A B2C newsletter publisher buys a cold email list from a broker and begins promotional campaigns to EU recipients with whom it has no prior relationship and no recorded consent. What is the soundest compliance conclusion?
Select an answer to reveal the explanation.
Short Explanation
Buying a list is not the same as earning permission. Under the ePrivacy-plus-GDPR stack, cold B2C email usually needs consent—or a genuine prior customer soft-opt-in—not a broker handshake. If you never met these people, hitting send is the compliance problem.
Full Explanation
A B2C newsletter publisher that buys a cold email list from a broker and begins promotional campaigns to EU recipients with whom it has no prior relationship and no recorded consent should conclude that electronic direct marketing to individuals typically requires prior consent or a qualifying soft-opt-in style prior relationship; cold bought-list spam generally fails that standard. Buying a list is not earning permission from people. Claiming bought lists are always lawful under legitimate interests for any B2C promotional email fails ePrivacy overlays that commonly demand consent. Saying GDPR alone never regulates marketing email once a list is purchased fails—GDPR still applies and ePrivacy still constrains electronic mail. Asserting a broker indemnity promising the list was ‘compliant’ substitutes contract theatre for a valid legal basis and data-subject rights. Exam caveat: soft-opt-in, where implemented nationally, is narrow (own similar products, existing customers, prior chance to refuse)—not a blanket blessing for brokered cold lists. Operational check: stop cold campaigns, suppress unverified contacts, rebuild permissioned lists, record consent or soft-opt-in evidence, and contractually forbid brokers from supplying non-permissioned EU consumer emails.