Building a newsletter list the right way

A properly built subscriber list has only people who asked to get your emails, and you can prove it at any time. It's also the best list for sales: people who signed up on their own open your emails. The rules come from the GDPR and the EU directive on electronic communications, and in practice they boil down to a few things you build into the form from day one.

What "consent" means for a newsletter

The GDPR defines consent as a freely given, specific, informed and unambiguous indication of someone's wishes, given by a statement or a clear action. For a newsletter form, that means:

• The box isn't pre-ticked. The regulation says explicitly, in recital 32, that a pre-ticked box, silence or inactivity doesn't count as consent.
• Signing up is separate from other agreements. Accepting the terms of an order doesn't subscribe someone to your newsletter. The consent request has to stand out clearly from the rest of the text.
• People know what they're signing up for. Say next to the box what they'll get and how often: "one email a month with news and offers."

The European Data Protection Board's guidelines on consent (EDPB, 2020) go through each of these conditions with examples.

Keep the proof

The GDPR requires the controller to be able to demonstrate that the person gave consent. In practice, for each subscriber you keep: the date and time, where they signed up (the website form, the checkout counter, an event), and what text they saw next to the box.

Double opt-in helps here: after someone enters their address, they get an email with a confirmation link and only join the list after clicking it. The law doesn't spell it out as a requirement, but it gives you solid proof that the address is theirs and that they wanted in. Bonus: you weed out typos and joke addresses that would otherwise hurt your deliverability.

Existing customers: the exception with conditions

The EU directive on privacy and electronic communications (2002/58/EC) has a useful exception. If you got a customer's email address in the context of a sale, you can use it to send them offers for your own similar products or services without separate consent. The condition: the person must be able to object clearly and free of charge, both when they give you the address and in every message after that.

The exception doesn't cover bought lists, addresses from business cards collected at a trade show, or lists "from a partner." For those, you need consent.

Unsubscribing as easy as subscribing

The GDPR says withdrawing consent must be as easy as giving it. If signing up took one click, unsubscribing can't require logging in, a password or a form asking why.

On the technical side there's a standard for this: the List-Unsubscribe header, with the one-click unsubscribe version described in RFC 8058 (2017). Ask your newsletter platform whether it adds it and check that it's on. Alongside it, put a visible unsubscribe link in the footer of every email.

Where to collect subscribers

• On your website, with a short form: email, an unticked box, clear wording. Name is optional.
• At the counter or front desk, on paper or a tablet, with the same wording and the date noted.
• At events, with a QR code pointing to the form on your site, so you get the same proof.

A good reason to subscribe works better than any pop-up: a useful guide, early access to news, an offer just for subscribers. Whatever the reason, people need to know clearly what they're saying yes to.

If you'd like to launch your company newsletter together, see our marketing services.