Newsletters and GDPR: consent, unsubscribe and best practices

The key rules for sending a GDPR-compliant newsletter: collect consent, make unsubscribing easy and handle your contacts' data properly.

Updated October 23, 2026·4 min read

In short

For a newsletter to comply with the GDPR, your contacts must have given free and explicit consent (an unticked box), with exceptions in some countries for existing customers and similar products. Every email must offer a simple way to unsubscribe, you must be able to prove consent and keep data only as long as necessary.

The GDPR (General Data Protection Regulation) governs the use of personal data in Europe, including your contacts' email addresses. Email marketing is also covered by national rules on electronic communications, which can differ slightly from one country to another, and data protection authorities publish practical guidance. This guide sums up the rules to know so you can send newsletters with Upkyo Campaigns with peace of mind. It gives general explanations and does not replace legal advice suited to your situation.

The rule depends on who you are writing to.

Individuals (B2C): the principle is prior consent. The person must have agreed to receive your emails before the first send.
Existing customers: many European countries allow you to email someone who has already bought from you, about similar products or services, if they were informed and could object when their details were collected.
Business contacts (B2B): in many countries you can email a work address without prior consent if the message relates to the person's job and they are informed and can object. Rules vary, so check the country concerned.

In every case, each email must let people unsubscribe.

GDPR consent is freely given, specific, informed and unambiguous. In practice:

an unticked checkbox, or a clear action such as signing up for the newsletter yourself;
wording that says what the person will receive ("our monthly newsletter and offers");
consent separate from your terms of sale: you cannot make it a condition of ordering;
a link to your privacy policy.

Double opt-in (a confirmation email with a link to click) is not required by the GDPR, but it proves the address is real and its owner agrees.

Sort through your files: keep the contacts whose origin and consent you know.
Import only those contacts into a list, see Import your contacts.
Add a signup form to your website to collect new consents.
Write a clear information notice next to the form, with a link to your privacy policy.
Check in a test email that the unsubscribe link is present.
Identify yourself clearly in every email: company name and contact details.
Set a retention period and remove inactive contacts when it ends.

How Upkyo Campaigns helps

An unsubscribe link is added to every email.
Unsubscribed contacts are never emailed again.
Signup forms let you grow your list with contacts who opted in.
A blocklist blocks addresses you must never contact.

You remain responsible for where your contacts come from and how you use their data: you choose who you import and what you send.

Unsubscribing: what the law says

Unsubscribing must be simple, free and immediate. No account login, no mandatory survey, no delay of several weeks. Once someone has unsubscribed, they must not receive marketing from you again, even if their address is in an old file you import again. Keep that rule in mind with every import.

How long can you keep a contact's data?

The GDPR does not set a single figure: data must be kept no longer than necessary. Several European regulators recommend about three years after the last interaction from a prospect (click, reply, purchase). After that, delete the data or ask the person whether they want to stay subscribed. For customers, the period usually runs from the end of the business relationship.

Common mistakes to avoid

Buying or renting a list: those people did not consent to hear from you. It is legally risky and disastrous for deliverability, see Improve the deliverability of your email campaigns.
Automatically adding store customers to the newsletter without informing them.
Hiding the unsubscribe link in tiny, pale text at the bottom of a long message.
Keeping no record of the date and source of consent.

What about outside Europe?

Other countries have their own laws. In the United States, the CAN-SPAM Act notably requires clear sender identification, a non-misleading subject line, a physical postal address and a way to opt out. Canada, the United Kingdom and other countries have their own rules. If you email contacts abroad, check the local requirements.

Frequently asked questions

Do I need consent to send a newsletter?

For individuals, generally yes: they must have agreed before the first send. Many countries make an exception for existing customers and similar products. For business contacts, information and the right to object are often enough.

Is an unsubscribe link mandatory?

Yes. Every marketing email must offer a simple, free way to unsubscribe. In Upkyo Campaigns, an unsubscribe link is added to every email.

Is double opt-in required by the GDPR?

No, the GDPR does not require it. It is still good practice: it confirms the address exists and gives you solid proof of consent.

Does CAN-SPAM apply to me?

CAN-SPAM is a US law that applies to commercial emails sent to recipients in the United States. If part of your list is in the US, follow its rules: honest headers and subject, a postal address and a working opt-out.

How long can I keep my prospects' email addresses?

No longer than necessary. Several European regulators recommend about three years after the prospect's last interaction. After that, delete the data or ask them to confirm their subscription.