gdpr
GDPR: Receiving marketing as precondition for receiving a free service, legitimate interest?
<p>I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service.</p>

<p>The UK ICO <a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/" rel="nofollow noreferrer">documentation on GDPR definition of legitimate interest</a> says that emails/text messages to individuals – obtained using ‘soft opt-in’ are allowed.</p>

<p>From their <a href="https://ico.org.uk/media/for-organisations/documents/1555/direct-marketing-guidance.pdf" rel="nofollow noreferrer">direct marketing guidance:</a></p>

<blockquote>
  <p>The term ‘soft opt-in’ is sometimes used to describe the rule about
  existing customers. The idea is that if an individual bought something
  from you recently, gave you their details, and did not opt out of
  marketing messages, they are probably happy to receive marketing from
  you about similar products or services even if they haven’t
  specifically consented. However, you must have given them a clear
  chance to opt out – both when you first collected their details, and
  in every message you send.</p>
</blockquote>

<p><em>(They go on to say that soft opt-in doesn't necessarily require a sale, merely e.g. a request for a quote, and that this only applies to commercial organizations, not charities).</em></p>

<p>This would appear to allow emailing existing customers, but then that is possibly contradicted by the following (from direct marketing guidance linked above)</p>

<blockquote>
  <p>The ICO recommends that organisations do not make consent  to
  marketing a condition of subscribing to a service unless they  can
  clearly demonstrate how consent to marketing is necessary  for the
  service and why consent cannot be sought separately. It is also
  relevant to consider whether there is a choice of other  services and
  how fair it is to couple consent to marketing with subscribing to the
  service.</p>
</blockquote>

<p>Possibly when the service is free then it might be argued that it is necessary and fair to couple consent to marketing with subscription to the service. (Though remember I am aiming to define this activity as legitimate interest rather than consent if possible - so am confused as to why consent now applies). However they also say <a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/" rel="nofollow noreferrer">this</a></p>

<blockquote>
  <p>It is not enough to argue that processing is necessary because you have chosen to operate your business in a particular way.</p>
</blockquote>

<p>Unfortunately this would appear to scupper the "free service in exchange for marketing" business model.</p>

<ol>
<li><p>If the user is allowed to withdraw consent on signup (or afterwards) then they can obtain the free service without marketing - even though this may cost the company money which they could only justify spending if it generates a marketing lead</p></li>
<li><p>Requiring consent on signup also, obviously, might affect signups pre GDPR implementation</p></li>
</ol>

<p>So the question - how can free-service-in-exchange-for-marketing be justified under GDPR (1) for commercial organizations? and (2) for nonprofits?</p>

<p>You have to distinguish two related matters here:</p>

<ol>
<li>Permission</li>
<li>Obtaining permission</li>
</ol>

<p>The "opt-in" versus "opt-out" discussion is about the process by which you may gain permission for marketing. But either way, you may end up with customers that refuse to receive marketing.</p>

<p>Now there are cases in which it doesn't really make sense to talk about the distinction between marketing and the service itself. For instance, a cinema may have a newsletter announcing which movies will run on which date, with short descriptions of them. It's just not reasonable to expect that they put out a "marketing-free" newsletter stating the dates on which the cinema is open, omitting the actual movies! That's just silly. Permission for the newsletter includes permission for the embedded marketing of the movies. Still, that newsletter is independent from the actual cinema service itself. </p>

<p>In your case, it appears that there is no relation between the marketing and the actual service. That is to be expected. As such, the GDPR is aimed straight at you. And you guessed that from the last "how you've chosen to operate your business" quote. Non-profits fall under the GDPR as well.</p>

<p>PS. you mentioned the "legitimate interest". That's not at all relevant. A rental company has a legitimate interest in keeping track of their customers and sending them emails when the rentals are overdue, for instance. The legitimate interest in this case is the care for their property.</p>
