GDPR email consent checker: can you send marketing email to this contact?
In short: The two-layer test for UK and EU marketing email: the sending rule (PECR or ePrivacy) for the recipient type and where the address came from, then the GDPR lawful basis, then the duties in every email. Limit: It's a reading of published regulator guidance, not legal advice, and it can't see your forms or records.
A GDPR email consent checker runs the two tests UK and EU marketing email has to pass. The sending rule (PECR in the UK, ePrivacy law in the EU) depends on who the recipient is and where you got the address; GDPR then needs a lawful basis, consent or legitimate interests. Choose the region, recipient and source to see both answers with the regulator's guidance.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Runs in your browser as you choose. A reading of regulator guidance, not legal advice.
1. May you send it? (PECR)
Allowed. PECR allows it without consent: a company is a corporate subscriber.
The ICO says you can send unsolicited marketing email to corporate subscribers (limited companies, LLPs, Scottish partnerships) without consent or a soft opt-in. You must still say who you are and give a working opt-out. Check the business is really a company: a sole trader's or ordinary partnership's address is an individual subscriber.
ICO: How do we comply with the PECR email marketing rules?2. May you process the address? (UK GDPR)
Lawful basis: legitimate interests (Article 6(1)(f)), with a written test.
Write down the purpose, necessity and balancing tests before you send: what you offer and why it's relevant to them, the minimum data you keep, and why they'd reasonably expect the email. Recital 47 says direct marketing 'may' be a legitimate interest, not that it always is.
ICO: What is the legitimate interests basis?3. What every email needs
Yours to confirm: Say who you are in every email
Don't disguise or hide the sender's identity, whatever the recipient type.
ICO: How do we comply with the PECR email marketing rules?Yours to confirm: Give a working opt-out in every email, and honour it for good
An objection to direct marketing is absolute: once they say stop, their data can't be used for marketing again. Keep them on a suppression list so a re-import can't bring them back.
GDPR Article 21: Right to objectCheck: Tell them where you got their address, by the first email
You didn't collect it from them, so Article 14 applies: who you are, why you have it, the source and their rights, at the latest in your first message. A short line or a link in the first email does it.
GDPR Article 14: Information where data were not obtained from the personYours to confirm: Write the legitimate interests assessment before the send
PECR doesn't need consent for the company, but jane.doe@ still identifies Jane, so UK GDPR applies to her address.
ICO: What is the legitimate interests basis?
Next step
Allowed to send isn't the same as safe to send.
Consent doesn't keep an address alive. People leave jobs and close inboxes, and every bounce counts against the sender. Drop the list here to see which addresses still exist before the campaign goes out.
No list right now? This tool stays free, no account, so bookmark it for next time. Ctrl+D (⌘+D on a Mac)
Ready to verify now? Verify the list
Sample result
UK, named person at a limited company, found on its website: PECR allows the email without consent.
- May you send it?
- Allowed
- Lawful basis
- Legitimate interests
- First email
- Article 14 notice
What this means for you
Run the legitimate interests test, give an opt-out, and say where you got the address in the first email.
- UK and EU rules
- Sending rule, then lawful basis
- Soft opt-in conditions
- Regulator source on every line
- PECR
- GDPR
- ePrivacy
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
Contacts you may email still have to exist
- Split the list by the answers here and keep only the segments you're allowed to email.
- Upload that file at /verify for a live mailbox check on every address. The first 100 email checks are free with a Google sign-in, no card.
- Send to the valid addresses and add every opt-out to a suppression list.
How do I check if I need consent to send a marketing email?
- Choose where the recipient is (UK, or an EU or EEA country) and who they are: a consumer, a sole trader, a named person at a company or a role address.
- Choose where the address came from: your sign-up form, a sale or enquiry, a bought list, a website or an event.
- Tick the conditions that are true, such as a recorded opt-in or an opt-out offered at the sale. The answer updates as you go.
- Read the sending answer, the lawful basis and the duties for every email, each linked to the regulator's page.
Example
- You enter
- Region United Kingdom, recipient a named person at a company (
[email protected]), address found on the company's website. - You get
- Sending: Allowed, PECR lets you email a corporate subscriber without consent. Processing: legitimate interests with a written three-part test. Every email: say who you are, a working opt-out honoured for good, and an Article 14 notice of where you got the address by the first email.
- Limits
- Runs in your browser; one recipient type and source at a time.
Do you need consent to send marketing emails under GDPR?
Not always under GDPR itself, but often under the sending rules that sit beside it. GDPR lets you process an address on consent or on legitimate interests; Recital 47 says direct marketing "may" be a legitimate interest. Whether you may send the email at all is decided by PECR in the UK and by each EU country's law implementing Article 13 of the ePrivacy Directive, and for individuals those rules ask for consent or the soft opt-in.
The order matters. The EDPB's guidelines on legitimate interest say that where national law doesn't allow the message, there is no legitimate interest to rely on for it. So the checker answers the sending question first, and only then the lawful basis. The full reasoning, with quotes, is in GDPR and B2B cold email.
Can I email a business in the UK without consent?
Yes, if it's a corporate subscriber. The ICO says you can send unsolicited marketing email to limited companies, LLPs and Scottish partnerships without consent or a soft opt-in, as long as you identify yourself and give an opt-out. Sole traders and ordinary partnerships are individual subscribers and get the same protection as consumers.
A named work address such as [email protected] is still personal data, so UK GDPR applies even when PECR doesn't ask for consent: write the legitimate interests assessment, and tell Jane where you got her address by your first email (Article 14).
What is the soft opt-in?
The exception that lets you email existing customers without fresh consent: you got the address in a sale or negotiation of a sale, you market your own similar products or services, and they were given a simple way to refuse at the time and in every message since. Miss any one and it doesn't apply.
It doesn't stretch to bought lists. Consent collected by someone else only counts for you when it named your organisation; the ICO's marketing lists guidance tells buyers to check how, when and by whom consent was given.
UK: who needs consent for marketing email?
| Recipient | PECR (may you send?) | UK GDPR (may you process?) |
|---|---|---|
| Named person at a limited company | Yes, no consent needed | Legitimate interests, written test |
| Role address (info@) at a company | Yes | Usually little or no personal data |
| Sole trader or ordinary partnership | Consent or soft opt-in | Not reached unless PECR allows |
| Consumer | Consent or soft opt-in | Consent, or legitimate interests on a soft opt-in |
From the ICO's PECR guidance. EU rules for business recipients differ by country, so the checker says "check the country" there.
Who uses this tool, and for what?
- Cold emailers
- Check a UK prospect list segment by segment: limited companies can go, sole traders come out before the sequence starts.
- Marketing teams
- Decide whether past customers can get the newsletter on the soft opt-in, or need a re-permission email first.
- Agencies
- Show a client why a bought list can't be mailed, with the ICO's own page under each answer.
- SaaS signups
- Confirm the sign-up checkbox gives you a consent you can prove before you start product marketing.
What can’t this tool tell you?
- It's a reading of published regulator guidance, not legal advice, and it can't see your forms or records.
- For business recipients in the EU it says to check the country; it doesn't list each member state's rule.
- It answers for one type of contact at a time. A list that mixes types needs splitting first.
- Countries outside the UK and EU have their own rules: CAN-SPAM in the US, CASL in Canada.
Common questions
- Is cold email legal under GDPR?
- GDPR can allow it on legitimate interests, but the sending rule decides first. In the UK, PECR allows unsolicited email to corporate subscribers without consent and needs consent or the soft opt-in for individuals and sole traders. In the EU, the rules for business recipients differ by country.
- Can I email customers without consent?
- Under the soft opt-in, yes, if you got their address in a sale or enquiry, you market your own similar products, and they could opt out then and in every email. Marketing unrelated products needs consent.
- Can I use a bought email list under GDPR?
- Only where the consent each person gave named your organisation, and you can see the wording and date. Generic consent to 'partners' doesn't cover you, and for individuals PECR and ePrivacy then don't allow the send.
- Is a pre-ticked box valid consent?
- No. GDPR consent has to be a clear affirmative act, and Recital 32 says silence, pre-ticked boxes or inactivity don't count. You also have to be able to show each consent (Article 7).
- Does GDPR apply to business email addresses?
- Yes, when the address identifies a person, such as [email protected]. A generic address like info@ often identifies no one. PECR's corporate subscriber rule is about consent to send, not about GDPR.
- Is this legal advice?
- No. It's a reading of the ICO's and EDPB's published guidance, linked on every answer. For a large or unusual list, take advice for the countries you send to.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.