Newsletter and email marketing check

Newsletter and Email Marketing Check

Check whether newsletters, B2B mailings, lead magnets, existing customer advertising, marketing automation, tracking or CRM imports can trigger legal risks under the UWG, GDPR and TDDDG.

Start the check

UWG § 7 GDPR TDDDG / Tracking Consent Logs CRM & automation

What this check helps with

The check provides a preliminary classification of typical email marketing constellations: consent and double opt-in, the existing customer exception, B2B outreach, list imports, unsubscribe links, tracking pixels, sending tools, third-country transfers and evidence documentation.

Assess the risk level for a send, import or campaign
Identify review points for consent, evidence, tooling and template
Structure the preparation for a legal review

Visualisation

Email compliance control centre

A newsletter is not legally assessed only at the moment of sending. What matters is the chain of address source, consent, objection, tracking, tooling and evidence.

Check the address source

Before every send it must be clear where the address comes from, for what purpose it was collected and whether the specific sender and content are covered.

Orientation

Typical review path before sending

Clarify the recipient group

Prospects, existing customers, B2B contacts, webinar leads, old CRM data or third-party lists are assessed differently.

Check the legal basis

Consent, double opt-in evidence or the narrow existing customer exception are usually decisive.

Assess content and tracking

Advertising, partner offers, scoring, open tracking and click tracking can raise additional UWG, GDPR and TDDDG questions.

Secure the tooling

Sending tool, CRM, sub-processors, DPA, third-country transfers, role permissions and suppression lists must fit together.

Secure the evidence

Consent texts, DOI logs, form versions, unsubscribe logs, templates and send history should be documented in a traceable way.

Classification

What this check delivers

The check does not replace legal advice. It does, however, help to identify typical risk signals and prepare the next review in a structured way.

Electronic advertising generally requires a reliable basis. In addition, privacy information, unsubscribe, evidence, sending tool contracts and tracking/device access must be assessed properly. Large mailing lists, old consents, B2B outreach, lead magnets, purchased lists, profiling and international marketing tools need particularly careful review.

When is sending a newsletter particularly risky?

Sending is particularly risky without reliable consent, with purchased or scraped lists, a missing unsubscribe link, unclear consent texts, high sending frequency, sensitive target groups, partner advertising or existing complaints.

Is double opt-in always enough?

Double opt-in is a strong evidence signal, but it does not replace a review of the specific consent text, the advertised content, the sender, the tracking functions, the privacy information and the documentation.

What applies to existing customer advertising?

The existing customer exception is narrow. In particular, the sales context, your own similar products or services, clear notices of the right to object at collection and in every email, and a working opt-out process must be checked.

Why are tracking pixels and link tracking relevant?

Open and click tracking can raise data protection and device access questions. Consent, transparency, withdrawal, profiling, retention period, tool provider and third-country transfers must be reviewed.

Interactive check

Preliminary newsletter risk classification

Answer the following questions. At the end you receive a preliminary risk level, typical reasons, next review points and a copyable summary for your enquiry.

1 of 5

1. Which email marketing situation should be reviewed? Classic newsletterRegular marketing emails to prospects, customers, leads or subscribers. Existing customer advertisingAdvertising to existing customers for your own similar goods or services. Lead magnet, white paper or webinar funnelThe email address is collected in exchange for a download, checklist, webinar, discount or trial access. B2B mailings or sales outreachAcquisition, partner, event, webinar, trade fair or sales emails to business contacts. Marketing automation or trigger emailsWelcome series, cart abandonment, reactivation, nurturing, segmentation or scoring. Transactional email with advertising contentOrder confirmation, service email, invoice or account email contains advertising or cross-selling. List import, tool change or CRM migrationExisting contacts are transferred to a newsletter, CRM or marketing automation tool.

2. What is the send based on?

Please select everything that applies.

Double opt-in with evidenceSign-up, confirmation link, time, source, consent text and confirmation are documented. Single opt-in onlyThe email address was entered, but there is no confirmed DOI verification. Existing customer exception is to be usedEmail was collected during a sale; advertising concerns your own similar offers; objection is possible. B2B contacts / presumed interestBusiness contacts are to be contacted because of their role, a trade fair, network, enquiry or industry. Old consents or legacy dataConsents come from an old shop, old CRM, offline source, trade fair, prize draw or earlier tool. Purchased, rented or third-party listAddresses come from a data broker, partner, association, platform, lead provider, scraping or co-marketing. Service/contract communication onlyNo advertising, purely contract, security, product, account, delivery or mandatory information. Unclear / no reliable basisIt is not certain whether consents, the existing customer exception or another basis can be proven.

3. Which risk factors exist?

Please select everything that applies.

Unsubscribe link or objection notice missing/unclearRecipients cannot unsubscribe easily, clearly and permanently. Pre-ticked checkbox or bundlingConsent is preselected, hidden, unclearly bundled or not sufficiently voluntary. Consent text is too generalAdvertising entity, content, frequency, channels, withdrawal and privacy information are not clear. Large mailing list or high sending frequencyMany recipients, daily campaigns, international lists or several brands. Segmentation, profiling or lead scoringOpens, clicks, behaviour, purchases, interests or CRM data control campaigns and assessments. Tracking pixels, link tracking or UTM/analyticsOpens, clicks, devices, location, campaign IDs or website behaviour are measured. Sensitive target groups or sensitive inferencesHealth, finances, children, employees, religion, political topics, applicants or vulnerable groups. Partner advertising, sponsoring or third-party offersThe newsletter contains advertising for third parties, co-marketing, affiliate links or sponsored content. No particular risk factors knownThe send is small, transparent, provable and without tracking/profiling particularities.

4. Which documentation and technology are in place?

Please select everything that is reliably implemented.

Consent and DOI logsTime, source, form version, consent text, IP/technical data and confirmation can be retrieved. Privacy policy up to dateNewsletter, provider, sending tool, tracking, profiling, legal basis, withdrawal and third-country transfers are described. Unsubscribe and suppression list processUnsubscribe works immediately, the suppression list is respected, no reactivation without a new basis. DPA with sending tool in placeMailing tool, CRM, marketing automation, tracking tool and sub-processors are governed by contract. Third-country transfers reviewedSCC, DPF, TIA, US/international support access, sub-processors and hosting regions have been reviewed. Preference centre or granular choiceRecipients can control topics, frequency, brands, channels or tracking options. Mandatory information in the email templateSender, imprint/provider, contact, unsubscribe link, privacy link and clear advertising labelling. CRM and list governanceImport rules, source checks, duplicates, role permissions, deletion periods, opt-out sync and responsibilities. No structured documentation yetIndividual tool functions exist, but no reliable evidence and compliance structure.

5. Is there specific pressure to act?

Please select everything that applies.

Campaign or send is imminentA newsletter, launch email, webinar funnel, discount campaign, trade fair email or product announcement is due to go out. Mailing has already been sentThe send has taken place; there are opens, clicks, complaints, bounces or unsubscribes. Complaint, warning letter or deadlineA recipient, competitor, association, supervisory authority, customer or lawyer objects to the send. Tool, provider or deliverability problemAccount suspension, spam complaints, blacklisting, high bounce rate, DKIM/SPF/DMARC problem or tool review. List import, CRM migration or tool changeContacts are to be transferred, merged, segmented or migrated to a new tool. Customer, DPO, procurement or auditor requests evidenceConsent evidence, DPA, TOMs, third-country transfers, opt-out process or send history are requested. Data breach or wrong sendWrong mailing list, visible recipients, wrong segmentation, unauthorised export or impermissible import. Preventive reviewNo acute case, but newsletter, CRM or marketing automation are to be set up properly.

Risk matrix

Typical risks, deadlines and measures

Topic	Typical trigger	Review measure	Timing / deadline
Electronic advertising	Newsletter, sales email, B2B outreach, advertising content in service email	Review consent, existing customer exception, sender, content, evidence and unsubscribe	Ongoing before sending
Consent evidence	Single opt-in, old consent, tool change, list import	Secure DOI log, form version, consent text, time, source and send history	Before campaign launch or import
Tracking / device access	Open tracking, link tracking, UTM, profiling, lead scoring	Assess GDPR/TDDDG review, consent log, transparency, withdrawal and preference centre	Before activating tracking
Sending tool / CRM	Mailchimp, HubSpot, Brevo, Klaviyo, Salesforce, ActiveCampaign or comparable tools	Review DPA, sub-processors, TOMs, third-country transfers, role permissions and deletion/suppression processes	Before tool approval and when changing provider
Data breach / wrong send	Wrong mailing list, visible recipients, impermissible import, unauthorised export	Review breach triage, risk assessment, evidence preservation, communication and notification obligations	GDPR notification to the supervisory authority for a notifiable breach, usually within 72 hours
Data subject rights	Access, erasure, withdrawal, objection, complaint	Document identity, data sources, send history, suppression list and response process	Usually to be answered within one month

Sensible next steps

Related ITMR checkers and follow-up reviews

These checks are particularly often relevant for newsletters, CRM, marketing automation and advertising campaigns.

E-commerce Warning Letter Risk CheckReviews advertising, checkout, price and consumer protection risks around your shop and campaign. Green Claims and Advertising Claims CheckHelps assess claims, discount campaigns, environmental and performance promises before sending. DPA CheckReviews contracts with newsletter, CRM, analytics and marketing automation providers. Third-Country Transfer CheckClassifies US tools, international sub-processors, SCC, DPF and transfer risks. DPIA CheckRelevant for scoring, profiling, sensitive target groups or particularly data-intensive marketing. Data Breach Risk CheckHelps with wrong sends, wrong recipients, visible mailing lists or unauthorised exports.

Have your newsletter, CRM or campaign legally reviewed?

If a send, list import, automation, tracking, complaint or tool change is coming up, a structured review can help reduce warning letter, data protection and evidence risks.

Submit an enquiry about the newsletter check

Note: This checker offers an initial orientation and does not replace a legal review of the individual case. Decisive factors include in particular the recipient group, content, consent text, evidence, send history, tooling, tracking, third-country transfers, complaints, deadlines and actual sending practice. How we set up email marketing in a legally sound way is shown in our Newsletter Check; further topics can be found in the area Marketing law.

Email compliance control centre

Typical review path before sending

Clarify the recipient group

Check the legal basis

Assess content and tracking

Secure the tooling

Secure the evidence

What this check delivers

Preliminary newsletter risk classification

Why this result?

Recommended next review points

Documents worth preparing

Typical risks, deadlines and measures

Related ITMR checkers and follow-up reviews

Have your newsletter, CRM or campaign legally reviewed?