An EU directive set opt-in email consent well before GDPR existed

The revenue mechanism

Sixteen years before the GDPR took effect, the European Parliament and Council adopted Directive 2002/58/EC, commonly called the ePrivacy Directive, on 12 July 2002, and it was published in the Official Journal on 31 July 2002. Its Article 13 is the provision that still governs unsolicited commercial electronic mail across EU member states: it states that automated calling systems, fax machines and electronic mail may be used for direct marketing only for subscribers who have given prior consent, an opt-in standard rather than the opt-out default the US CAN-SPAM Act uses for equivalent mail. As a directive rather than a regulation, it did not apply automatically; member states were required to transpose it into their own national law, with a transposition deadline of 31 October 2003 set in the text itself.

What the documents show

Article 13 also carries a specific exception, often called the soft opt-in: a business that obtains a customer's electronic contact details in the context of a sale may use those details to market its own similar products later, provided customers are given a clear and distinct opportunity to object, free of charge and in an easy manner, both when the details are first collected and on the occasion of each later message. A separate EUR-Lex record for the same directive shows it was substantially amended by Directive 2009/136/EC on 19 December 2009, which reworked several articles including the cookie-consent provision at Article 5(3), and that a consolidated version dated from that later amendment is the version now read alongside the original 2002 text.

The assumptions exposed

Because a directive requires national transposition, the precise wording a newsletter operator must comply with is technically the implementing law of each member state, not the directive's own text, even though nearly all member states adopted rules closely tracking Article 13. The soft-opt-in exception is narrower than it is often assumed to be: it applies specifically to details collected in the context of a sale for the seller's own similar products, not to addresses collected for a newsletter sign-up with no purchase involved, a distinction easy to miss when a publisher assumes any prior relationship qualifies.

What to check before you rely on it

This is an editorial checklist and not legal advice for any specific member state. A publisher with EU subscribers should confirm whether their own consent-capture flow relies on the soft-opt-in exception or on affirmative opt-in consent, and should check the exception's own conditions rather than assuming any past customer relationship qualifies.

• Was the subscriber's address collected in the context of an actual sale, or only a newsletter sign-up?
• Is there a clear, free objection option offered both at collection and in every subsequent message?
• Has the relevant member state's own transposing law been checked, rather than only the EU directive's text?

The opt-in default this 2002 directive set predates GDPR by more than a decade and still supplies the consent standard GDPR's own marketing-email guidance builds on.