Marketing Automation and GDPR: What Retailers Must Do

Marketing automation is allowed under the GDPR, but each automated message needs a lawful basis. For marketing emails and SMS to individuals, that basis is usually prior consent, with one exception for existing customers buying similar products. Every message must offer an easy way out, and you must be able to show where each contact's permission came from.

This guide is for independent retailers who send automated emails, texts or WhatsApp messages, or who segment their customer list. It explains which rule applies to which message, shows a worked example of consent wording, and links every rule to its official text. It is general information, not legal advice; for a specific case, ask your data protection officer or a lawyer.

Last reviewed: October 2026.

Two laws, not one

Retail marketing automation sits under two sets of rules:

• The GDPR (Regulation 2016/679) governs all processing of personal data: the lawful basis (Article 6), what valid consent is (Articles 4(11) and 7), people's rights, and your duties as the business that decides how the data is used.
• The ePrivacy Directive (2002/58/EC), as transposed in each country, adds specific rules for electronic marketing messages (Article 13) and for cookies and trackers (Article 5(3)). In France the email rule is in article L34-5 of the Code des postes et des communications électroniques; in the UK it is regulation 22 of PECR.

For marketing messages, the ePrivacy rule is the one that decides whether you may send at all. The GDPR then governs how you handle the data.

Which rule applies to which automated message

The EDPB Guidelines 05/2020 on consent add two points retailers often miss: a pre-ticked box is not consent, and consent cannot be made a condition of a purchase or a giveaway entry when it is not needed for it (GDPR Article 7(4)).

A worked example: collecting consent at checkout

Here is checkout wording for a shop that wants to email offers both to customers and to newsletter sign-ups. It is an illustration to adapt with your own details, not a legal template.

Why it works: the box starts unticked, it names the channel (email), it names the sender, it says how to stop, and it points to the privacy notice that explains the rest (GDPR Articles 7 and 13). The order still goes through if the box stays empty.

Then record, for each contact, when they agreed and where (checkout, in store, sign-up form). Under GDPR Article 7(1) you must be able to show that consent was given.

Five duties that automation makes easy to forget

1. Keep only what the campaign needs. An email address and a first name usually suffice. Data minimisation is a principle, not a suggestion (GDPR Article 5(1)(c)).

2. Make the exit automatic. Every email needs a working unsubscribe link, and an unsubscribe must suppress the address in every future send, including the ones already scheduled.

3. Answer requests within one month. Access, correction and erasure requests must be answered without undue delay and at the latest within one month (GDPR Article 12(3)).

4. Have a contract with every tool that touches the data. Your email platform, SMS provider and marketing software act as processors and need a written agreement covering what Article 28 requires.

5. Write down what you do. A record of processing activities (Article 30) lists what data you hold, why, for how long, and who receives it. For a small shop this can be a single page.

Fines for breaching the core principles or people's rights can reach €20 million or 4% of worldwide annual turnover, whichever is higher (GDPR Article 83(5)). In practice, regulators also act on complaints, which is why an easy unsubscribe matters as much as the consent box.

What Liflio does, and what stays with you

Liflio is a marketing platform for independent retailers. For email, WhatsApp and Telegram campaigns it handles part of the mechanics:

• Each contact carries a consent status (granted, unknown or revoked) with the date and the source. Contacts you import are only mailable if you confirm they opted in; contacts with an unknown status are skipped at send time.
• Unsubscribes are enforced. Emails carry an unsubscribe link and a one-click List-Unsubscribe header, and unsubscribed, bounced or complaining addresses go on a suppression list that every later send checks.
• WhatsApp messages use approved templates sent to opted-in contacts.
• The providers that process data on our behalf are listed on our subprocessors page.

What stays with you: deciding your lawful basis, collecting consent with honest wording, keeping the proof, answering requests, and writing your privacy notice. No software makes a shop compliant on its own. For giveaways, which raise their own consent questions, see the EU giveaway rules guide.

FAQ

Do I need consent to email my existing customers?

Not always. Under the ePrivacy Directive, you may email existing customers about similar products you sell without prior consent, if you offered an opt-out when you collected the address and in every message. Someone who only created an account without buying is not a customer for this purpose.

Is double opt-in required by the GDPR?

No. The GDPR requires consent you can prove, not a confirmation email. Double opt-in is one practical way to prove that the owner of the address signed up, so many senders use it. A timestamped record of where and when consent was given is the minimum.

Can I use legitimate interest for marketing emails?

For emails and SMS to individuals, the ePrivacy rule applies first: prior consent, or the existing-customer exception. Legitimate interest (GDPR Recital 47) is more relevant to postal marketing and to business contacts. Whatever the basis, people can always object to direct marketing.

Is segmenting my customer list allowed?

Yes, segmenting by purchase history or location is profiling for direct marketing, which is allowed. Tell people about it in your privacy notice, and stop if someone objects (GDPR Article 21(2)). Decisions with legal or similarly significant effects, such as refusing credit, fall under stricter Article 22 rules.