Legal email marketing: 10 GDPR and LSSI rules for your campaigns

Have you ever wondered whether you can email that contact who gave you their business card at a trade show? It’s one of the most common questions in email marketing. And the short answer is no, unless they’ve given you permission.

Doing legal email marketing in Spain isn’t complicated. It boils down to three ideas: ask for permission before you write, explain what you’ll do with the data and let anyone leave whenever they want.

In this guide you’ll find the laws that apply today, the 10 rules you must follow in every campaign and texts to copy into your forms and emails.

A note before we start: this guide is for information only and is no substitute for advice from a lawyer or a data protection officer.

Which laws regulate email marketing in Spain

Today, three laws apply to your campaigns. Each one covers a different area:

The Spanish Data Protection Agency (AEPD) enforces them and fines companies for spam.

What about the LOPD? The old Organic Law 15/1999 ceased to be in force in December 2018. With it, the obligation to register data files with the AEPD also disappeared. If you want the details, see our entry on the LOPD.

One important difference: the GDPR only protects natural persons. The LSSI, on the other hand, also applies when you write to a company. That’s why an advertising email to info@company also needs permission.

The 10 rules of legal email marketing

These are the legal email marketing rules you must follow in every campaign, from collecting the contact to sending.

1. Ask for permission before the first email

Without prior consent, you can’t send advertising by email. That’s what article 21 of the LSSI says.

Under the GDPR, that consent must be freely given, specific, informed and unambiguous. It also has to be given through a clear action by the user.

That’s why pre-ticked boxes don’t count. Nor can you bundle permission for the newsletter into “I accept the privacy policy”.

Text to copy next to an unticked box:

☐ I want to receive the [Brand] newsletter with news, tips and offers. I can unsubscribe whenever I want.

2. Use the customer exception, without abusing it

You can write to your customers without asking for permission, under certain conditions. The LSSI allows it if there is already a contractual relationship and three requirements are met:

• you obtained their email lawfully, when they bought or signed up for something;
• you tell them about your own company’s products or services, similar to the ones they bought;
• you gave them the option to refuse when you collected the email and you give it again in every message.

For example, a sports shop can send sneaker offers to someone who bought a pair from it. It can’t pass that email on to a partner brand.

Text to copy into the checkout process:

We’ll send you offers on products similar to the ones you’ve bought. If you don’t want to receive them, tick this box: ☐ I don’t want to receive offers.

3. Provide the information on the form itself

Anyone who subscribes has to know who you are and what you’ll do with their data. Article 13 of the GDPR requires it.

The LOPDGDD allows you to do it in layers: basic information next to the form and a link to the full privacy policy.

First layer to copy below your subscription form:

4. Keep proof of consent

If you’re ever asked, you must be able to prove that the contact agreed. The GDPR places that burden on the sender.

Store the date, the time, the source form and the text each person accepted.

Double opt-in helps a lot. It means sending a confirmation email and not adding the contact until they click the link.

Note: it isn’t required by law. But it’s the simplest way to prove permission and, at the same time, it keeps out fake or mistyped addresses.

Sample confirmation email:

Subject: Confirm your subscription to the [Brand] newsletter

Hello, We’ve received a request to subscribe this email address to our newsletter. To confirm it, click the button. If it wasn’t you, ignore this message and we won’t write to you again. [Button: Confirm my subscription]

5. Identify yourself and make it clear it’s advertising

Every commercial email has to say who is sending it and that it’s advertising. Article 20 of the LSSI requires it.

Use a recognizable sender with your brand name. And if it’s a promotion, make that clear from the subject line or the start of the message.

If you’re running a giveaway or offering a discount, the terms have to be clear and easy to find.

Email footer to copy:

You received this email because you subscribed at [website]. [Company name], [address], [Tax ID]. [Unsubscribe] · [Privacy policy]

6. Include an unsubscribe option in every email, simple and free

Unsubscribing has to be as easy as subscribing. The LSSI requires a simple, free method in every communication. And the GDPR says withdrawing consent must be as easy as giving it.

No asking for passwords, making people write an email or forcing them to give a reason. One link and you’re done.

In addition, since 2024 Gmail and Yahoo have required bulk senders to offer one-click unsubscribe from within the email client itself, using the List-Unsubscribe header. You’ll find the details in what Outlook, Gmail and Yahoo require to keep your emails out of spam.

If someone would rather receive fewer emails instead of leaving, offer them a preference center. But the option to unsubscribe completely must always be there.

7. Don’t buy or scrape email lists

A purchased list doesn’t give you valid permission. At most, those people agreed to receive emails from another company.

Nor can you copy addresses from websites, social networks or directories. Just because an email address is published online doesn’t mean you can send it advertising.

We explain this in detail in why you shouldn’t buy email databases. If you want to grow, build your own customer database with a well-designed lead magnet or pop-up.

8. Choose a compliant provider and sign an agreement with it

The platform that sends your campaigns processes data on your behalf. The GDPR calls it a data processor and requires a contract with it (article 28).

Before choosing, ask where it stores the data and what security measures it applies.

If the data leaves the European Union, the transfer has to be covered. For the United States, the EU-US Data Privacy Framework is used today, in force since July 2023. It replaced the Privacy Shield, struck down in 2020, which in turn replaced Safe Harbor.

And never send a campaign from your personal email account with everyone in CC. You expose the addresses of all the recipients. If in doubt, review how CC and BCC work.

9. Keep only what you need and clean your list

Ask only for the data you’re going to use. For a newsletter, the email address is enough; the name is optional.

The GDPR also requires you not to keep data longer than necessary. Review your inactive contacts from time to time: you can send them a re-engagement campaign and, if they don’t respond, unsubscribe them.

When someone unsubscribes, keep their address on a suppression list. That way you avoid emailing them again by mistake if you import another list.

10. Keep the special cases in mind

There are three situations worth reviewing separately.

Minors: in Spain, a minor can give consent from the age of 14. Below that age, consent is given by their parents or guardians.

Robinson List: if you’re going to advertise to people who haven’t given you permission, the LOPDGDD requires you to check it first. If your contacts have given you their consent, you don’t need to check it.

Transactional emails: an order confirmation, an invoice or a password change aren’t advertising. You can send them without marketing consent, as long as you don’t use them to sneak in promotions. We explain this in what a transactional email is.

What fines apply for sending spam

Every year the AEPD fines companies for sending advertising without permission. These are the amounts set by law:

The amount takes into account intent, duration, the harm caused, the profit obtained and any previous penalties.

But the fine isn’t the only cost of breaking the rules of legal email marketing. Sending without permission generates spam complaints, damages your sender reputation and can land you on a blacklist. From then on, not even your customers receive your emails.

Checklist before sending your campaign

Go through this list before clicking “Send”. It sums up everything above:

How Mailrelay helps you do legal email marketing

At Mailrelay we make it easy for you to comply with every send:

• subscription forms with double opt-in, so you have proof of permission;
• automatic unsubscribe management, so no one who left receives your campaigns again;
• automatic list cleaning, which removes addresses that bounce;
• custom fields to store the source and date of each sign-up, and groups to separate customers from subscribers;
• support by chat, ticket and phone on all plans, including the free one.

With the free account you can send up to 80,000 emails a month to 20,000 contacts.

Where to start

If you already have a list, the first step towards legal email marketing is to check where each contact came from. Set aside any contact without clear permission or a previous purchase, and don’t send it advertising.

Next, change your form: unticked box, first information layer and double opt-in. And review the footer of your templates using the checklist.

That will take care of most of it. The rest is keeping your list clean and handling unsubscribes immediately.

Frequently asked questions about legal email marketing

These are the questions we get most often about data protection in email marketing.

Is it legal to send advertising emails without consent?

No, except to your own customers and about products similar to the ones they bought. In all other cases, the LSSI requires the person to have requested or authorized it beforehand.

Is double opt-in mandatory?

No. Neither the GDPR nor the LSSI requires it. But you do have to be able to prove consent, and double opt-in is the simplest way to do it.

Can I send commercial emails to companies without permission?

No. The LSSI also applies to companies, so you need their consent or a previous customer relationship. In addition, an email address like firstname.lastname@company is personal data, so the GDPR applies to it.

Is the LOPD still in force?

No. Organic Law 15/1999 was replaced in December 2018 by the LOPDGDD (Organic Law 3/2018). Today, data protection in email marketing is governed by the GDPR and the LOPDGDD, and sending advertising by the LSSI.

What must a marketing email include to comply with the GDPR?

An identifiable sender, a clear indication that it’s advertising, your company details and a one-click unsubscribe link. And, before sending it, permission from every recipient.