Email capture and consent under GDPR and ePrivacy

Two laws decide whether you may email someone, not one

Most people think a sign up form follows one rule, called GDPR. In Ireland there are two.

The GDPR (the EU General Data Protection Regulation) decides what consent is and what makes it valid. The ePrivacy Regulations 2011 (S.I. No. 336 of 2011) decide when you need that consent before you send marketing by email, text or private message. Regulation 13 is the one that matters here.¹ Both are enforced by the Data Protection Commission (DPC), and the DPC is clear that any consent the ePrivacy Regulations ask for must meet the GDPR's definition of consent.²

So every form answers two questions. Under the ePrivacy Regulations: may I send this person marketing email at all? Under the GDPR: if I rely on their consent, is it real, and can I prove it?

I am an engineer who builds these forms, not a solicitor. What follows is what the law and the DPC say, and how I turn it into forms that work. Beyond the basics, ask a solicitor.

Claddagh Leaf is an invented online tea shop in Galway, run by Aoife, at claddaghleaf.example. Nobody real, and every number in this article is made up so I can show each step.

Her site has a popup: "Join the club for 10% off your first order", one email field and a button. Underneath, in small grey text: "By signing up you agree to our terms and privacy policy."

The ePrivacy question: a weekly email about new teas is marketing, and most of these visitors have never bought anything, so she needs their consent. The GDPR question: is pressing that button consent to marketing email? The text never mentions email or marketing and ties the sign up to her terms. So the popup collects addresses she cannot lawfully email: the work of collecting, none of the value.

The GDPR defines consent as a "freely given, specific, informed and unambiguous indication" of someone's wishes, given "by a statement or by a clear affirmative action". That definition sits in Article 4(11).³

Article 7 adds the conditions around it.⁴ You must be able to show the person consented. A request inside a longer document must stand apart, in plain language. People can withdraw at any time, must be told so, and withdrawing must be as easy as agreeing. And consent is not freely given if something the person wanted was made to depend on a consent it did not need.

The DPC adds practical tests. Silence, boxes ticked in advance and inactivity are not consent, and an opt out box is unlikely to be enough wherever consent is required.² Marketing consent must not be bundled with consent for anything else. In 2024 the DPC prosecuted a Dublin gym that relied on members agreeing to its terms and conditions, which mentioned electronic marketing, and could not produce a consent record when asked.⁵ For receipts by email, the DPC's best practice is two blank boxes, one for the receipt and one for marketing.⁶

I turn the law into five checks, each a question the form must answer yes to:

Freely given: could the person say no and still get what they came for?
Specific: does it say this business, this channel, this kind of message?
Informed: do they know who you are and that they can withdraw?
Unambiguous: did they do something deliberate, like ticking an empty box?
Provable: could you show who agreed, when, how, and to which wording?

A box that arrives already ticked fails the fourth question on its own. That one is so common it has its own article on dark patterns.

Freely given: the popup exists for the email list and the code is the reason to join, so nothing unrelated is held hostage, provided the form says plainly that the club is a marketing email. Specific: "agree to our terms" says nothing about email. Fail. Informed: no business name in the consent line, nothing about withdrawing. Fail. Unambiguous: the press is deliberate, but it agrees to terms, not to marketing. Fail. Provable: the shop stores the address and a date, nothing else. Fail.

The rebuilt popup reads: "Get 10% off your first order, plus a weekly email from Claddagh Leaf about new teas. Unsubscribe any time with one click." One email field, one button, "Send me the code and the weekly email". The button now names exactly what happens, so pressing it is a clear affirmative action for one specific thing, and the shop records the wording and the time with the address.

The existing customer rule: people who bought can be emailed without a tick

The ePrivacy Regulations have one exception to the consent rule for businesses, the existing customer rule (the UK calls its version the soft opt in). Regulation 13(11) lets you email a customer without their consent if all of this is true: you got their email address from them in the context of a sale, you are marketing your own products or services of a kind similar to what they bought, you gave them a clear, easy and free way to object when you collected the details and in every message since, and the sale was no more than 12 months before the email.¹²

The DPC's guidance fills in the details, and they matter.² The exception covers existing customers only. The DPC says an organisation must not send electronic marketing to a prospective customer who does not complete a purchase, the example being someone who browses but never finishes the checkout. That is narrower than the UK rule, which also covers negotiations for a sale. In Ireland a quote request or a negotiation is not a sale, so it does not count: regulation 13(11) asks for a sale.¹ A free account or a free trial is less clear. In the Inteligo Media case in November 2025 the Court of Justice of the EU held that a sale needs payment, but that a free account can count where its cost is paid for indirectly through the price of a paid offer, and left it to the national courts to check each case.⁷ So a free trial that is part of a paid plan is arguable, but no Irish court or DPC guidance has settled it yet. The address must also have been obtained lawfully, with a valid legal basis for the reason you first took it. Similar means similar to what the person actually bought, and you cannot use it to promote someone else's products. On the 12 months, the DPC's receipt guidance adds that the clock also runs from the last compliant marketing email the person did not opt out of.⁶

The opt out at collection is where most shops trip. The DPC's guidance on receipts suggests an opt out box prominently displayed beside the email field, at the point you collect the address.⁶ A sale with no opt out offered there cannot be marketed to afterwards.² Every later message then needs a working way to opt out, in practice an unsubscribe link.⁸

I treat it exactly as in the article on data warehousing for marketing automation: the same conditions, carried as a permission column per person and checked inside every query that builds a mailing list.

The existing customer rule answers the ePrivacy question, and according to the Court of Justice it also settles the lawful basis. In the same Inteligo Media judgment the Court held that where you use an email address under the existing customer rule, the lawful basis conditions in Article 6(1) of the GDPR do not apply, because the ePrivacy rule governs that use completely.⁷ The GDPR has not gone away, though. It still governs how you collected the address in the first place, what you tell people, and their right to object, which must be offered clearly and distinctly when you take the address and in every message.

Worked example: the checkout and the free trial

At Claddagh Leaf's checkout, under the email field, there is an unticked box in normal sized text: "Please don't send me emails about new teas and offers. You can also unsubscribe from any email." Cian, an invented customer at cian@example.com, buys a tin of Assam and leaves the box empty.

Can Aoife email Cian next week about her new Darjeeling? The details came from Cian, during a sale. Darjeeling is her own tea, a similar product. He was offered a simple refusal when she took his address, every email carries an unsubscribe, and the sale was a week ago, well inside 12 months. Yes. Can she email him about the deli next door's cheese hampers for a commission? No. It is not her product.²

Now a software example. Rotawise is an invented staff rota tool in Cork. Niamh, at niamh@example.com, starts a 14 day free trial. In the UK a free trial counts as negotiations for a sale. In Ireland nothing has been sold yet. After the Inteligo Media case a trial that is part of a paid plan might count, but that is unsettled, and the DPC's guidance still speaks of customers who complete a purchase.²⁷ So if Rotawise wants to email Niamh about its features and plans during the trial, it asks for her consent, which is good practice whatever a court later decides, and the sign up screen carries an unticked box for product news. If she goes on to pay, Rotawise offers the opt out box on the payment screen, where the sale happens, and from then on it can rely on the existing customer rule for its own similar products. If Niamh had only read the pricing page and left, there would be nothing to rely on either way.

One point for software sold to businesses. Email marketing to companies, and anyone else who is not a natural person, is allowed on an opt out basis, until they tell you to stop. An individual's work address is also outside the consent rule if it reasonably appears to be used mainly for their business and the email relates only to that business.⁹ But an objection from a business counts: the DPC prosecuted an office supplies company that kept emailing a business owner's work address after she had asked three times to be removed.¹⁰ Keep a "do not email" list, and remember that the GDPR still protects the named person behind a work address.

What Irish law adds, and what it leaves out

Irish law differs from the UK picture in three ways that touch email capture.

First, there is no charity soft opt in. Since February 2026 the UK lets charities email supporters without consent under a new rule of their own. Ireland has nothing like it. Regulation 13 has one exception, for existing customers in the context of a sale, and it applies to a charity exactly as it applies to a shop.¹² A donation is not a sale, and neither is signing up to volunteer. So a charity needs consent to email its supporters, with the same unticked box any business uses.

Second, fines. Breaking the ePrivacy Regulations is a criminal offence, prosecuted by the DPC in the courts, and each marketing message sent in breach is a separate offence. The maximum is €5,000 per offence on summary conviction and €250,000 per offence on indictment.⁹ In practice the District Court cases have been smaller and steady: a Kildare publisher fined €6,000 across three charges for marketing emails to two people in 2022,¹¹ and in September 2026 a Dublin department store, after charges that included emails people could not unsubscribe from, ordered to pay €1,000 to charity and €1,000 towards the DPC's costs.¹² A criminal record for the company, the costs and the headline are the real price, and the DPC names the companies it prosecutes.

Third, the burden of proof sits on you. In a prosecution under the ePrivacy Regulations it is for the marketer to show that the person consented, not for the person to show they did not.⁹ That is the legal reason the consent record later in this article matters so much.

What stays the same as everywhere in the EU: the GDPR definition of consent, the conditions in Article 7, and the right to object in Article 21.³⁴¹³ And one point is easy to misread. The Inteligo Media judgment does not mean "no consent needed for marketing email". It only switches off the Article 6 conditions where the existing customer rule already applies. For everyone else the ePrivacy Regulations still decide whether you may send the email, and for people who are not customers that still means consent.²⁷

Worked example: a rescue in Kilkenny

Nore Valley Hedgehog Rescue is an invented registered charity in Kilkenny, planning a spring appeal. Sam, at sam@example.com, signed up as a volunteer through the rescue's own website in March 2026, and the form had an unticked box to opt out of emails about the rescue's work. In the UK that would be enough. In Ireland it is not: volunteering is not a sale, so the existing customer rule does not apply, and an opt out box is not consent. The rescue needs Sam's consent, and the fix is to turn that box round into an unticked opt in: "Send me emails about the rescue's work and appeals."

Jo, at jo@example.com, gave an email address for a receipt when buying a coffee at the rescue's café, and the till offered an opt out that Jo did not take. That is a sale, so within 12 months the café could email Jo about its own similar products, coffee and cakes. The spring appeal is not a similar product to a coffee. For the appeal, the rescue needs Jo's consent.

Alex donated in December 2025. A donation is not a sale, so the date makes no difference. The rescue needs Alex's consent, asked at the next moment Alex starts, such as the next donation form.

And an email promoting the garden centre that sponsors the rescue? Not under the existing customer rule, for anyone. It is not the rescue's own product.

The commonest lead generation pattern I see is the gated guide: enter your email to download it, and by doing so you join the newsletter. It feels like a fair trade. The law reads it differently.

Article 7(4) asks whether something the person wanted was made conditional on a consent it did not need.⁴ Sending someone a PDF does not need their consent to a weekly newsletter. So the newsletter consent collected this way is not freely given, and the existing customer rule does not rescue it either, because downloading a guide is not buying anything.² The DPC's line on bundling points the same way: marketing consent has to stand on its own, apart from whatever else the person is signing up to.⁵

Two clean ways to build it. Email the guide, which needs the address, with a separate unticked box for the newsletter. Or, as I often prefer, let people download it with no email at all and invite them to the newsletter on the last page. Fewer addresses, every one from a person who asked.

Worked example: Aoife's brewing guide

Claddagh Leaf offers "The Galway guide to brewing loose leaf tea" as a PDF. The old form said: "Enter your email to get the guide. You'll also join our newsletter." In a month, 1,200 people downloaded it.

None of those 1,200 newsletter consents is freely given, because the guide was conditional on them, and downloading a guide does not make anyone a customer. So Aoife can lawfully send marketing to none of them. She can send each person the guide, and that is all.

The rebuilt form: one email field, a button that says "Email me the guide", and beside it an unticked box: "Also send me the weekly Claddagh Leaf email about new teas. Unsubscribe any time." Same month, same 1,200 downloads, and 456 people tick the box. Those 456 are a list she can use.

A consented list is smaller, and worth more

The usual objection is the drop in sign ups. It is real. What matters is the usable list, and what it earns.

The share of people who say yes is a rate like any other:

r = \frac{C}{N}

Here $r$ is the opt in rate, $C$ is the number of people who ticked the box, and $N$ is the number of people who saw the form and submitted it. It only means something if you count $C$ and $N$ the same way every month, which is the point of Foundations: ratios and rates.

To put a value on a subscriber, I use expected value: the chance they order in a month, times the margin an order brings.

E = p \times m

Here $E$ is the expected margin in euro per subscriber per month, $p$ is the probability that a subscriber places an order in a month after receiving the emails, and $m$ is the margin in euro on an average order. It is the simplest case of the expected value formula, with one outcome that pays and one that pays nothing, explained from scratch in Foundations: expected value.

Worked example: what the 456 are worth

From Aoife's rebuilt form:

r = \frac{456}{1{,}200} = 0.38

Here $456$ is $C$ , the people who ticked the box, and $1{,}200$ is $N$ , everyone who downloaded the guide. So 38% of them also asked for the email (Foundations: ratios and rates). On the old form the collected number was 1,200, but the usable number was zero, so the comparison that matters is 456 against 0.

Now the value. In Aoife's (invented) records, 4% of subscribers place an order in a month, and her average order brings €14 of margin after the tea, the packaging and the An Post postage.

E = 0.04 \times 14 = 0.56

Here $0.04$ is $p$ and $14$ is $m$ in euro, so $E$ is 56 cent per subscriber per month (Foundations: expected value). Across the 456, it is $456 \times 0.56 = 255.36$ , about €255 a month from one month's guide downloads, from people who asked to hear from her.

Along the bottom are the two forms, each with two bars: addresses collected, and addresses that can lawfully receive marketing email. Up the side is the number of addresses. The takeaway: the bundled form looks like the bigger list and is in fact an empty one, 1,200 addresses to store and protect and never use.

In my experience a list built this way also gets fewer spam complaints, because nobody on it is surprised. If you want to compare two wordings of the box properly, that is an A/B test with enough people in each arm, and the article on sample size, lift and test design shows how many you need before the difference means anything.

When a list turns out not to be clean, the instinct is to email everyone and ask them to confirm. Do not, if you were not allowed to email them in the first place.

The clearest cases come from the UK regulator, applying its own version of the same EU ePrivacy rules. In 2017 it fined Flybe for sending more than 3.3 million emails titled "Are your details correct?" to people who had opted out of marketing, asking them to update their preferences, with a prize draw for those who did. It fined Honda Motor Europe for 289,790 emails asking customers to confirm their marketing choices. Honda argued the emails were customer service. The regulator disagreed: an email asking whether someone wants marketing is itself marketing.¹⁴ Irish law gives you no reason to expect a softer reading. Regulation 13 makes it an offence to send electronic marketing to someone who has not consented, either by opting in or, as an existing customer, by not opting out.⁸

So the clean route to permission runs through moments the person started: the next purchase, the next login, with a plain question at checkout or in the account.

Aoife's old popup collected 3,000 addresses over two years under the wording from the first worked example. Of those, 1,100 have since bought something.

The 1,900 who never bought: no valid consent, no existing customer rule. She does not email them, not even to ask, and deletes the addresses on her normal retention schedule.

The 1,100 who bought: her checkout never offered an opt out, so the existing customer rule was not set up, and a later opt out is too late.² No "please confirm" campaign either. From now on her checkout and account page carry the opt out box and the new consent wording, and when any of the 1,100 buys again, their status is recorded properly from that moment. Slower than a mass email, and it does not end in the District Court.

Proof is a record, not a feeling

Article 7(1) puts the burden on you to demonstrate consent,⁴ and in an ePrivacy prosecution the onus is on the marketer as well.⁹ The DPC's gym case turned on exactly this: asked for the Article 7 consent record, the gym could not produce one.⁵ So the record should show who consented (a name or an identifier), when (a timestamp), what they were told (the consent wording, versioned and dated), how (the form and the submitted data), and whether and when they withdrew. Keep it for as long as you rely on the consent. For the existing customer rule, I keep a simple flag per person that shows which basis applies, the date of the sale for the 12 month clock, plus a suppression list I check before every send.

In the shops I build, this is one small table, written by the form and never edited by hand. A row looks like this:

{
  "email": "eoin@example.com",
  "basis": "consent",
  "channel": "email",
  "purpose": "weekly_new_teas",
  "wording_version": "popup_v3_2026_03_02",
  "source": "guide_form",
  "page": "https://claddaghleaf.example/guides/brewing",
  "given_at": "2026-03-14T09:12:44Z",
  "withdrawn_at": null
}

The wording version points to a stored copy of the exact text the person saw. Without it, the record says someone agreed, but not to what.

I also flag older consents with no engagement, and those people get a plain question next time they are in their account.

Worked example: the complaint that ends in a minute

Eoin, the owner of the row above, writes to Aoife: "I never signed up to your emails." She finds his row: consent, from the guide form, 14 March 2026 at 9.12am, wording version popup_v3_2026_03_02, which she opens: "Also send me the weekly Claddagh Leaf email about new teas. Unsubscribe any time." She replies with the date, the page and the wording, apologises, and unsubscribes him on the spot. No bother. The record is not for winning arguments with customers. It shows the DPC, if it ever asks, that the consent was real.

Leaving must be as easy as joining

Article 7(3) says withdrawing consent must be as easy as giving it.⁴ The DPC says the same, and adds that every marketing message must carry a valid way to opt out, in practice an unsubscribe link in an email.⁸ For existing customers that opt out has to be offered in every message, free of charge.¹⁹

Separately, Article 21 gives everyone the right to object to direct marketing at any time, and once they object their data must no longer be used for it.¹³ There are no grounds to refuse. Under the ePrivacy Regulations, sending marketing to someone who has objected is itself an offence.² That covers people you emailed under the existing customer rule too, so an unsubscribe from a customer ends the exception for good, until that customer actively consents later. Two of the DPC's recent prosecutions began with unsubscribes that did not work because of a fault at a software provider, which is a good reason to test yours.⁵¹²

In practice that means three things. The unsubscribe link works in one click. It writes to the same consent table, so withdrawn_at gets filled in. And every mailing list is built by a query that excludes anyone on the suppression list, so an unsubscribe in one tool cannot be undone by an import into another.

Worked example: one unsubscribe, three tools

Orla, at orla@example.com, clicks unsubscribe on a Tuesday evening. The email tool marks her unsubscribed, and a webhook writes the time into her consent row and adds her to the suppression list. On Wednesday Aoife uploads recent customers to her ad platform, and on Friday she imports last year's competition entries into the email tool. Both lists are built by queries that leave out the suppression list, so Orla is in neither. Without that check, Friday's import would have quietly subscribed her again. Sending audiences to other platforms brings its own questions about the companies you share data with, covered in how data processors can get you fined.

Onboarding is the best moment to ask, and to ask well

Someone who has just bought, or just started a trial, is paying attention and wants something from you. That is the moment to ask what they want to hear about, rather than assume.

I build it as one short preference step. Two or three topics, each with a plain description and an honest frequency, each unticked. One channel per box, because consent has to be specific and the DPC wants marketing consent kept apart from every other choice.⁵⁶ And a settings page that changes it later in the same words. Getting the copy on that step right is worth an afternoon, because "about twice a month" is a promise people can hold you to.

When Niamh first logs into her Rotawise trial, one screen asks what she would like to hear about, with two unticked boxes: "Tips for building rotas faster, about twice a month" and "New features, roughly monthly". A third line, "Text me when a shift swap needs my approval", is a service message, and is labelled as part of the product, not marketing.

In the UK, Niamh's trial alone would already let Rotawise send product emails. In Ireland that is unsettled at best, so this screen is where Rotawise gets her consent, and her answer also says which emails she will open. She ticks the tips only. From then on she gets the tips and nothing else, and her choice is written to the consent table with the wording version of the screen she saw.

The short version: build the form so the right answer is the easy one

Here is the whole decision, as I run it before any email address goes onto a marketing list.

Read it from the top. Each diamond is a question whose answer stops you or moves you on. The order matters: the suppression list comes first, because an objection beats every other basis. The takeaway is that there are only two doors into a marketing list, consent and the existing customer rule, and in Ireland there is no third, not for charities either.

None of this asks for less ambition, only for fewer addresses you cannot use. A clear box, a recorded wording, an opt out at the checkout and a suppression list checked on every send take a few days to build, and then quietly do the right thing every day. Trust built that way tends to pay you back later, which is the subject of GDPR as a strategic advantage.

Government of Ireland, European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, regulation 13, Irish Statute Book, 2011, https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print
Data Protection Commission, FAQ on Consent for Electronic Direct Marketing, dataprotection.ie, April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2026-05/FAQ_Consent_Electronic_Direct_Marketing_April2020.pdf
European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4(11), EUR-Lex, 2016, https://eur-lex.europa.eu/eli/reg/2016/679/oj
European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 7, Conditions for consent, EUR-Lex, 2016, https://eur-lex.europa.eu/eli/reg/2016/679/oj
Data Protection Commission, Prosecution of Pulse Gym trading as Energie Fitness Dublin 8, Case studies, electronic direct marketing, dataprotection.ie, 2024, https://dataprotection.ie/en/dpc-guidance/case-studies/electronic-direct-marketing/prosecution-pulse-gym-tradingas-energie-fitness-dublin-8
Data Protection Commission, E-Receipts, dataprotection.ie, 2026, https://www.dataprotection.ie/organisations/e-receipts
Court of Justice of the European Union, Judgment of 13 November 2025, C-654/23, Inteligo Media, paragraphs 48, 53 to 62 and 64 to 69 and operative part, EUR-Lex, 2025, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62023CJ0654
Data Protection Commission, Can customers object to electronic direct marketing?, FAQs on direct marketing, dataprotection.ie, 2026, https://www.dataprotection.ie/en/faqs/direct-marketing/can-customers-object-electronic-direct-marketing
Adam Finlay and Mark Ellis, McCann FitzGerald, Direct marketing Q&A: Ireland, Practical Law Country Q&A, Thomson Reuters, law stated as at 31 December 2019, https://mccannfitzgerald.com/uploads/Direct_marketing_QAndA_Ireland.pdf
Data Protection Commission, Prosecution of Viking Direct (Ireland) Limited, Case studies, electronic direct marketing, dataprotection.ie, 2019, https://dataprotection.ie/en/dpc-guidance/case-studies/electronic-direct-marketing/prosecution-viking-direct-ireland-limited
Data Protection Commission, Data Protection Commission welcomes latest successful prosecution of marketing offences, dataprotection.ie, 5 December 2022, https://www.dataprotection.ie/en/news-media/data-protection-commission-welcomes-latest-successful-prosecution-of-marketing-offences
Gazette Desk, Brown Thomas broke rules on marketing emails, Law Society Gazette, 9 September 2026, https://www.lawsociety.ie/gazette/top-stories/2026/september/brown-thomas-broke-rules-on-marketing-emails/
European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 21, Right to object, EUR-Lex, 2016, https://eur-lex.europa.eu/eli/reg/2016/679/oj
Alexander J Martin, ICO fines Flybe, Honda for breaking data rules. They were, um, trying to comply with GDPR, The Register, 28 March 2017, https://www.theregister.com/2017/03/28/ico_fines_flybe_honda/

Consent by design: email capture, lead forms and onboarding under the GDPR and the ePrivacy Regulations

TL;DR

Two laws decide whether you may email someone, not one

The existing customer rule: people who bought can be emailed without a tick

Worked example: the checkout and the free trial