General Data Protection Regulation (GDPR) from the European Union
What is the General Data Protection Regulation?
The European Union General Data Protection Regulation (GDPR) has applied since May 25, 2018. It is a single privacy law that sets the rules for how organizations collect, use, store, and share personal data about people in the EU's 27 member states and the wider European Economic Area (Iceland, Liechtenstein, and Norway).
GDPR is not just a European concern. Under Article 3, it also applies to businesses outside the EU that offer goods or services to people in the EU or monitor their behavior. If a U.S. business emails, texts, or tracks EU subscribers, GDPR likely applies to that data.
For DailyStory customers, the biggest impact is on how you collect, record, and honor consent from email and SMS subscribers. DailyStory cannot enforce compliance for our customers, but it includes the tools you need to comply. GDPR is also different from the California Consumer Privacy Act; make sure you understand the differences.
Key takeawaysCollect clear, opt-in consent and keep proof of it. Make unsubscribing as easy as subscribing. Honor data requests like erasure promptly. In 2026, regulators in France also began requiring separate consent for email open-tracking pixels, so measure campaigns by clicks and conversions instead of opens.
GDPR at a glance
| Topic | What to know |
|---|---|
| In effect since | May 25, 2018 |
| Where it applies | EU and EEA, plus businesses abroad that market to or monitor people there |
| UK | Covered separately by the UK GDPR and PECR after Brexit |
| Who enforces it | Each country's data protection authority, coordinated by the European Data Protection Board |
| Maximum fines | Up to EUR 20 million or 4% of global annual turnover, whichever is higher |
| Most common reason for fines | Insufficient legal basis for processing data |
Email and SMS marketing in Europe is also governed by the ePrivacy Directive, which each country implements in its own law. GDPR defines what valid consent is, and the ePrivacy rules decide when you need it for electronic marketing.
Consent must be freely given and opt-in
For most email and SMS marketing to EU residents, you need the subscriber's consent first. Under Article 4(11) and Article 7, consent only counts if it meets all four of these conditions:
| Condition | What it means | Example |
|---|---|---|
| Freely given | A real choice, with no penalty for saying no | Don't require newsletter sign-up to complete a purchase or download |
| Specific | Separate consent for each purpose | Separate checkboxes for email, SMS, and partner offers |
| Informed | People know who you are and what they're agreeing to | Name your business, describe what you'll send, and link your privacy policy |
| Unambiguous | A clear, affirmative action | An unchecked box the subscriber checks; pre-checked boxes and silence don't count |
The simplest approach is an unchecked checkbox next to clear consent language on every web form. Many businesses also use double opt-in, sending a confirmation message before adding someone to a list. GDPR doesn't strictly require it, but it is strong proof that the person who signed up owns the address. Learn more about double opt-in.
The soft opt-in exception
Many EU countries allow a "soft opt-in" for existing customers. If someone bought from you, you may be able to email them about similar products as long as you gave them a chance to opt out when you collected their address and in every message. The rules vary by country, so check local requirements before relying on it.
Consent must be easy to withdraw
Article 7(3) requires that withdrawing consent be as easy as giving it. People must be able to unsubscribe without logging in or jumping through multiple steps.
All DailyStory marketing emails include an unsubscribe link in the footer and a list-unsubscribe header, which lets email clients like Gmail show a built-in unsubscribe button. The unsubscribe link does not require a login. For text messages, DailyStory processes STOP replies automatically.
Keep evidence of consent
Article 7(1) puts the burden of proof on you. You must be able to show who consented, when, how, and to what, along with a record of whether consent was later withdrawn.
DailyStory keeps a full audit trail of consent actions on each contact record, including opt-ins and opt-outs, so you have that record if a subscriber or regulator asks.
Review older and imported lists
Contacts collected before you adopted GDPR-compliant forms, imported from another system, or bought from a third party may not have valid consent. If you can't prove consent that meets GDPR standards, don't email those contacts. A re-permission campaign, sent only where you have a lawful basis to make contact, can confirm consent from older European subscribers. Purchased lists should never be used for EU marketing.
Respect data subject rights
GDPR gives individuals several rights over their data. You generally must respond to requests within one month.
| Right | What the person can ask for | What it means for marketers |
|---|---|---|
| Access (Art. 15) | A copy of the data you hold about them | Be able to export a contact's profile and activity |
| Rectification (Art. 16) | Corrections to inaccurate data | Update contact records when asked |
| Erasure (Art. 17) | Deletion of their data, also called the "right to be forgotten" | Delete the contact and stop all processing |
| Data portability (Art. 20) | Their data in a common, machine-readable format | Provide a CSV or similar export |
| Objection (Art. 21) | To stop direct marketing at any time | An objection to marketing is absolute; stop immediately |
Contact records in DailyStory are maintained at our customers' discretion. As the business that collected the data, you are responsible for honoring requests, such as deleting a contact when asked to erase their data.
Email tracking pixels now need consent in France
On April 14, 2026, France's data protection authority, the CNIL, published its recommendation on tracking pixels in emails. It treats open-tracking pixels like cookies: using them to measure open rates or personalize campaigns generally requires separate, prior consent, independent of the consent to receive the email. The transition period for existing contacts ended July 14, 2026.
| Pixel use | Consent needed under the CNIL recommendation? |
|---|---|
| Measuring open rates to optimize campaigns | Yes |
| Personalizing content or targeting based on opens | Yes |
| Sharing open data with third parties | Yes |
| Narrow deliverability and security uses | Limited exemptions, with transparency still recommended |
Open rates were already unreliable because of Apple Mail Privacy Protection, and this makes them harder to use for European audiences. Shift your reporting toward clicks, conversions, and revenue. Be aware that personalized tracking links can also raise consent questions, so review your setup with counsel if you email French subscribers. Our guide to UTM codes explains how to measure campaign results on your own site.
The penalty for GDPR non-compliance
Under Article 83, fines have two tiers: up to EUR 10 million or 2% of global annual turnover for some violations, and up to EUR 20 million or 4% for the most serious, including violations of consent rules and individuals' rights. Whichever amount is higher applies.
Enforcement is real and growing. The CMS GDPR Enforcement Tracker Report recorded 2,685 fines totaling about EUR 6.11 billion as of March 2026, and insufficient legal basis for processing data remains one of the most common reasons. Fines are not reserved for big tech; Spain's regulator alone has published more than 1,000 fines, many against smaller businesses.
What's changing: the Digital Omnibus
In November 2025, the European Commission proposed a "Digital Omnibus" package that would amend parts of the GDPR and move cookie consent rules into it. The AI-related part became law in 2026, but the GDPR and ePrivacy changes were still in first reading as of September 2026, with more than 1,750 amendments tabled. Until a final text is adopted, the GDPR applies in full and unchanged.
GDPR checklist for email and SMS marketers
Frequently asked questions
Does GDPR apply to U.S. businesses?
Yes, if you offer goods or services to people in the EU or EEA, or monitor their behavior, such as by tracking email engagement. Where your company is based doesn't matter.
Is double opt-in required under GDPR?
GDPR doesn't explicitly require it, but you must be able to prove consent. Double opt-in is one of the most reliable ways to do that, and regulators and courts in some countries expect it.
What should I do if someone asks to be forgotten?
Delete their personal data from your marketing systems, stop all processing, and confirm the deletion within one month. Keep only what another law requires you to keep.
This article is general information, not an exhaustive analysis of GDPR. Consult a privacy attorney about how GDPR and national ePrivacy laws apply to your business.
Additional reading on GDPR
- Official GDPR text on EUR-Lex
- GDPR articles and recitals, organized by topic
- CMS GDPR Enforcement Tracker Report
- CNIL recommendation on email tracking pixels (PDF)