# EMAIL MARKETING — EU VARIANT

> **Region:** European Union, EEA (Iceland, Liechtenstein, Norway), United Kingdom (post-Brexit, UK GDPR is near-identical)
> **Primary law:** **GDPR (Regulation 2016/679) + ePrivacy Directive 2002/58/EC** (often called "Cookie Law" or "PECR" in UK)
> **Consent model:** **OPT-IN MANDATORY** — explicit, freely given, specific, informed, unambiguous (Article 4(11) GDPR)
> **Penalty:** Up to EUR 20,000,000 or 4% of global annual revenue, whichever is higher
> **Enforcement:** National Data Protection Authorities (CNIL France, ICO UK, BfDI Germany, Garante Italy, AEPD Spain, etc.)

---

## GDPR + ePrivacy — KEY REQUIREMENTS

### 1. Lawful basis for processing (Article 6 GDPR)

For email marketing, you need ONE of:
- **Consent** (Article 6(1)(a)) — most common, requires opt-in
- **Legitimate interest** (Article 6(1)(f)) — narrow, B2B only with hard caveats
- **Contract** (Article 6(1)(b)) — transactional emails (order confirms, password reset)

For B2C marketing, **consent is the safe default**. Legitimate interest for marketing is contested and risky.

### 2. Valid consent (the hard part)

Consent must be:

| Requirement | What it means |
|------------|---------------|
| **Freely given** | No pre-ticked boxes, no bundled consent (consent to email = consent to terms) |
| **Specific** | Separate consent for newsletter vs. partner offers vs. analytics |
| **Informed** | User knows who's collecting, why, retention period, rights |
| **Unambiguous** | Affirmative action required (clicking, ticking) — silence is NOT consent |
| **Withdrawable** | As easy to withdraw as to give |
| **Documented** | Log timestamp, IP, form version, consent text shown |

### 3. Double opt-in (recommended, not strictly required)

GDPR doesn't EXPLICITLY require double opt-in, but:
- It provides defensible proof of consent
- ePrivacy + national DPAs strongly recommend it
- All major ESPs default to it for EU lists
- Lower spam complaint rate, better deliverability

**Practical default:** Always use double opt-in for EU subscribers.

### 4. Right to erasure ("Right to be forgotten")

Subscriber can request deletion of all their data. You must:
- Hard-delete from active list (not just suppression)
- Delete from backups within reasonable cycle
- Confirm deletion within 30 days
- Notify any third parties you shared data with

**Suppression list** (which prevents re-mailing) is allowed AFTER deletion as it serves a legitimate interest (preventing accidental re-add).

### 5. Data Processing Agreement (DPA)

You MUST have a DPA with every ESP that processes EU data. Standard ESPs (Klaviyo, Mailchimp, Brevo) provide templates. Sign before first send.

### 6. Cross-border data transfers (post-Schrems II)

If your ESP stores EU data outside the EEA (e.g., on US servers):
- Use Standard Contractual Clauses (SCCs) — required since 2020
- For US transfers: rely on EU-US Data Privacy Framework (DPF, since July 2023)
- Document Transfer Impact Assessment (TIA) for high-risk transfers

**Easier path:** Use ESP with EU data residency (Brevo France, Mailchimp EU region, Klaviyo EU instance).

### 7. Data Protection Officer (DPO)

Required if you:
- Process special categories of data at scale (health, biometric, ethnic origin)
- Are a public authority
- Conduct large-scale systematic monitoring

For most SMBs running email marketing, DPO is NOT mandatory but recommended for transparency.

---

## ePrivacy Directive (PECR in UK) — soft opt-in

ePrivacy adds rules SPECIFIC to electronic communications (email, SMS, calls).

### Soft opt-in exception (Article 13(2) ePrivacy)

You CAN email existing customers without explicit consent IF:
- They bought a similar product/service from you
- You gave them a clear unsubscribe option at the point of collection
- You give them an unsubscribe option in every email
- The email is for similar products/services only

**Soft opt-in does NOT apply to:**
- Prospects who never bought
- B2B leads with no prior relationship
- Emails about unrelated products

---

## ESP picker for EU

| ESP | Why it fits EU |
|-----|----------------|
| **Brevo (Sendinblue)** | French company, EU servers default, GDPR-by-design |
| **Klaviyo (EU instance)** | EU data residency available; pre-built GDPR forms |
| **Mailchimp + EU DPA** | Mature DPA process; not EU-native but works |
| **GetResponse** | Polish company, EU-friendly, GDPR-compliant |
| **MailerLite** | Lithuanian company, EU servers, simple GDPR setup |
| **EmailOctopus** | UK-based, GDPR + UK GDPR |

**Avoid for EU-primary:** US-only services without DPA / EU data option.

---

## EU footer template (GDPR + ePrivacy compliant)

```
You're receiving this email because you opted in at [yoursite.com]
on [date opted in] (IP: [logged IP]).

[Brand Name]
[Legal entity, registration number]
[Street Address, City, Postal Code, Country]

[Unsubscribe (one click)] | [Update preferences] | [Privacy Policy]

You have the right to access, rectify, erase, restrict, or port your
personal data. Contact our DPO at [dpo@brand.com] or your local DPA.

(c) [Year] [Brand Name]. All rights reserved.
```

---

## Welcome series — EU 3-email template (with double opt-in)

```
Step 0: User submits form
   |--> Confirmation email (NOT in welcome series — separate)
   |    "Click to confirm your subscription"
   |
   |--> User clicks link -> CONFIRMED
   |
Welcome 1 (immediate after confirm): "Welcome — your benefit inside"
Welcome 2 (+2 days): "[First name], here's why we exist"
Welcome 3 (+4 days): "How [N customers] achieved [outcome]"
```

### Why the confirmation email matters

It is NOT counted as a marketing email (it's transactional). Required to PROVE consent in case of dispute.

---

## Send time (EU)

- **Tuesday-Thursday** strongest open rates
- **Time zones**: EU spans 4 time zones (GMT-1 in Azores to GMT+3 in Finland) — segment by country
- **Avoid:** Sundays (lower open in DE, NL), August (vacation in FR/IT/ES), Christmas week
- **B2B:** 9-11 AM local time
- **B2C:** 6-8 PM local time

---

## EU benchmarks (2025-2026)

| KPI | Poor | Average | Good | Excellent |
|-----|------|---------|------|-----------|
| Open rate | <20% | 20-28% | 28-38% | >38% |
| Click rate | <1.5% | 1.5-3% | 3-5% | >5% |
| Unsubscribe rate | >0.4% | 0.2-0.4% | 0.1-0.2% | <0.1% |
| Spam complaint | >0.1% | 0.05-0.1% | <0.05% | <0.01% |
| Email ROI | <EUR 25 per EUR 1 | EUR 25-35 | EUR 35-45 | >EUR 45 |

EU open rates run higher than US partly because consent quality is higher (only opt-in users) — strict law -> cleaner list -> better engagement.

---

## EU compliance checklist

### Pre-launch (legal foundation)

- [ ] Privacy policy with all 13 GDPR-required elements
- [ ] Consent form with un-ticked checkbox (no pre-tick)
- [ ] Double opt-in flow live and tested
- [ ] Consent log capturing timestamp + IP + form version
- [ ] DPA signed with ESP
- [ ] If non-EU ESP: SCCs in place + Transfer Impact Assessment
- [ ] DPO appointed (if required) or named contact for data subjects
- [ ] Cookie banner on all sites (ePrivacy)
- [ ] Sender domain authenticated (SPF + DKIM + DMARC)

### Per email send

- [ ] Subject line not deceptive
- [ ] Footer with company name, registered address, unsubscribe
- [ ] One-click unsubscribe (RFC 8058 List-Unsubscribe header)
- [ ] No spam triggers (CAPS, FREE, !!!)

### Monthly

- [ ] Process erasure requests within 30 days
- [ ] Audit consent log (sample 5% for completeness)
- [ ] Review unsubscribe rate; investigate if >0.4%
- [ ] Renew DPA / SCCs if changed
- [ ] Update privacy policy if data flows changed

---

## EU-specific risk flags

- **Buying lists:** ALWAYS GDPR violation; lists cannot have valid consent for you
- **B2B legitimate interest:** Risky; requires Legitimate Interest Assessment (LIA) on file
- **Cold outreach:** Generally non-compliant under ePrivacy; use targeted ad platforms instead
- **Adding webinar attendees automatically to newsletter:** Bundled consent — violation
- **Re-engaging dormant subscribers > 12 months silent:** Risky; suppress and ask for re-confirm
- **Sending from a non-EU server without SCCs:** Article 44 GDPR violation post-Schrems II
- **No DPO when required:** Article 37 violation; fines apply

---

## Country-specific notes within EU

| Country | Quirk |
|---------|-------|
| **Germany** | Strictest enforcement; Bundesdatenschutzgesetz adds local rules; DSGVO awareness very high |
| **France** | CNIL very active; cookie banner enforcement heavy; ePrivacy strict |
| **Italy** | Garante issues big fines (recently to OpenAI for ChatGPT) |
| **Spain** | AEPD active; LOPDGDD adds national rules |
| **Netherlands** | Autoriteit Persoonsgegevens active on dark patterns |
| **UK** | Post-Brexit UK GDPR + Data Protection Act 2018 + PECR; ICO enforces |
| **Ireland** | DPC oversees most US Big Tech (Meta, Google, Apple HQs) |

---

*EU Variant | Global Skill 14 | Over Powers Agency | v1.0.0*
