**How it works:**
1. Customer clicks "Share via WhatsApp/SMS/email"
2. Their device opens THEIR messaging app
3. Pre-filled message includes referral link
4. The customer hits send (their action, their channel)

**Why safer:** It's the customer's communication, not yours.

### Approach 3: Form to invite (NEEDS CARE)

**How it works:**
1. Customer enters friend's email
2. Your platform sends email to friend

**Compliance requirements:**
- Disclose to customer that friend's data will be used (transparency)
- Single email max (no follow-ups without consent)
- Email content clearly identifies as initiated by [Customer Name]
- Opt-out instant honor

**Risk:** German DPAs particularly skeptical of this; French CNIL has fined for friend-import practices.

### Approach 4: NEVER — Bulk import

Never accept CSV/contacts upload to email "everyone" — automatic GDPR violation.

---

## Email rules for EU referrals

### Cold email from your platform to referee

**Default rule:** NEEDS CONSENT.

**Workarounds (limited):**
- B2B context: legitimate interest may apply (Art. 6.1.f) — reasonable expectation, recipient can object
- Explicit referrer-as-mediator messaging: "Your friend [Name] thought you'd like..."
- Single touch only — no follow-up email without explicit consent

### Required email elements (ePrivacy + GDPR)

- Sender clearly identified
- Physical address of business
- Lawful basis for sending (referenced in privacy policy)
- 1-click unsubscribe (ePrivacy + Yahoo/Gmail rules)
- Plain language
- No misleading subject lines
- Right to be forgotten — instant honor on request

### Double opt-in

For long-term referee engagement (not just one email):
- Single opt-in email with clear "Click to confirm subscription"
- No further marketing until confirmed
- Especially recommended for Germany/Austria

---

## SMS rules for EU referrals

GDPR + ePrivacy Directive: **same as email — opt-in MANDATORY**.

**Penalty examples:**
- TIM (Italy) fined €27.8M for unsolicited marketing calls/SMS (2020)
- Vodafone Italy fined €12.3M similar issue (2020)

**Practical:** Auto-SMS to referee = illegal without consent. Use share button (referrer's own SMS app) instead.

---

## Endorsement / disclosure rules

### EU Consumer Protection Directive (UCPD)

Misleading commercial practices banned. Referrers compensated for endorsement = "material connection" → must disclose.

### National variations

- **Germany (UWG):** strictest — must clearly mark "Werbung" or "Anzeige" if compensated
- **France (DGCCRF):** disclosure required, "publicité" tag
- **Italy (AGCM):** "post sponsorizzato" / "ad" tag
- **UK (CMA + ASA):** "#ad" or "#advert" tag (post-Brexit but mirrored EU rules)

### Practical disclosure

```
Em recebeu este e-mail porque [Friend Name] indicou você. [You — Brand] paga uma comissão de [X] a [Friend Name] por cada amigo que se cadastrar.

You received this email because [Friend Name] referred you. [You — Brand] pays [Friend Name] a referral commission of [X] for each friend who signs up.
```

(Provide in local language for each country.)

---

## Cash incentives in EU

**Generally allowed**, but tax implications for both customer and you (the brand):

- **Customer:** Income tax may apply on referral cash earnings (varies per country — most don't tax small amounts)
- **You (the brand):** VAT treatment varies; consult tax advisor
- **Lottery rules (Germany):** if referral structure is purely lottery-based, registration with state authority may be required

**Safer alternatives:**
- Account credit (no income tax for referrer)
- Discount voucher (no income tax)
- Subscription extension (free month for referrer)

---

## Tracking & attribution (GDPR-compliant)

### Without third-party cookies

- First-party tracking via your domain (server-side cookies)
- Unique referral codes (URL params + first-party cookie)
- Self-reported attribution at signup ("How did you hear about us?" → "From a friend's referral")

### Tools (EU-friendly)

| Tool | Origin | GDPR-friendly |
|------|--------|---------------|
| **ReferralCandy** | Singapore (EU data centers) | ✅ |
| **Friendbuy** | US (with EU regions) | Partial — verify DPA |
| **InviteReferrals** | India | Verify EU residency |
| **GrowSurf** | US | Verify DPA |
| **Talon.One** | Germany | ✅ Native EU |

**Recommendation:** Talon.One for native EU; ReferralCandy for international with EU compliance.

---

## EU referral output template addition

```markdown
## EU Compliance Status

- [x] Referral mechanism: link-share + native share button (no auto-SMS to referee)
- [x] GDPR opt-in flow for any email touch
- [x] Privacy policy updated with referral data processing description
- [x] DPA signed with referral platform
- [x] Local language disclosure (DE/FR/ES/IT)
- [x] 1-click unsubscribe (ePrivacy)
- [x] Right to be forgotten flow tested
- [x] Tax advisor consulted on cash incentives
- [x] Cookie banner respects referral cookie consent
```

---

## Common pitfalls (EU-specific)

1. **Auto-emailing referee from platform** without consent → GDPR violation (max €20M)
2. **Auto-SMS to referee** → ePrivacy violation
3. **Bulk CSV import** of contacts → instant violation
4. **No DPA with referral platform** → no lawful basis
5. **Same English copy** as US → no German "Werbung", no French "publicité"
6. **Cookie tracking before consent** → cookie consent violation
7. **No 1-click unsubscribe** → ePrivacy violation
8. **Storing referral data in US-only servers** → Schrems II issue
9. **Lottery-style structure unregistered** in Germany → state-level fine
10. **No transparency** about referrer compensation → UCPD violation

---

## Quick-wins (EU)

- Use link-share + native share button (legally safest, still effective)
- Talon.One for native EU referral platform
- Local language disclosure copy (DE/FR/ES/IT)
- Account credit instead of cash (avoids tax complexity)
- Server-side first-party tracking (cookieless-friendly)
- Translate referral landing page to user's local language (conversion +20-40%)
