Email marketing law in the Netherlands: opt-in, GDPR and the spam law

Telecommunications Act and GDPR: the two laws that apply to email marketing

Two legal frameworks determine what you can and cannot do. They complement each other and both apply, whether you run a web shop, a SaaS company or a local business.

Telecommunications Act (art. 11.7): are you allowed to send this email at all?

The Telecommunications Act contains the Dutch spam ban. The core is simple: you only send commercial emails to people who have given permission in advance (the opt-in principle). This covers not only promotional emails but also charitable and idealistic messages.

Requirements per email:

Recognisable sender name and a valid reply address
Clear identity: who are you and why are you emailing someone?
A working unsubscribe link (one click, no obstacles)
No misleading subject lines or sender names

GDPR: how do you process email addresses lawfully?

As soon as you use email addresses, or track opens and clicks, you are processing personal data. The GDPR (known in Dutch as the AVG) then determines how you organise that properly. You need a valid legal basis, you must be transparent and you must respect recipients' rights.

In practice

The Telecommunications Act determines whether you may send email. The GDPR determines how you document and organise it. Both apply, and two regulators enforce them: the ACM (spam law) and the Dutch Data Protection Authority (GDPR).

May I email someone? The decision tree for business owners

No time for the whole story? Work through these five steps:

Step 1
Is it a marketing email, newsletter, promotion or fundraising message?Yes: continue.
Step 2
Has the recipient explicitly opted in?Yes: you may email them (with an unsubscribe link).
Step 3
No opt-in? Is there a recent customer relationship and is it about similar products or services?Soft opt-in: that is allowed (with opt-out).
Step 4
No opt-in and no customer relationship?Do not email. First ask for permission via a form.
Always
If someone unsubscribes or objects, you stop immediately.Add the address to the suppression list.

May I email this email address? All scenarios at a glance

Which situation do you recognise? This overview gives you an immediate answer per scenario, including what you need to record as proof.

Situation	Allowed?	Conditions	Record
B2C newsletter after sign-up	Yes	Opt-in + unsubscribe link	Form text, date, IP, log
Existing customer, similar product	Yes*	Soft opt-in + opt-out in every email	Purchase date + proof of the relationship
B2B one-to-one approach (cold)	Sometimes	Relevant, with context, offer an opt-out	Source + response to objections
B2B newsletter (bulk)	Risky	Only safe with opt-in	Opt-in logs + segmentation
Service message without promotion	Yes	Necessary for the service	Relationship + purpose of the message
Service message with promotion in it	Risky	It becomes marketing: follow the opt-in rules	Opt-in/soft opt-in + unsubscribe link
Bought or rented list	Never do this	No consent, always complaints	n/a: never use this
Business card from an event	Not just like that	No opt-in: always send a double opt-in confirmation	Proof of consent required

* Soft opt-in: only under the conditions in the Soft opt-in section.

Opt-in for email marketing: when is consent valid?

Consent is only valid if it is freely given, specific, informed and unambiguous. This is where it goes wrong most often in practice.

Invalid opt-ins (common mistakes)

A pre-ticked box on the sign-up form
Consent hidden in the terms and conditions or small print
Vague text such as 'I agree' without saying what someone will receive
Adding an email address from a business card straight to the list without confirmation
Scraping addresses from LinkedIn or websites (never valid)

What a valid opt-in looks like

Active action: someone fills in a form themselves or ticks an (empty) box
Clear text: what will someone get, how often and from whom?
Opt-in separate from other consents (do not bundle in one tick box)
Record: source, date/time, IP address, form text and, for double opt-in, the confirmation too

Is double opt-in mandatory for email marketing in the Netherlands?

Not required by law, but almost always the smartest choice. Double opt-in proves consent better, produces cleaner lists (no typos, no fake addresses) and reduces spam complaints. What is more, a list full of people who really said yes twice converts better than a large list of people on the fence.

Pro tip

Add one sentence to every email explaining why someone is receiving it, for example: 'You are receiving this because you signed up at mailcamp.nl on 3 January.' This significantly reduces spam reports.

Soft opt-in: emailing existing customers without explicit consent

Soft opt-in is the legal exception that allows you to send marketing to existing customers without a separate opt-in. But it is not a free pass, and the exception is often abused.

The four mandatory conditions for soft opt-in

The email address was obtained during an earlier sale or service
You only email about your own, similar products or services
You offer an opt-out when collecting the address and in every follow-up email
You stop immediately after an unsubscribe or objection

What counts as 'similar'? Practical examples

Customer bought a software licence → email about updates and upgrades: similar
Customer attended a training course → invitation to a follow-up course: similar
Customer bought product A → newsletter about a completely different category: not similar
Web shop order → newsletter from another brand in the same group: not similar
Business card exchanged at a trade fair → adding to the newsletter list: never valid just like that

Email marketing B2B: what are the rules for business mailings?

Many business owners think B2B email marketing is 'free'. That is a dangerous misconception that regularly leads to complaints and GDPR violations.

Business email addresses are almost always personal data

An address such as jan.devries@companyname.nl can be traced to a person. That means it falls under the GDPR as normal. You must be transparent, offer an opt-out and stop when someone objects, even if it is a business address.

Sending a B2B newsletter: opt-in is the safest basis

For a regular B2B newsletter, opt-in is almost always the safest and most effective basis. Not only legally, but also practically: recipients who have signed up themselves open more often and complain less.

Cold B2B email: when is it possible?

With a direct, personalised one-to-one approach there is in practice a little more room. But strict conditions then apply:

Demonstrably relevant to that person's job or role
A short explanation of why you are getting in touch (provide context)
A clear opt-out: 'If you no longer wish to receive this, let me know'
Never bulk sending from an email marketing tool: that is spam
Take objections seriously and keep a record of them

Note: role addresses (info@, sales@, marketing@)

There is one important legal exception to the opt-in rule: email addresses specifically intended for commercial messages. Think of marketing@company.nl, acquisition@company.nl or sales@company.nl. You may approach those without prior consent. The assumption is that such an address was explicitly created to receive this kind of message.

But note the difference: info@company.nl, general@company.nl or contact@company.nl are not covered. Those are general addresses, not addresses specifically intended for commercial messages. You treat them like any other address: opt-in or an existing customer relationship is required.

And leaving the legal leeway aside: in practice, marketing@ addresses also produce lower engagement and more complaints than opt-in lists. Nobody feels personal ownership, emails disappear into a shared inbox and are marked as spam more quickly. The legal leeway exists, but it is rarely the smartest move.

What must be included in every newsletter or marketing email?

Checklist per email; every item is required:

Recognisable sender name + valid reply address (no noreply@)
Clear identity: who are you and why are you emailing someone?
An unsubscribe link that works immediately: one click, no login, no hassle
Link to your privacy statement
Company details or a way to get in touch
No misleading subject line or sender name

Tracking and measuring opens: what may you track in email marketing?

Tracking opens and clicks is standard in email marketing. Legally it is defensible as long as you are transparent. What you need to arrange:

Explain in your privacy statement that you measure opens, clicks and behaviour, and for what purpose
Use behavioural data to send more relevant emails: fewer complaints, higher deliverability
Be extra careful with sensitive personal data in segmentation
Sign a data processing agreement with your email service provider (ESP)

Open rates are becoming less reliable

Apple Mail Privacy Protection and Gmail filters increasingly block open tracking. As a result, open rates are no longer accurate. Also steer by clicks, replies and conversions as KPIs: they are more reliable.

How do you prove opt-in consent? What should you record?

If someone files a complaint with the ACM or the Dutch Data Protection Authority, you must be able to show that you had consent. At a minimum, record the following for each sign-up:

Source: which form, which checkout page, which webinar or event?
Date and time of sign-up
IP address of the subscriber
The exact text used to ask for consent (screenshot or log)
Single or double opt-in (including the confirmation email for double)
Audit log: who changed what, and when
Suppression list: addresses that have unsubscribed or objected

What are the risks? ACM fines and other consequences

Concrete figures, so you know what is at stake.

€900,000Maximum ACM fine per violation of the spam ban

€20 million or 4%Maximum fine from the Dutch DPA for serious GDPR violations (of worldwide annual turnover)

15%of all complaints to the Dutch DPA in 2019 were already about unsolicited advertising

ACM (Netherlands Authority for Consumers and Markets): the spam law

The ACM enforces the spam ban in the Telecommunications Act. Fines can reach €900,000 per violation.

Dutch Data Protection Authority (AP): the GDPR

The AP enforces the GDPR. For serious violations, fines can reach €20 million or 4% of worldwide annual turnover. In 2019, 15% of all complaints to the AP were already about unsolicited advertising.

Reputation damage and deliverability

Practically speaking, deliverability damage is at least as harmful as a fine. High spam-report rates cause your emails to land in the spam folder, even for people who do want to receive them. This is cumulative and hard to reverse.

Retention periods for email addresses: how long may you keep data?

The GDPR does not prescribe a fixed marketing retention period. You must be able to explain why you keep data. Practical policy:

Active contacts: keep them as long as there is engagement and the relationship remains logical
Inactive (no opens or clicks for 12 to 24 months): pause, clean up or send a re-opt-in campaign
Unsubscribers and objectors: keep a minimal suppression list to prevent emailing them again
Communicate your retention periods in your privacy statement

GDPR compliance checklist email marketing (10 minutes)

Go through this list for every campaign or list. Can you answer 'yes' to everything? Then you are in good shape.

0 of 10 ticked

Frequently asked questions about email marketing law

The most searched questions about the spam law, GDPR, opt-in and newsletters in the Netherlands.

Can you send a newsletter without consent?

No, unless there is soft opt-in for existing customers. The Telecommunications Act prohibits sending commercial emails without prior opt-in. The only exception applies to existing customers for similar products or services, and even then an opt-out is mandatory.

What is the difference between opt-in and double opt-in?

With opt-in, someone fills in a form and thereby gives consent. With double opt-in (also called 'confirmed opt-in'), they receive a confirmation email and have to click again to confirm the subscription. Double opt-in is not required by law, but strongly recommended: it provides better proof of consent, cleaner lists and fewer spam complaints.

Can you email business email addresses without opt-in?

Not just like that. Personal business addresses (name@company.nl) are personal data and fall under the GDPR. For regular B2B newsletters, opt-in is the safest basis. With a one-to-one approach there is a little more room, provided you are relevant, give context and offer an opt-out.

Is an unsubscribe link mandatory in every email?

Yes. Unsubscribing must be easy for the recipient. A working unsubscribe link in every marketing email is the norm and the only practical way to comply. No login, no form, no need to send an email: one click must be enough.

How long may you keep email addresses (GDPR)?

There is no fixed legal period. Keep addresses as long as the relationship makes sense and you can explain it. For inactive contacts (no activity for 12 to 24 months), cleaning up or a re-opt-in campaign is best practice. Record your retention periods in your privacy statement.

Can you use a bought email list for your newsletter?

No. The people on that list have not given you consent. This almost always results in high spam-report rates, damages your deliverability and breaches the Telecommunications Act. Always build your list organically.

What is the difference between the AVG and the GDPR?

They are identical. The AVG (Algemene Verordening Gegevensbescherming) is the Dutch name for the European GDPR (General Data Protection Regulation). When someone says 'GDPR-compliant', they mean the same as AVG-compliant.

What does the ACM do in response to a spam complaint?

The ACM (Netherlands Authority for Consumers and Markets) enforces the spam ban. Consumers and businesses can file a complaint via spamklacht.nl. The ACM can issue a warning, impose an order subject to a penalty, or issue a fine of up to €900,000 per violation. In the case of repeat or large-scale violations, publicity is also used.

Does the Telecommunications Act also apply to B2B mailings?

Yes. The Telecommunications Act applies to all commercial emails, including to business recipients. It makes no difference whether the recipient is a private individual or a business owner. Only for role addresses (info@, contact@) that cannot be traced to a person is there a little more room, but even then you must be transparent and offer an opt-out.

What is a data processing agreement and do I need one for email marketing?

If you use an external email service provider (ESP), such as MailCamp, Mailchimp or ActiveCampaign, you process personal data via a third party. The GDPR then requires you to conclude a data processing agreement. This is a contract setting out what the processor may do with the data. Good ESPs provide this automatically.

May I use email addresses that I received via a business card?

Not just like that. An exchanged business card is not an opt-in for your newsletter or marketing emails. Always send a confirmation email (double opt-in) first before you add someone to a marketing list. That way you have demonstrable proof of consent.

This article is practical explanation and not individual legal advice. Interpretation may differ per situation. Consult a lawyer if in doubt.

Sources: Telecommunications Act art. 11.7, AVG/GDPR, ACM.nl, autoriteitpersoonsgegevens.nl, ddma.nl.

Email marketing law in the Netherlands: everything about opt-in, GDPR and the spam law