Channel-by-channel rules: the consent matrix
This is the heart of the chapter for exam purposes. Post is GDPR-only (no ePrivacy), usually consent or legitimate interests. Live phone calls are left to member states (opt-in OR opt-out, but always a free opt-out). Automated calls always need prior opt-in. Email/SMS/MMS need prior opt-in, with the soft opt-in exception. Fax needs prior opt-in. Since 2009 the ePrivacy restrictions cover both B2C and B2B, so there is no generic B2B exception.
| Channel | Consent basis | Key conditions |
|---|---|---|
| Post | Opt-out (legitimate interests) - some states require consent | GDPR only; no ePrivacy. Balance interests; some states (Belgium, Greece, Spain) mandate consent; cleanse national registers where required (e.g. Austria, Denmark, NL) |
| Live phone call (person-to-person) | Member-state choice: opt-in OR opt-out | Art 13(3): states decide; minimum is a free opt-out. Opt-out states (UK, Ireland) require cleansing the national TPS; some states (Austria, Hungary, Slovenia) mandate opt-in |
| Automated calling system (pre-recorded) | Opt-in (always) | Art 13(1): prior opt-in consent always required; some states (Poland, UK) require caller identity/contact details |
| Email / SMS / MMS | Opt-in (prior consent) | Art 13(1); soft opt-in exception for existing customers; must give valid opt-out address; sender not concealed; clearly a commercial communication |
| Fax | Opt-in (prior consent) | Art 13(1): prior opt-in consent required; in UK, cleanse the Fax Preference Service before B2B fax marketing |
Since 2009 the ePrivacy restrictions on unsolicited marketing apply to both B2C and B2B communications. Some states relax B2B (e.g. Germany allows B2B phone marketing on opt-out), but the GDPR still applies to employees' contact details, and national registers (e.g. the UK Corporate Telephone Preference Service / Fax Preference Service) must still be cleansed.