Sending newsletters legally in Germany and the EU: consent, existing customers, proof

Reviewed by: Holger D. Erbe, Managing Director of LOGIN SystemHaus GmbH Published: August 2, 2026 Last reviewed: August 28, 2026

In Germany, marketing emails require permission. This article explains what matters: when you need consent, when the exemption for existing customers applies, what you need to log and what every email must include. It covers German and EU law, which applies when you email recipients in Germany and the rest of the EU.

General information, not legal advice. LOGIN SystemHaus GmbH is not a provider of legal services. If in doubt, and before larger mailings, it is worth having a lawyer take a look.

The principle: no consent, no advertising

Under Section 7 of the German Unfair Competition Act (UWG), advertising by email without the recipient's prior express consent is an unacceptable nuisance. This applies to consumers and businesses alike. A business card handed over at a trade show is not consent, and neither is an address listed in a website's legal notice.

Express means active, informed and for this specific purpose. A pre-checked box is not consent, and neither is a box that accepts the terms and conditions at the same time. The recipient has to know who wants to send them what.

On top of that, the General Data Protection Regulation (GDPR) requires a legal basis for processing the address and imposes information obligations on you. Both sets of rules apply side by side. Consent under one does not replace the requirements of the other.

The exemption for existing customers

Section 7(3) UWG allows advertising to existing customers without separate consent if all four conditions are met:

1. You received the address from the customer in connection with the sale of goods or services.
2. You only use it to advertise your own similar goods or services.
3. The customer has not objected to this use.
4. When the address is collected, and in every single email, the customer is clearly told that they can object at any time without incurring any costs other than the transmission costs.

The sticking point is usually “similar.” If you sold software, you may write about software, but not about a new consulting service in a different field. And the exemption only covers customers, not prospects who have never bought anything.

Double opt-in: how it works and what to log

If it comes to a dispute, you have to prove that consent was given. The standard method, and in practice the only reliable one, is double opt-in:

1. The prospect enters their email address.
2. They receive an email with a confirmation link and no other promotional content.
3. Only when they click that link are they subscribed.

You need to log the time of signup, the time of confirmation, the exact wording of the consent text and the technical process. The last point is often forgotten and is the most important one: you must be able to reconstruct the text as it was back then, not as it reads today.

Consent goes stale. Consent given years ago and never used since no longer reliably holds up in court.

What every email must include

• An unsubscribe link that works without logging in and takes effect immediately. A link to a contact form is not enough.
• A legal notice with the information required by Section 5 of the German Digital Services Act (DDG).
• A note on where the address came from, if you rely on the existing-customer exemption.
• An honest subject line. Disguising the promotional nature of an email is a separate violation.

Unsubscribes must take effect without delay. The classic court case is the email that arrives twice more after someone unsubscribed, because a second system did not know about the list.

What your sending service provides, and what remains your job

A sending service takes care of the technical side: encryption, signing, delivery, logging, a data processing agreement (DPA) and server location. It cannot judge whether your addresses were collected properly, and it takes no responsibility for that either.

That is why MailBridge does not allow purchased or rented address lists or cold outreach by email. The details are in our Terms of use. The reason is not principle for its own sake: a single send to a purchased list damages the reputation of the sending infrastructure that every other customer also uses to send their invoices.

On the technical side, newsletters are no different from any other email: without SPF, DKIM and DMARC, even a fully compliant newsletter ends up in the spam folder.

Common misconceptions

• “B2B is allowed.” No. Section 7 UWG does not distinguish between consumers and businesses. An address like info@customer.com is protected just the same.
• “Legitimate interest is enough as a legal basis.” That may hold up for the data processing in individual cases, but not for whether the marketing email itself is permitted. The UWG requires consent regardless.
• “We copied the address from their website.” A published address is a way to get in touch, not consent to advertising.
• “But the newsletter is free.” Advertising is not tied to an invoice. A free mailing that is meant to promote sales is advertising, too.
• “Asking once will be fine.” The email in which you ask for consent is itself advertising and subject to the same rule.

What happens when it goes wrong

The usual consequence is not a government agency but an Abmahnung, a formal warning letter from a lawyer demanding that you sign a cease-and-desist declaration backed by a contractual penalty, plus the costs. Once you sign, the next violation triggers that penalty, and the next violation happens quickly when an unsubscribe does not reach a second system.

Data protection authorities can also step in if the processing of the addresses itself is challenged. In practice, the warning letter is the more common and faster route.

The real damage is usually something else: complaints hurt your sender domain's reputation, and that then affects invoices and order confirmations that have nothing to do with the newsletter.

A short checklist before you send

1. Does every address come from a documented signup or a genuine business relationship?
2. Can you still prove the consent text as it was back then?
3. Does the content match what people consented to?
4. Does the unsubscribe link work, and does it take effect in every system?
5. Are the legal notice and an honest subject line in place?
6. Are SPF, DKIM and DMARC in order?
7. Are hard bounces from the last mailing suppressed?