Newsletters and GDPR: Consent and Unsubscribes
By CodexierPublished 5 min read
Email newsletters are one of the few marketing channels you own, and one of the most regulated. In Sweden two sets of rules apply at once: GDPR, which governs the personal data, and the Marketing Act, which governs when you may send marketing by email or SMS at all. This guide covers consent for new subscribers, the existing-customer exception, the difference between B2B and B2C, what every email must contain and what records to keep.
Consent for new subscribers
Under the Swedish Marketing Act, marketing by email to a natural person requires their prior consent. GDPR then sets the standard for what counts as consent: freely given, specific, informed and unambiguous. In practice that means a separate sign-up form, or an unticked checkbox at checkout, with text that says what they will receive and how often. A pre-ticked box, or consent hidden in the terms, does not count.
- Say what they will get: 'monthly newsletter with offers and news', not 'updates'.
- Do not make consent a condition of buying or of downloading something they need.
- Link to your privacy notice from the form.
- Double opt-in, where the subscriber confirms by clicking a link, is not required by law but gives you strong evidence and a cleaner list.
The existing-customer exception
The Marketing Act allows marketing email without prior consent to existing customers, under strict conditions. All of them must be met.
- You got the email address from the customer in connection with a sale.
- The marketing concerns your own products that are similar to what they bought.
- The customer was clearly offered the chance to opt out, free of charge, when the address was collected.
- Every email repeats that chance to opt out, easily and free of charge.
The exception does not cover someone who only made an enquiry, marketing for other companies, or products unrelated to the purchase. A shoe shop may email customers about shoes and accessories; it may not use the exception to sell its partner's insurance. The GDPR legal basis for this processing is usually legitimate interest, and you must still inform the customer about it.
B2B vs B2C rules
| Recipient | Marketing Act | GDPR |
|---|---|---|
| Private individual | Prior consent, or the existing-customer exception | Applies fully |
| Sole trader (enskild firma) | Treated as a natural person: same as private individual | Applies fully |
| Generic company address (info@) | No consent requirement, but identity and unsubscribe rules apply | Usually limited, as no individual is identified |
| Named employee at a company | Generally treated as marketing to the company when relevant to the role | Applies: the address identifies a person |
B2B email to named people needs a legitimate interest assessment, relevance to the person's role and an easy way to object. Buying lists does not remove these obligations.
What every email must include
- A clear sender: your company name, so the recipient knows who is marketing to them.
- Recognisable as marketing: the content must not pretend to be a personal message or an invoice.
- A working unsubscribe link that takes effect without login or payment, ideally in one click.
- A valid address where the recipient can object, which the Marketing Act requires for all recipients.
- Offers, discounts and competitions presented with their conditions clearly stated.
Most newsletter tools add the sender details and unsubscribe link automatically. Check that the link actually works, and that unsubscribes from one tool are honoured everywhere you send from.
Keeping records
GDPR requires you to be able to demonstrate consent. For each subscriber, store the date, the form or page used, the consent wording shown and, with double opt-in, the confirmation. Keep a list of unsubscribed addresses so they are not re-added by an import. Delete subscribers who have been inactive for a long time; it improves deliverability and reduces the data you hold. If your newsletter tool is separate from your CRM, make sure consent and unsubscribes sync both ways; see GDPR in your CRM.
When not to buy help: a small business with one sign-up form and a standard newsletter tool can follow this guide alone. When lists are merged from several sources, the existing-customer exception is used, or B2B and B2C mix, a review as part of our growth retainer can prevent expensive mistakes. Book a short call to go through your setup.
Frequently asked questions
Can I import my customer list into a newsletter tool and start sending?
Only if each customer either consented or falls under the existing-customer exception, including having been offered the chance to opt out when their address was collected. Otherwise, ask for consent first.
Is double opt-in required in Sweden?
No, but it is the easiest way to prove consent and it removes mistyped and fake addresses. Many businesses use it for that reason.
Do the rules apply to SMS as well?
Yes. The Marketing Act treats SMS marketing like email: prior consent from natural persons, with the same existing-customer exception.
Who supervises this?
The Swedish Consumer Agency supervises the Marketing Act rules, and the Swedish Authority for Privacy Protection (IMY) supervises GDPR.
Unsure whether your newsletter setup holds up?
Tell us where your subscribers come from and which tool you use. On a short call we will check consent, the existing-customer exception and your records.
Book a free 15-minute call