Can you email that customer your Black Friday offer? An EU soft opt-in permission sheet (ePrivacy Article 13(2), GDPR Article 21, Inteligo Media judgment) for small businesses writing campaigns with AI and their accountants
What you get: a finished email marketing permission sheet in three tabs: a contact list tab with one row per email address and a result formula that says SEND, SEND UNDER SOFT OPT-IN, CHECK NATIONAL RULE or DO NOT SEND; a campaign check tab with the six things every marketing email needs before it goes out, whether a person or an AI tool wrote it; and an objection log so nobody who said no gets your Black Friday email. Five made-up example rows show how it fills in.
Short answer: in the EU, marketing by email "may be allowed only in respect of subscribers or users who have given their prior consent" (ePrivacy Directive 2002/58/EC, Article 13(1)). The one exception, often called the soft opt-in, is narrow: you obtained the customer's email address "in the context of the sale of a product or a service", you are "the same natural or legal person", you market "its own similar products or services", and the customer was given the chance to object "free of charge and in an easy manner" when the address was collected and "on the occasion of each message" (Article 13(2)). Using an AI tool to write the email changes none of this.
Why this matters before Black Friday
Many small shops, studios and service firms will send their biggest campaign of the year around Black Friday (Friday 27 November 2026), often to a list exported from the shop or booking system and with text drafted by an AI writing tool. The ePrivacy Directive treats email as cheap to send but a burden on the recipient, which is why it requires prior consent as the rule (Recital 40). The existing-customer exception exists because "within the context of an existing customer relationship, it is reasonable to allow the use of electronic contact details for the offering of similar products or services, but only by the same company that has obtained the electronic contact details" (Recital 41).
The Court of Justice confirmed in Inteligo Media (Case C-654/23, judgment of 13 November 2025) that Article 13(2) is an exception to the consent rule that "must, therefore, be interpreted strictly" (para. 59), and set out its conditions in order: address obtained in the context of a sale, marketing of similar products or services "provided by that sender itself", and a free, easy objection at collection and in each message (para. 48). The same judgment held that a free account which gives access to some content and leads towards paid content can count as obtaining the address "in the context of the sale of a product or a service" (paras. 54 to 57 and 63), and that where an email is sent in line with Article 13(2), the lawful-processing conditions of Article 6(1) GDPR "are not applicable" to that use of the address (para. 69, reading Article 95 GDPR).
One limit: Article 13 is in a directive, so each Member State applies it through its own law. Article 13(3) leaves some choices to national legislation, and Article 13(5) says paragraphs 1 and 3 apply to subscribers who are natural persons, with Member States protecting the legitimate interests of other subscribers such as companies. Check your country's rule for business addresses.
Step 1: tab 1, contact list (one row per email address)
| Column | What to write | Source |
|---|---|---|
| A. Email address | As exported from your shop, booking or invoicing system | |
| B. Person or company | Person (any address of an individual, including a named work address such as anna@firm.example) or Company (a general address such as info@ or office@). Treating named work addresses as Person is our working rule, the safe side; your national rule may differ | Art. 13(5) ePrivacy |
| C. How you got it | Purchase (they bought from you), Free account (a free account leading to paid offers, as in Inteligo Media), Sign-up (newsletter form), Bought list, Scraped or Other | Art. 13(2); C-654/23 paras. 54 to 57 |
| D. Consent on file | Yes only if you can show when and how they agreed to marketing emails, otherwise No | Art. 13(1) ePrivacy; Art. 7(1) GDPR ("be able to demonstrate") |
| E. Same seller sends | Yes if the business that sold to them is the one sending. No for a sister company, a partner or a buyer of your list | Art. 13(2) ("the same natural or legal person"); Recital 41 |
| F. Similar to what they bought | Yes, No or Unsure. Example: a customer of your bike repair service and an offer on bike servicing is Yes; the same customer and a partner's insurance offer is No | Art. 13(2) ("its own similar products or services") |
| G. Chance to object given when collected | Yes if checkout or sign-up showed a clear, free way to say no to marketing emails, otherwise No | Art. 13(2); Recital 41 |
| H. Objected or unsubscribed | Yes or No, filled from tab 3 | Art. 21(2), 21(3) GDPR; Art. 7(3) GDPR |
| I. Result | =IF(H2="Yes","DO NOT SEND: objected",IF(D2="Yes","SEND: consent on file",IF(AND(OR(C2="Purchase",C2="Free account"),E2="Yes",F2="Yes",G2="Yes"),"SEND UNDER SOFT OPT-IN: opt-out link in every email",IF(B2="Company","CHECK NATIONAL RULE: company address","DO NOT SEND: no consent, soft opt-in not met")))) | Formula and labels are our working rule, not a legal test |
Bought and scraped lists never meet Article 13(2), because the sender did not obtain the address from its own customer in a sale. In the formula they fall through to DO NOT SEND for a person, or CHECK NATIONAL RULE for a company address.
Step 2: tab 2, campaign check (one row per email you plan to send)
Run this on the final text, after any AI drafting, before you press send.
| # | Check | Source |
|---|---|---|
| 1 | The sender on whose behalf the email is made is clear: your business name, not a disguised or unclear identity | Art. 13(4) ePrivacy; Art. 6(b) Directive 2000/31/EC; Recital 43 |
| 2 | The email is clearly identifiable as a commercial communication | Art. 6(a) Directive 2000/31/EC |
| 3 | Discounts, gifts or other promotional offers are clearly identifiable as such, and their conditions are easily accessible and presented clearly | Art. 6(c) Directive 2000/31/EC |
| 4 | There is a valid address where the recipient can ask you to stop | Art. 13(4) ePrivacy |
| 5 | For soft opt-in rows: a free, easy way to object is in this message | Art. 13(2) ePrivacy; Recital 41 |
| 6 | If this is your first communication with the person, the right to object to direct marketing is explicitly brought to their attention, clearly and separately from other information | Art. 21(4) GDPR; Recital 70 |
Two AI-specific points. If an AI tool segments the list or picks offers per customer, that is profiling related to direct marketing, and an objection covers it too: the right to object "includes profiling to the extent that it is related to such direct marketing" (Art. 21(2) GDPR). And pasting the customer list into an AI tool is a separate use of personal data from sending the email; check it with the related sheets linked below. Having a person read every AI-drafted email against checks 1 to 6 before sending is our working rule.
Step 3: tab 3, objection log
| Column | What to write | Source |
|---|---|---|
| Email address | The address that objected | |
| Date and channel | Unsubscribe link, reply, phone, in the shop, or an automated signal | Art. 21(5) GDPR (objection "by automated means") |
| Removed from marketing | Date removed from every marketing list and every tool that sends for you | Art. 21(3) GDPR: "shall no longer be processed for such purposes" |
| Copied to tab 1 column H | Yes or No | Our working rule |
Withdrawing consent must be "as easy to withdraw as to give consent" (Art. 7(3) GDPR). Keeping a short do-not-email list so an address is not re-imported from an old export is our working rule; keep only what you need for that.
Five made-up example rows
| Business and contact | Key answers | Result |
|---|---|---|
| Bike shop: customer who bought a bike online, Black Friday offer on servicing | Person, Purchase, no consent, same seller, similar Yes, opt-out at checkout Yes, not objected | SEND UNDER SOFT OPT-IN: opt-out link in every email |
| Same bike shop: same customer, offer from a partner insurer | Similar No, partner's product | DO NOT SEND: no consent, soft opt-in not met |
| Bookkeeping firm: newsletter subscriber who ticked a marketing box with date stored | Consent Yes | SEND: consent on file |
| Yoga studio: list of emails bought from a local directory | Person, Bought list, no consent | DO NOT SEND: no consent, soft opt-in not met |
| Web shop: info@ address of a business customer, unsubscribed last year | Objected Yes | DO NOT SEND: objected |
These rows are made up for illustration and do not describe any real business or person.
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Directive 2002/58/EC as amended by Directive 2009/136/EC (Articles 2(h), 13(1) to 13(6) and Recitals 40, 41, 43, as read on EUR-Lex), Directive 2000/31/EC (Article 6), Regulation (EU) 2016/679 (Articles 7(1), 7(3), 21(2) to 21(5), 95 and Recital 70) and the judgment of the Court of Justice of 13 November 2025 in Case C-654/23, Inteligo Media (paras. 48, 54 to 57, 59, 63, 68, 69). Article 94(2) GDPR reads references to Directive 95/46/EC as references to the GDPR. National laws implementing Article 13 differ, especially for company addresses (Art. 13(5)). The columns, result labels, formula and the Black Friday date are our own working aids. Checked on 28 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants, tax advisers and bookkeepers
Clients often ask in November whether they may email their whole customer list. Tab 1 gives them a row-by-row answer they can filter before the campaign, and tab 2 is a six-line check for the email itself. Use the same sheet for your own practice newsletter: Article 13(2) only covers your own similar services to people who became clients. Stay inside your professional rules and refer legal questions on.
Keep the result next to your AI tool list
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List the AI writing or email tool once, then attach this sheet as its evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: AI-generated marketing content label sheet · Reusing customer data in AI tools · Erasure and objection request sheet · Black Friday email list clean-up · 30-day lowest price log
Sources
- Directive 2002/58/EC (ePrivacy Directive), consolidated text: EUR-Lex; recitals in the original text: EUR-Lex
- Judgment of the Court of Justice of 13 November 2025, Inteligo Media, Case C-654/23: EUR-Lex
- Directive 2000/31/EC (Directive on electronic commerce): EUR-Lex
- Regulation (EU) 2016/679 (GDPR), official text: EUR-Lex
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.