The same GDPR rules apply to online marketing as to other data processing, supplemented by specific rules from the Telecommunications Act for spam and cookies. Check each marketing tool or supplier to ensure responsible data handling, enable the most privacy-friendly settings, and obtain consent before emailing or tracking people, except for your own customers within reasonable limits. Record these choices in your privacy policy, processing register, and processor agreement.
Choose Marketing Tools with Privacy in Mind
Are you using tools like an email platform or social media? First, consider whether the supplier handles data responsibly. You can assess this in two ways:
Objective: Does the tool meet GDPR requirements?
Subjective: Does this align with your organization's privacy values?
Document these agreements in your processing register and processor agreement, even if your privacy policy already sets general boundaries. This ensures everyone in your organization knows who is responsible for what.
Enable the Most Privacy-Friendly Settings by Default
Every marketing tool offers privacy options, but you need to configure them properly. Discuss this with your IT department and always choose privacy by default: the setting that best protects your visitors' privacy.
Also apply data minimization: collect only the data you truly need. For each field in a form, ask yourself: Can this be done without this data?
Check Where Your Data Goes
Do your visitors' data go to countries outside the European Economic Area (EEA)? Then you must carefully check if adequate safeguards are in place to protect that data. Discuss this in advance with your privacy coordinator or Data Protection Officer (DPO).
What Rules Apply to Cookies and Spam?
The ePrivacy Directive from 2002 (opens in new tab), incorporated into the Telecommunications Act in the Netherlands, governs cookies and spam. This directive protects privacy in electronic communications: confidentiality of messages, rules for cookies, and a ban on unsolicited commercial emails (the spam ban).
There has been long discussion about a European ePrivacy Regulation to replace this directive. The European Commission withdrew this proposal in February 2025. Therefore, no new European regulation will be introduced. Instead, limited adjustments to existing rules will be made through the Digital Omnibus package, including aligning cookie rules more closely with the GDPR. The current ePrivacy Directive and Telecommunications Act remain your starting point.
When Can You Email or Message for Marketing?
Direct mailings, via email, SMS, app, or direct social media messages, are only allowed with consent or when contacting an existing customer.
For new contacts (not customers): Always ask for consent and keep proof of it for 5 years. If you can't prove someone gave consent, you may not contact them.
For existing customers: You may email based on legitimate interest, as long as the customer can reasonably expect it. Did someone only request information without becoming a customer? Then you may not send direct digital marketing unless that person gave separate consent.
For both groups, the following also applies:
Always offer a clear and easy way to unsubscribe, both when collecting data and in every message you send.
Make it clear who the sender is. Anonymous mailings are not allowed.
What About Advertising on Social Media?
Social media partly earn revenue through targeted advertisements. Platforms use data they collect themselves and sometimes data from external sources (data brokers). Because many parties are involved, it can be difficult for your organization to verify if everyone in the chain complies with privacy regulations.
An increasing number of organizations are building their own customer data using first-party cookies: data visitors leave on your website themselves. If a visitor does not consent to behavior tracking, you can still show contextual ads based on page content rather than personal behavior.
Therefore, consult with your privacy coordinator or DPO before launching a social media campaign. Check if the campaign aligns with your privacy policy and if social media targeting guidelines are followed.
A Practical Checklist for Your Marketing Activities
Review these points before starting a marketing activity:
Be Transparent
Always explain which data you use for what purpose.
Choose Privacy by Default
Enable the most privacy-friendly settings for every tool.
Check Your Supplier.
Sign a processor agreement and verify compliance.
Check Data Transfers Outside the EEA.
Ask your supplier about data transfers to third countries.
Request Consent When Needed.
Ensure you have a valid basis: consent or an existing customer relationship.
Keep Data Up-to-Date.
Regularly check if data is still accurate and delete it after its retention period.
Frequently Asked Questions
Can I Advertise Freely on Facebook or Instagram?Hide explanationShow explanation
No. You must first check if the campaign aligns with your privacy policy and complies with social media targeting guidelines. Discuss this with your privacy coordinator or DPO before starting.
Do I Always Need Consent for a Newsletter?Hide explanationShow explanation
For new contacts, yes. For existing customers, you can send a newsletter based on legitimate interest, provided the customer can reasonably expect it. If someone only requested information without becoming a customer, you still need consent.
What Is the Difference Between First-Party and Third-Party Cookies?Hide explanationShow explanation
First-party cookies collect data that visitors leave on your website themselves, with their consent. Third-party cookies track visitors across multiple websites, often for advertising purposes by third parties.
More articles per topic
