You Ask, I Answer: GDPR and Email Marketing?

In today's episode, Naureen asks, I am ramping up emails in the EU, and I am looking for current best practices in terms of emailing with respect to GDPR rules. Do any of you folks use outside services to warm up your cold leads so they are compliant with GDPR? You can't. You can't do that. Um GDPR, which is the general data protection regulation uh in the EU passed in 2018, or enacted into law, it became operable in 2018, explicitly forbids this exact thing.

Um you cannot email a cold list of leads. You can't. Um, because you don't have consent, and more importantly, you don't have consent for marketing purposes. Right. That is what GDPR really focuses in on.

Is do you not just have blanket consent, but do you have consent for the individual purposes? So if you collect data for sales purposes, um, and you've gotten permission from the user to do that, you cannot use it for marketing purposes. Just like if you collect data for customer service purposes, you cannot use it for marketing purposes. You have to ask for that consent separately. Um the fees, the fines, and the penalties are really, really bad and really, really strict.

Uh, we're talking uh millions of dollars potentially in fines. Far bore far beyond what anything in the United States has for unsolicited or for improper use of data. So suppose you have a list of email addresses. What can you do with it and still be compliant with GDPR? Not much.

I mean about the only thing you could do is hash it, which means encrypt it, and then load the encrypted version into a system of advertising that allows you to send retargeted ads towards those individuals, asking them to opt in or asking them, you know, basically advertising like your newsletter or what have you. And even that you'd want to ask a lawyer if you're allowed to do that, right? Because under the law, if you have somebody's personal information and they didn't give you consent for it, I'm not sure you can even use it for that. Again, check with the lawyer. I am not a lawyer.

This is not a lawyer here in any way, shape, shape, or form. Honestly, the safest thing to do would be to take that list of cold leads and shred it. Right? Or hit the delete key and make it go away so that you are not in possession of information you should not have and you're not tempted to use it. So what do you do instead?

How do how do you build and grow uh a marketing list that is GDPR compliant? Ads, right? Run ads in the target market, not using personal information, just using aggregated demographics or firmographics or whatever, advertising your stuff. Um do any normal inbound marketing, right? So create great content that people in the EU can find and subscribe to your stuff.

Make a podcast, make videos on YouTube, any all of the inbound methods where a person comes to you and proactively and voluntarily gives you consent to user information for marketing data, that is okay. That will pass muster in the EU, in China, in California, and all the places where data privacy regulation exists and is stringent. Inbound marketing, permission based marketing is the easiest, simplest, and legally strongest way of doing your marketing. And again, run ads too. Ads are a little bit more outbound, but again, if you're using a system like Google Ads or YouTube ads or whatever, and you're not retargeting based on data that you shouldn't have, you're just using general advertising targeting, again, that's totally fine.

There are no legal issues with doing broad-based, you know, awareness-based advertising to big market segments, right? So you're targeting business owners, or you're targeting people between the ages of 45 and 54, or you're targeting people in the country of Belgium. All that totally cool, uh, legally compliant, and and I think this is relevant given the nature of the question, is that before you do any of these campaigns, go to your website and make sure that all of your forms and data collection are compliant, right? Have your legal team or your legal council or your your law firm or whoever uh review it all, review your privacy policies and things like that to make them GDPR compliant. Uh they should be already, like GDPR has been in effect since 2018.

So if you're doing business in the EU and you're not compliant, you are playing you're playing Russian roulette with a semi-automatic. Which if you don't know what those are, then not as relevant. Anyway, it's a bad idea, right? You want to make sure that if you are doing business in the EU, if you are a legal entity that does business uh with it, the people who are within the EU, and by the way, that applies to everybody within the physical borders, not just EU citizens. So if you're an American who is in Paris, while you are in Paris, you are subject to the rules of GDPR, because you are on European territory.

And so for that time, GDPR applies to you. So a company emailing you and they didn't have your consent to send you marketing email. If you get that email while you are in Paris, uh, you could press charges against that company. So go through and make sure that all of your website and uh all your data collection uh techniques are all compliant uh to make sure that you're not gonna be massively legally exposed within within the EU. And by the way, within China, and especially after 2023 in California, uh in the United States, because California's CPRA regulations take effect January 1, 2023, and they are much more stringent than the CCPA registr legislation that is in effect now and took effect, I believe, in 2020.

So good question. Take any information that you do not have consent for and toss it. Thanks for asking.