Today email marketing campaigns can be divided into the pre and post GDPR eras. Before GDPR came into effect, sending out email campaigns was straightforward. All you needed was an email contacts list and a tool to send these emails out. Today, global data privacy laws like the GDPR increasingly require organizations to obtain users’ consent before sending them any marketing communications. This has forced organizations to re-evaluate their email marketing practices.
Contents
What are Data Privacy Laws?
Governments around the world have implemented Data privacy laws with the intent of protecting an individual’s rights related to data privacy and security. In this case, individuals include business customers, employees or anyone who has interacted with a business in some shape or form. These laws outline rules regarding how businesses can collect, store, or share and use individuals’ personally identifiable data. In Europe, GDPR is one such law. Almost all aspects of online marketing, including email marketing, is covered by GDPR.
How Does GDPR Affect Email Marketing?
The GDPR is not as strict or harsh as it has been made out to be but it’s important to remember it does affect email marketing, in three critical areas.
Opt-in & Opt-out
The first one is about the opt-ins and opt-outs, and the consent regarding communications. All consent must be freely given, specific, informed, and unambiguous according to the GDPR, it is vital that you now articulate this by a ‘clear affirmative action’. This means that you can’t assume consent based on the prospects inactivity, and any pre-ticked box isn’t going to be enough to meet their standards. The prospects and customers must agree that their data can be used and that they can be contacted.
The Right to Be Forgotten
The GDPR is there for the citizens, and it has been designed to give them back control of how their data is collected and what it’s used for. This will include giving them the option of having their data removed from your database. By no means should you keep the data longer than needed and for anything else other than its intended purpose, businesses and organisations are no longer able to keep anyone’s data indefinitely. European citizens can ask you to remove their data when there is no legitimate reason to process their information when they withdraw consent for it to be used on the original terms or when it’s been unlawfully processed.
Processing Personal Data
The third change is the legal basis for processing personal data. This means you’ll need to do a better job collecting data and focus less on the unnecessary data you have collected for ill-considerate reasons. All data gathered from your customers and prospects must have a reason behind it, what do you intend to use it for, for how long would you need to use it. The intended purpose plays a massive role. You can no longer collect data for the sake of having it, by not following this your organisation could face large penalties.
Here’s how to stay in compliance with GDPR while improving the effectiveness of your email marketing efforts.
Sneaky tactics used by email marketers, where people didn’t know if they were opting in or out, are being tackled by the GDPR in the new standards for consent. GDPR prohibits organizations from sending direct marketing communications to individuals without first obtaining their consent. Such consent must be freely given, informed, specific, and unambiguous.
It’s therefore worth considering your current opt-in/consent process considering GDPR requirements for consent which are:
- Unbundled: consent requests must be separate from other terms and conditions. Consent should not be a precondition of signing up for a service unless necessary for that service.
- Active opt-in: pre-ticked opt-in boxes are invalid – use unticked opt-in boxes or similar active opt-in methods (e.g., a binary choice given equal prominence).
- Granular: give granular options to consent separately to different types of processing wherever appropriate.
- Named: name your organisation and any third parties who will be relying on consent – even precisely defined categories of third-party organisations will not be acceptable under the GDPR.
- Documented: keep records to demonstrate what the individual has consented to, including what they were told, and when and how they consented.
- Easy to withdraw tell people they have the right to withdraw their consent at any time, and how to do this. It must be as easy to withdraw as it was to give consent. This means you will need to have simple and effective withdrawal mechanisms in place.
- No imbalance in the relationship: consent will not be freely given if there is an imbalance in the relationship between the individual and the controller – this will make consent particularly difficult for public authorities and for employers, who should look for an alternative lawful basis.
What About Third-Party Mailing Lists?
Many companies use third party mailing lists for their email campaigns to save them the trouble of building these lists from scratch. However, using marketing lists from another source defeats the purpose of obtaining consent from the user and might get you in trouble from a data privacy and GDPR perspective. If you are desperate and end up purchasing a mailing list, it is a good idea to check whether the individuals consented to share their information and agreed to receive marketing emails. You should also match this list against your first-party data to filter out people who have previously objected to or opted out of your marketing emails.
If you are unsure if consent has been given, it is best not to use such lists. The penalties for breaching GDPR could be a very high cost to pay for this negligence.
Conclusion
Email marketing will continue to be an incredibly effective way for businesses to reach out to their customers, especially as privacy and control over data become the norm. Businesses that can collect, protect, and manage their data well will find themselves more successful in their marketing efforts.
