Right to opt out of direct marketing
Whatever the lawful basis, the GDPR gives individuals an absolute right to object to direct marketing. On consent, they withdraw consent; on legitimate interests, the opt-out is the right to object under Article 21, which can be exercised at any time and cannot be overridden by a balancing test. Marketers must inform people of this right at first contact, honour requests promptly and free of charge, and should suppress rather than delete contact details.
The right to opt out applies regardless of whether the lawful basis is consent or legitimate interests, and across all channels (post, phone, email, any other). It must be brought to the individual's attention at the first communication, clearly and separately from other information.
On opt-out, controllers should suppress (keep a do-not-contact record) rather than delete. Deleting risks re-acquiring the person's details later and marketing to them again, against their wishes. The marketer must also stop using any profiling data about them.
| Lawful basis | Mechanism | Can the controller refuse / balance? |
|---|---|---|
| Consent (Art 6(1)(a)) | Withdraw consent | No - withdrawal must be as easy as giving it |
| Legitimate interests (Art 6(1)(f)) | Right to object, Art 21(2) | No - objection to direct marketing is absolute, exercisable 'at any time' |
- Opt-outs must be honoured promptly and free of charge (no premium-rate-text-to-opt-out).
- Minor incidental costs (e.g. the individual's own ISP charging to send an email) don't make it 'not free'.
- Cleanse marketing lists against internal opt-out records before each campaign - and don't invite opted-out people to opt back in.
- Many member states run national opt-out registers ('Robinson Lists' / preference services). Failing to cleanse a Robinson List is usually a breach of specific national law, not of data protection law itself.
- A valid opt-in consent overrides a person's listing on a Robinson List.