Under the GDPR, you must obtain affirmative permission before emailing marketing materials. That means that if you currently have a system that automatically subscribes users to email lists when they take certain actions (such as downloading an ebook) or if your system requires users to check a box in order to opt out of emails, this will need to be updated. If you’ve collected emails under old, non-GDPR-compliant systems, then you must obtain consent from everyone on your current list who is covered by the law before you send out future marketing emails. Likewise, in the event that someone withdraws consent to receive emails, you must ensure that no more emails will reach them (even if they were prepared and scheduled prior to the withdrawal of consent). If email subscriptions are linked to another activity, then rather than an opt-out box, you should require users to check an opt-in box to receive emails. If you obtain a lead’s email address through a referral, then you may send that lead a notification of the referral, but they must provide active consent before you send them marketing materials. Obtaining email contacts by purchasing or copying lists will be prohibited.
