The soft opt-in for online shops: emailing customers without a newsletter tick box

The general rule

Article 13 of the ePrivacy Directive requires prior consent for unsolicited electronic mail for direct marketing to natural persons, as implemented in each member state’s law. In practice, online shops ask customers to tick a box or confirm a subscription before sending newsletters and promotions.

The same article contains an exception, often called the soft opt-in. Where a business obtains a customer’s email address in the context of a sale, it may use that address to market its own similar products or services, provided the customer is clearly given the chance to object, free of charge and in a simple way, both when the address is collected and in every message.

The United Kingdom has a corresponding rule in the Privacy and Electronic Communications Regulations. Member state laws implement the exception with some differences in wording and interpretation, so the national rule for the target market should be checked.

The conditions

The soft opt-in is not a general permission to email anyone who has interacted with the business. Each condition narrows it, and all of them must be met.

A sale or negotiation

The address was obtained in the context of a sale of a product or service. Many national interpretations require an actual purchase; some accept negotiations towards a sale.

The same business

Only the business that obtained the address may use it, not partners, group companies or buyers of a list.

Similar products or services

Marketing must concern the business’s own products or services similar to those purchased.

Objection at collection

The customer must be given a clear, simple and free opportunity to refuse when providing the address, for example a checkbox to opt out at checkout.

Objection in every message

Every marketing email must include an easy way to unsubscribe.

Germany as an example of strict application

Germany implements the exception in section 7(3) of the Act against Unfair Competition, with four cumulative conditions: the address was obtained in connection with the sale of goods or services, it is used for direct marketing of the business’s own similar goods or services, the customer has not objected, and the customer is clearly informed at collection and with each use that they can object at any time without costs other than basic transmission costs.

German courts interpret similarity narrowly, generally expecting the advertised products to correspond to the purchased products or serve the same typical purpose. Warnings from competitors or consumer associations are a practical risk for shops that stretch the exception.

What the soft opt-in does not cover

It does not cover newsletter sign-ups without a purchase, visitors who created an account but never bought, people who entered a competition, leads from events, or addresses bought or rented from third parties. It does not cover marketing of unrelated products, such as a shop selling bicycles emailing about insurance from a partner.

It also does not replace data protection rules. Customers must receive transparent information about the use of their data, and personal data used for profiling or combined with tracking may need additional consideration. Email tracking pixels and personalisation based on browsing behaviour can raise separate consent questions.

In the UK, legislation passed in 2025 extended a similar option to charities for supporters, with commencement set by later regulations. This does not change the rules for commercial online shops.

Building it into checkout and CRM

The objection at collection is where most shops fail. A privacy policy link alone does not give a clear opportunity to object. The checkout needs a visible option near the email field, such as “Do not send me offers about similar products”, and the choice must be stored with the customer record.

The CRM or email platform needs a lawful basis field that distinguishes customers marketed under the soft opt-in from subscribers who gave explicit consent. Segments for similar-product campaigns should use purchase categories, and campaigns for unrelated products should go only to consented subscribers.

Unsubscribes must apply across all marketing systems quickly, and suppression lists must survive data imports and platform migrations. Many complaints arise when an old list is imported into a new tool and previously unsubscribed customers are mailed again.

Timing and relevance

Regulators do not set a fixed period after which a customer relationship expires, but marketing to someone who bought once many years ago is harder to justify as related to the sale. Many businesses set internal limits, such as stopping soft opt-in marketing if a customer has not bought or engaged for a defined period.

Relevance is also good business. Customers marketed about genuinely similar products engage more, complain less and protect sender reputation, which matters under mailbox providers’ requirements for high-volume senders. This article is a general overview and not legal advice.

Where this sits in what we do

This article covers one decision inside a wider engagement. The solution page sets out how that engagement runs, what it includes and what it costs to find out.

• E-commerce Growth System — Store, brand, advertising, lifecycle communication and order automation as one system — with local payment methods and the margin arithmetic checked before launch.
• Why more traffic rarely fixes a pipeline problem
• Lead scoring that sales will actually use
• Structured data for business websites: which rich results still work and which markup is wasted effort
• Failed subscription payments: reducing involuntary churn with retries, card updaters and better recovery flows
• All insight articles