Who can receive direct marketing without consent, and what about cookies?

In brief

Electronic direct marketing to a natural person, such as a named customer or an employee, normally needs prior consent under the Act on Electronic Communications Services, section 200. There is a limited customer exception: the same seller or service provider may market its own similar products or services to an existing customer if the opt-out is easy and free. Direct marketing to an organisation is allowed unless the organisation has expressly objected, but every message must still be clearly recognisable as marketing and must contain a working stop address. For cookies, the first legal question is whether the cookie or related identifier creates personal data; if it does, the General Data Protection Regulation applies and you need a legal basis, transparent information and working data subject rights.

Electronic marketing to a natural person normally requires prior consent

A natural person means a human being. In marketing work, this can be a consumer, a sole trader, a member of an association, or an employee whose address identifies the person.

The Act on Electronic Communications Services, section 200, sets the main rule for electronic direct marketing to a natural person. Marketing by automated calling systems, fax, email, text message, voice message, audio message or image message may be sent only to natural persons who have given prior consent.

For daily work, this means that a list of private customer emails cannot normally be used for a campaign just because the addresses are available in a customer relationship management system. The starting point is consent before the marketing is sent.

Consent also matters under the General Data Protection Regulation (GDPR). The GDPR’s Article 4 defines consent as a freely given, specific, informed and unambiguous expression of the data subject’s wishes. In plain terms, the person must understand what they are agreeing to, and the organisation must not treat silence or uncertainty as permission.

A work address can still be personal data. If an address identifies a person, such as a named employee address, the GDPR’s Article 4 definition of personal data is met because the person can be identified. For the wider question of recognising personal data, see What is personal data, and when does it stop being personal data?.

You may market your own similar products to an old customer without new consent

Section 200 also contains an important exception. If a seller or service provider receives a natural person’s contact detail during the sale of a product or service, the same seller or service provider may use that detail for direct marketing of its own products and services in the same product group or otherwise similar products and services.

This is not a general permission to market anything to anyone who has once bought something. It is tied to four practical conditions:

• the contact detail was received in connection with a sale;
• the sender is the same seller or service provider;
• the marketing concerns the sender’s own similar products or services;
• the customer can object easily and without a separate charge both when the detail is collected and in every later email, text, voice, audio or image message.

The opt-out must also be clearly explained. In practice, a campaign should not hide the unsubscribe route in legal wording, make it paid, or require extra steps that make stopping the marketing difficult.

The GDPR still applies if the contact detail is personal data. Article 5 requires personal data to be handled lawfully, fairly and transparently, for specific purposes, with data minimisation and appropriate security. Article 5 also contains the accountability principle: the controller is responsible for compliance and must be able to show it.

That means the organisation should be able to explain why the customer exception applies. It should also be able to show what customer relationship the contact came from, what product or service was sold, why the new campaign is similar, and how the opt-out was offered.

You may send marketing to an organisation when the right to object works

The Act on Electronic Communications Services, section 202, treats direct marketing to an organisation differently. Direct marketing to an organisation is allowed unless the organisation has expressly prohibited it.

This rule is still not a free-for-all. The organisation must be given an easy way, without a separate charge, to prohibit the use of its contact details in every direct marketing email, text message, voice message, audio message and image message. The sender must clearly inform the recipient about that right.

A useful campaign distinction is this:

Recipient in the campaign	Starting point under the Act on Electronic Communications Services
Natural person reached by email, text, voice, audio or image message	Prior consent is normally required under section 200.
Existing natural-person customer	Own similar products or services may be marketed under the customer exception in section 200, if the opt-out is easy and free.
Organisation	Marketing is allowed unless the organisation has expressly objected under section 202.
Named employee at an organisation	The direct marketing rule may concern an organisation, but the address can still be personal data under the GDPR’s Article 4.

The last row is often where mistakes happen. A message can be business-to-business marketing and still involve personal data. For example, a named work email address identifies an employee. That does not automatically make the message unlawful, but it means the GDPR’s rules on lawful basis, transparency and rights must be considered.

For more on legal bases, see What legal basis permits processing personal data?.

Every marketing message must reveal its purpose

The Act on Electronic Communications Services, section 203, requires a direct marketing email, text message, voice message, audio message or image message to be clearly and unambiguously recognisable as marketing when it is received.

This affects subject lines, sender names and message content. A campaign should not look like an invoice, a service alert or a personal administrative message if its purpose is direct marketing.

Section 203 also prohibits certain sending practices. A direct marketing message must not hide or conceal the identity of the sender on whose behalf the message is sent. It must include a valid address where the recipient can request that the communication stops. It must not try to direct recipients to websites that are contrary to the Consumer Protection Act provisions referred to in section 203.

For a decision-maker, the operational point is simple. The marketing team needs a pre-send check for sender identity, marketing labelling and a working stop route. If a processor sends the campaign on the controller’s behalf, the controller still needs to know what the recipient will actually see.

Section 204 adds that, at the user’s request, a telecommunications operator and an organisation subscriber have the right to block receipt of direct marketing covered by sections 200, 202 and 203. The measures must be carried out carefully and must not restrict freedom of expression, confidential communications or privacy more than necessary.

With cookies, the first question is whether personal data is created

A cookie is a small identifier stored in or read from a user’s device. In ordinary work, the legal issue is not the word “cookie” alone. The first GDPR question is whether the cookie or the data around it relates to an identified or identifiable natural person.

The GDPR’s Article 4 includes online identifiers in the definition of personal data when they can identify a person directly or indirectly. For example, a cookie value linked to a logged-in customer account, purchase history or repeated behaviour can become personal data because it can be connected to a person.

If no identified or identifiable natural person is involved, the GDPR’s personal data rules do not apply to that handling. If a natural person can be identified directly or indirectly, the organisation is processing personal data. Processing is a broad word under Article 4. It covers actions such as collecting, storing, using, combining, disclosing and deleting personal data.

Once cookie use becomes personal data processing, Article 5 matters. The controller must handle the data lawfully, fairly and transparently. It must collect it for specific, explicit and legitimate purposes. It must keep the data limited to what is necessary for those purposes. It must keep it secure.

This is why a cookie review should not stop at the banner text. It should map what identifiers are set, what they are connected with, what purpose they serve, who receives the data, and how long the data remains identifiable.

What must be asked about cookies depends on the chosen legal basis

The GDPR’s Article 6 gives six possible legal bases for personal data processing. Consent is one of them. Other bases include performance of a contract, compliance with a legal obligation, vital interests, a task in the public interest or the exercise of official authority, and legitimate interests. Article 6 also states that legitimate interests do not apply to processing carried out by public authorities in the performance of their tasks.

So the GDPR question is not always “where is the consent box?” The first question is which legal basis the controller relies on for the specific cookie-related processing purpose. If the controller relies on consent, the consent must meet the GDPR’s Article 4 standard: freely given, specific, informed and unambiguous.

If cookies are used for several purposes, each purpose needs its own lawful assessment. A cookie used to keep a service session working is not the same purpose as a cookie used to build a marketing audience. The GDPR’s Article 5 purpose limitation principle requires clarity about the purpose before the data is used.

Articles 13 and 14 set the transparency duties. If personal data is collected from the data subject, Article 13 requires the controller to give information such as the controller’s identity and contact details, the data protection officer’s contact details where applicable, the purposes and legal basis, recipients or recipient categories, retention period or criteria, rights, and complaint rights. If personal data is not obtained from the data subject, Article 14 requires similar information and also information on the categories of personal data and where the data came from.

For a cookie consent or privacy notice flow, this means the person should be able to understand at least these points before the processing is presented as lawful:

• who the controller is;
• what cookie-related personal data is processed;
• why it is processed;
• which GDPR legal basis is used;
• who receives the data or what recipient categories exist;
• how long the data is kept or how the period is decided;
• what rights the data subject has.

Data subject rights can also reach marketing and cookie data. Articles 15 to 20 cover access, rectification, erasure, restriction and data portability in the situations described in those articles. Article 12 requires the controller to facilitate the exercise of those rights and to communicate in clear and plain language. For the practical handling of rights requests, see Data subject rights: when a customer asks for their data, you have a month.

The limits matter because one section does not solve everything

The direct marketing sections and the GDPR answer different questions. Sections 200, 202 and 203 of the Act on Electronic Communications Services decide when electronic direct marketing may be sent and what the message must show. The GDPR decides when personal data processing is lawful, transparent, limited and accountable.

This means one permission does not automatically solve the other side. An organisation may be allowed to send business-to-business marketing under section 202, but the named employee’s address may still be personal data. An existing customer exception may allow similar-product marketing under section 200, but the controller still needs a GDPR legal basis and transparent information for the personal data processing.

The reverse is also true. Having a GDPR legal basis for storing a contact detail does not by itself remove the direct marketing rules in the Act on Electronic Communications Services. A database may be lawful for customer management, but an electronic direct marketing campaign still needs its own section 200 or section 202 assessment.

Cookies have the same split. The GDPR articles cited here do not, by themselves, answer every technical rule about storing or reading data on a device. They answer the personal data side: when an identifier becomes personal data, what legal basis is needed, what information must be provided, and which rights must work.

Special categories need extra care. The GDPR’s Article 9 starts from a prohibition on processing personal data revealing matters such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, or data concerning a natural person’s sex life or sexual orientation. Article 9 then lists exceptions. If cookie-related profiling or segmentation touches these kinds of data, the campaign is no longer an ordinary marketing setup.

A campaign check is worth doing before sending

A practical pre-send review can be short, but it should cover both laws. The point is to catch the usual failures before the message leaves the system.

For electronic direct marketing, the review should ask:

• Is the recipient a natural person, an existing customer under the section 200 exception, or an organisation under section 202?
• If the recipient is a natural person and no customer exception applies, where is the prior consent?
• If the customer exception is used, was the contact detail obtained during a sale by the same seller or service provider?
• Are the marketed products or services in the same product group or otherwise similar?
• Is the opt-out easy, free and present both at collection and in every relevant message?
• Is the message clearly and unambiguously recognisable as marketing?
• Is the sender identity visible and is there a valid stop address?

For personal data and cookies, the review should ask:

• Does the campaign or cookie setup identify a natural person directly or indirectly?
• Who is the controller for that processing?
• What is the specific purpose?
• Which GDPR Article 6 legal basis is used for that purpose?
• Has the person received the Article 13 or Article 14 information?
• Can data subject rights be handled in practice?
• Is the data limited to what is necessary and kept no longer than needed for the purpose?

This check also helps with accountability. Under the GDPR’s Article 5, the controller must be able to show that the principles are followed. In marketing, evidence is often simple: the consent record, the customer relationship basis, the opt-out wording, the campaign copy, the privacy notice, and the cookie purpose map.