You’ve probably already heard about the General Data Protection Regulation (GDPR) and the CCPA (California Consumer Privacy Act), which both came into effect in 2018. You also probably know that they have produced a great deal of implications regarding data privacy and processing for businesses operating in the European Union (EU), the state of California, and around the world. However, you might not be entirely clear on what that means for your email marketing strategy.
In order to address this, we’ve assembled our top five considerations to keep in mind when making sure your email marketing strategy is GDPR and CCPA compliant.
If you keep these points in mind, consult the official GDPR and CCPA websites, and even use a software like Osano or consult a professional in your area, and you’ll be sure to have your email marketing strategy up and running and compliant in no time.
1. Consider your opt-in process
When it comes to your email marketing strategy, one of the most important implications resulting from GDPR and CCPA regulations are related to your opt-in process. Basically, you need to review the process your subscribers go through when opting-in to receive your marketing communications.
The GDPR, or General Data Protection Regulation, is an EU law that applies to any business operating in the EU or European Economic Area (EEA), as well as any business providing goods or services to EU or EEA citizens from another geographic area.
The GDPR has broader implications for your opt-in process as it requires that you obtain consent before sending marketing communications. It specifies that this consent should be “freely given, specific, informed, and unambiguous,” via “a clear affirmative action.” That means that you cannot assume consent or present subscribers with pre-filled out forms. They must provide consent completely by themselves.
Although it’s not required by the GDPR, many email marketers choose to implement a double opt-in system in order to be sure that their customers have consented to receiving communications. That means that once subscribers opt-in, they receive another email in which they have to confirm their subscription. If you choose not to use a double opt-in, be sure that your customers directly consent to receiving communications from you in your opt-in process.
The CCPA, or California Consumer Privacy Act, is a California law that applies to businesses operating in California or providing services to California residents. Now that we know what the CCPA is, know that this law has less implications for your opt-in process as it does not require consent to collect or use personal information. However, it does have some implications for opting-out or unsubscribing, which we’ll discuss further below.
2. Review your existing subscribers
While ensuring that your email marketing strategy is GDPR and/or CCPA compliant, there are a few reasons why you might need to review your existing subscriber list.
The GDPR and the CCPA do not require that your business obtain consent from your existing subscribers again. However, especially in the case of the GDPR, you need to review whether your existing subscribers went through an opt-in process that conforms with law. If you find that you have subscribers on your list that did not properly provide consent to receive marketing communications in your opt-in process, you may need to review your opt-in process and ask them to go through it again.
Second of all, it’s a good idea to review your existing subscribers to determine whether the GDPR or the CCPA (or both!) apply to your business. That means thinking about the geography of your customer base.
While the GDPR is an EU law and the CCPA is a California law, your business is not necessarily exempt from complying with these laws if it’s not located in the European Union or California. It can also apply to you if you do business with or provides goods and services to citizens of the European Union or California.
Additionally, even if your business is not obligated to comply with the GDPR or the CCPA, it’s a good idea to do so regardless. These laws are considered landmarks and are likely to spur similar legislation around the world in the years to come. Thoughtful, ethical data collection and privacy regulations are just good business practices at the end of the day.
3. Make sure it's easy to unsubscribe
When it comes to the GDPR and the CCPA, your email marketing unsubscribing process is just as important as your opting-in process. Just as it has to be easy and straightforward to provide consent to receive marketing communications, your subscribers also have to have the ability to stop receiving them at any time.
In order to be compliant with GDPR regulations, you need to do more than just provide subscribers with a way to opt-out when they receive marketing communications. It should be easy to do so. On top of always providing an unsubscribe button at the bottom of emails, you shouldn’t make subscribers jump through hoops to opt-out successfully.
Specifically, you should not:
- Ask subscribers to visit multiple pages or click multiple links to process their request
- Require any information other than the subscribers' email address (although you can ask for it, optionally)
- Oblige subscribers to log in to their account
- Take subscribers to an opt-out page where the opting-out process is unclear
If you want to be sure that subscribers are opting out intentionally, you can provide multiple opt-out options. For example, ask them whether they want to unsubscribe from all communications, or just a specific kind. Air Canada provides a good example of this, pictured above.
In terms of the CCPA, the opting-out requirements are associated with the sale of personal information. In order to be compliant, you must provide customers with a clear option to opt-out of the sale of their personal information to third parties. This is usually done with a “do not sell my personal information” link or box.
4. Think about the data you collect and process
In order for your email marketing strategy to be GDPR and CCPA compliant, your business needs to be mindful about the data you collect. Not only do you have to make sure that the data you collect is safe, but you also need to tell customers how you’re using it and why. The best way to achieve this is by making sure your subscriber data is stored securely and that you only collect data that’s absolutely necessary for your business.
When collecting customer data, ask what information your business absolutely needs. In the case of email marketing, that usually includes an email address and a contact name for communication personalization. That’s it. Any additional information should be assessed as to whether it’s actually necessary or not.
Most businesses account for data security in their privacy policy). Privacy policies usually cover details about data collection, storage, transfer, and processing. This should be communicated or sent to subscribers as well as kept in an easily accessible place.
Many compliant businesses also provide information about how customer information will be used and processed during the opt-in process.
5. See the positives in GDPR and CCPA compliance
Last of all, make sure to see the positives in making your business compliant with GDPR and CCPA regulations. Ever since they’ve come into effect, many businesses have been stressed and frustrated with having to change their processes and spend time and resources on making themselves compliant.
While it’s true that it can be a lot of work ensuring that your business is compliant with data privacy and processing regulations, keep in mind that it’s ultimately a good thing. This compliance will save you a lot of headaches down the road. Even more importantly, your relationship with your subscribers should be one of trust. It’s important that they know that you respect them as an individual, provide them with transparent and honest information, and that their data is secure and being responsibly processed.
Give yourself peace of mind by making your email marketing strategy compliant
Ensuring that your email marketing strategy is GDPR and CCPA compliant is a lot of work. It can be confusing, frustrating, and time consuming. Nevertheless, your efforts will pay off in the long run. Not only will you make sure that you aren’t subjected to any hefty noncompliance fines, but you’ll also be investing in your relationship with your subscribers. The GDPR and CCPA are landmark legislation for a reason: they represent important improvements in data processing and privacy and are paving the way for the future.
If you’re in the process of making your email marketing strategy GDPR or CCPA compliant, keep these tips in mind. Specifically, review your opt-in process, your existing subscriber list, your unsubscribing process, the data you collect, and your data storage & security.
If you’re really stuck, there are a variety of software online that can help ensure that your business is GDPR or CCPA compliant, like Osano. You can also consult data protection experts in your area.
Follow these steps and you’ll be GDPR and CCPA compliant in no time.