Email advertising and newsletters: Consent and existing customers

The general rule in section 174 paragraph 3 of the Telecommunications Act 2021 is short but far-reaching. Electronic mail for direct marketing purposes requires prior consent of the recipient. Electronic mail includes email in particular, but also other text messages distributed over networks. Voice advertising calls and automatic call systems are governed by paragraphs 1 and 2 with comparable strictness.

The term direct marketing is understood broadly. It covers all content intended to promote the sale of goods or services, whether the sender is the beneficiary or a third party. A purely informational appearance does not protect the message where it also carries a commercial statement. Service information about an existing contract is not advertising as long as it is not combined with new offers.

The basis for processing the address under the GDPR is a separate question. Valid consent under data protection law does not automatically replace consent under the Telecommunications Act. A permitted data use does not make sending a commercial message lawful either. Both checks must be documented separately when the campaign is released.

Under section 174 paragraph 4 of the Telecommunications Act 2021, existing customers may be contacted without prior consent where four requirements are met together. First, the contact information must have been obtained in the context of a sale or service by the sender to that customer. A simple registration form without any contractual relationship is not enough.

Second, the message must promote only the sender own similar products or services. Additions and follow-up products in the same use environment are covered. A fundamentally different category falls outside the exception. Third, the recipient must be able to refuse the further use clearly, easily and free of charge at collection and in every subsequent message. The refusal must not create additional cost.

Fourth, no prior objection may exist. In particular, the address must not be entered in the list under section 7 paragraph 2 of the E-Commerce Act, known as the ECG list. If one of the four requirements is missing, sending without a separate consent is not permitted. The four conditions operate as one closed package and cannot substitute for one another.

The ECG list is a central register in which persons and businesses can request that they receive no commercial communication by electronic mail. The register is maintained by the Austrian regulator RTR and is also known as the Robinson list. An entry has effect against every sender.

Before each mailing to an Austrian recipient, the mailing list must be compared with a current extract of the ECG list. The comparison should be traceable. A defined procedure, a technically recorded moment of comparison and preservation of the result are useful in practice. Only then can it later be shown that no entry existed at the time the message was sent.

A single comparison is not enough for ongoing newsletters. The address base has to be checked again before every new send. In automated campaign flows the check and its outcome belong in the release protocol. Where an address is blocked, it must be removed from every affected list and flagged so that it will not be used again.

Under section 174 paragraph 5 of the Telecommunications Act 2021, several situations are expressly prohibited. The identity of the sender must not be concealed or disguised. A breach of section 6 paragraph 1 of the E-Commerce Act must be avoided, especially the failure to identify a commercial communication, an unclear sender indication or unrecognisable offers and promotional actions with their conditions.

Links must not lead to websites that breach the E-Commerce Act or other advertising rules. In addition, an authentic address must exist where the recipient can refuse further messages. A reply to an unmonitored inbox or a link without any real effect is not enough.

The unsubscribe link should be clearly visible in every message, should work without login or extra steps and should take effect immediately. Unsubscribes must be processed reliably, across systems and quickly on every mailing list. Failures at this point rarely concern one newsletter alone. They usually affect the entire sending environment.

The existing-customer exception applies only to your own similar products or services. What counts as similar follows from the concrete use environment and the customer expectation at the original contract. A short segment logic in the CRM helps to build lawful selections and records the basis of the choice.

Newsletters with mixed content are especially sensitive. Once an editorial message contains an offer, discount or purchase incentive, it is treated as commercial communication. The separation between information and advertising should be clearly recognisable. Purely contractual information such as contract confirmations or security notices remains permissible where no additional advertising is added.

The advertising claims self-check organises the type of claim, the audience, evidence and visible qualifications. For an email campaign, record additionally which segment the recipients come from, which customer relationship exists and how similarity to the original purchase is justified.

In practice, complaints about unwanted email advertising often reach the Austrian Telecommunications Office. In parallel, competitors or associations may act under the UWG because unlawful commercial communication may also constitute an unfair commercial practice. Both routes can run at the same time and may call for separate responses.

The article on a UWG cease and desist letter from a competitor or association explains the separate review of the claim, undertaking and evidence. The article on the limitation of injunction claims under section 20 UWG sets out the time frame for possible claims.

The sending business should be able to demonstrate valid consent or every condition of the existing-customer exception in full. Sign-up moment, confirmation message, stored consent wording, change logs and unsubscribe records must therefore be preserved so that they can later be presented. Screenshots taken after the fact are rarely sufficient.