Data protection: Consent

Oct 24th '22

Before sending marketing communications by electronic mail, marketers need to have received the consumer’s active consent, through a clear and affirmative ‘opt-in’. This advice provides more detailed answers to the following questions:


  • When is consent needed?
  • What counts as ‘electronic mail’?
  • What counts as consent?
  • Is an ‘opt-in’ mechanism the same thing as consent?
  • Can an ‘opt-out’ mechanism count as consent?
  • Can consumers be ‘opted in’ by default?
  • When do ads need to contain ‘opt out’ information?


The relationship between the Committee of Advertising Practice (CAP) Code and the data laws enforced by the ICO is explained in general advice on the Data protection rules.


  • When is consent needed?

If personal data will be used to send marketing communications by electronic mail, the consumer needs to have given the marketer their explicit consent beforehand. If a brand sends this type of ad to a consumer who has not given their consent, this is likely to breach Code rule 10.6.


The only exceptions to this requirement are:


  • If the marketing communication is sent to corporate subscribers, or
  • If the contact details have been collected in the process of making a sale, and the marketing communication relates to a similar product or service.


Code rule 10.6 confirms that donations to charities, not-for-profits and political parties would not count as a ‘sale’, so this exemption would not apply. Such organisations would still need to get consent before sending marketing communications that solicit donations.


  • What counts as ‘electronic mail’?

Examples of ‘electronic mail’ are given in the ‘Definitions’ in Section 10 of the CAP Code.


This category of marketing communication doesn’t just refer to e-mail. It also includes text, voice and video messages sent by SMS, or by any other form of digital messaging. Direct messages on social media platforms or in apps, for example, are likely to count as electronic mail.



  • What counts as consent?

There are several criteria that need to be met if you’re using people’s data on the basis of consent:


  1. Consent needs to be freely given.  This means that if consumers are pressured or coerced into agreeing to receive marketing communications, e.g. if a product will be withheld if they don’t provide it, it may not count as consent.
  2. Consent also needs to be specificinformed and unambiguous.  If consent to receive advertising messages is bundled in with other T&Cs, or is explained in a vague way, it’s unlikely to count as genuine consent.  So it needs to be separated and clearly explained.
  3. Consent needs to be given through a clear affirmative action.  This means that you should give consumers a means of giving consent through an active gesture, such as needing to click a ‘tick box’ next to text that explains what they’re consenting to.


  • Is an ‘opt-in’ mechanism the same thing as consent?

All examples of ‘consent’ require an opt-in, but not all opt-ins count as consent. It only counts as consent if it meets the criteria explained above.


If consumers are given a means to consent (or ‘opt in’), it needs to be clear that they are opting in to receive marketing communications, specifically.


  • Can an ‘opt-out’ mechanism count as consent?

Because consent needs to be given through an “affirmative” gesture, it can’t be provided through an opt-out mechanism.


One example of an ‘opt-out’ mechanism would be a pre-ticked box next to text stating that a tick is consent to receive marketing communications. A consumer leaving it ticked is unlikely to count as a “clear affirmative action”, so would not count as consent.


  • Can consumers be ‘opted in’ by default?

If consumers are ‘opted-in’ automatically or by default, it is really an opt-out mechanism.


Examples of this practice would include either a pre-ticked box, or a statement that consumers are automatically opted-in but can opt out if they wish. Neither of these practices are likely to count as consent. So ‘automatic’ opt-ins should not be used for sending marketing communications by ‘electronic mail’.


  • When do ads need to contain ‘opt out’ information? 

All marketing communications need to contain information about how to opt out, even if consumers originally gave consent (through an ‘opt in’) to receive them.


If marketing communications don’t include this, they are likely to breach rules 10.6 and 10.7.


Source: CAP


Note: This advice is given by the CAP Executive about non-broadcast advertising. It does not constitute legal advice. It does not bind CAP, CAP advisory panels or the ASA. CAP’s AdviceOnline entries provide guidance on interpreting the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing.


About us

LS Consultancy are experts in Marketing and Compliance, and work with a range of firms to assist with improving their documents, processes and systems to mitigate any risk.


We provide a cost-effective and timely bespoke copy advice and copy development services to make sure all your advertising and campaigns are compliant, clear and suitable for their purpose.


Our range of innovative solutions can be tailored to suit your unique requirements, no matter whether you’re currently working from home, or are continuing to go into the office. Our services can be deployed individually or combined to form a broader solution to release your energies and focus on your clients.


Contact us today for a chat or send us an email to find out how we can support you in meeting your current and future challenges with confidence.


Explore our full range today.


Contact us


Why Not Download our FREE Brochures! Click here.


Call Us Today on 020 8087 2377 or send us an email.


Need A Regulatory Marketing Compliance Consultant? A Bit More About Us


We welcome individual bloggers / Professional Writers / Freelancers to submit high quality contents. Find out more…


You can see our Google reviews here.