When an Irish business can send marketing email and texts without consent

In Ireland, marketing by email, text and phone is governed by Regulation 13 of the ePrivacy Regulations (S.I. No. 336 of 2011). When the message goes to a person, the GDPR applies as well. The e-Commerce Regulations add rules for businesses that provide online services (see below).

Texts count as email. The Regulations define electronic mail as any text, voice, sound or image message that can be stored until the recipient collects it, and the definition includes an SMS message (Regulation 2). Breaking Regulation 13 is a criminal offence. The Data Protection Commission (DPC) can prosecute it itself in the District Court (Regulation 26(1)). The Irish Statute Book's directory, updated to 6 October 2026, lists no amendment to Regulation 13.

Some contact is not marketing at all. In a 2024 case study, the DPC found that an airline's request for feedback, with no marketing in it, was not direct marketing. Its 2019 guidance describes unsolicited marketing as contact the person did not seek or request. A reply to their own question does not fit that.

Regulation 13 treats individual people (natural persons) differently from companies and other organisations. The GDPR adds conditions, covered further down. Phone calls have rules of their own.

Where you need consent, the DPC's FAQ says it must meet the GDPR standard: freely given, specific, informed and unambiguous, shown by a statement or a clear positive action (Article 4(11)). Silence, pre-ticked boxes and doing nothing do not count (Recital 32). Article 7 adds two rules. If you ask for consent inside a document about other things, the request must be clearly distinguishable from the rest. Withdrawing consent must be as easy as giving it.

It is up to you, the sender, to prove consent. If you are prosecuted, you must show that the person unambiguously consented (Regulation 13(14)). The GDPR also requires a business relying on consent to be able to show it (Article 7(1)). Pulse Gym, trading as Energie Fitness Dublin 8, was prosecuted in 2024 over marketing texts. Its consent was in the terms members accepted when joining online, and it could not produce a copy. The DPC said marketing consent may not be bundled with consent for other purposes.

For each person, keep the date they consented, where, the words they were shown, and any withdrawal. The DPC's e-receipts guidance recommends two blank tick-boxes at the till: one for the receipt and one for marketing by email.

You can email or text a past customer without consent if you got their contact details lawfully, from them, as part of a sale (Regulation 13(11)). This is called the soft opt-in. The DPC's FAQ says you cannot rely on it if even one condition is not met. All four must hold for every message:

Condition (d) has two parts, and the second keeps the window moving. It is met if the customer bought from you not more than 12 months before the message, or if you used their details for marketing email within those 12 months. If a customer has had your marketing at least once in every 12 months since buying, and has not objected, the condition keeps being met. If their last purchase and your last marketing message to them are both more than 12 months old, you need their consent.

The DPC reads it the same way. Its e-receipts guidance says a customer who does not unsubscribe may be treated as still opted in for twelve months from your most recent marketing email. Its FAQ says the first marketing message must be sent within 12 months of the original sale.

The FAQ's hotel examples show where the line falls. A past guest who left the opt-out box unticked when booking can be emailed the hotel's own offers within the 12 months, with an opt-out each time. The hotel cannot send them a deal from an unconnected hotel chain. A guest whose booking form offered no opt-out cannot be emailed marketing on the strength of that booking.

An enquiry is not a sale, and the soft opt-in needs a sale. The DPC's FAQ says it does not cover a possible customer who does not complete a purchase. Its example is somebody who browses online and leaves before the checkout.

Answering their enquiry is not unsolicited marketing, because they asked. But offers they did not ask about, added to your reply, could count as direct marketing, as the DPC said of the airline's feedback email. Marketing to them afterwards is direct marketing. Ask for consent when they enquire, with a blank tick-box, and keep the record. If the enquiry came from a work address and is about the person's business, the rules for businesses below apply.

The consent rule protects individual people (Regulation 13(1)). You can email a company or other organisation until it tells you it does not consent (13(4)). That opt-out is enforced. In 2018 Viking Direct (Ireland) Limited pleaded guilty to sending a marketing email to a business email address after the owner had asked three times to be removed.

A named person at work is still an individual. But their work email is outside the consent rule on two conditions (Regulation 13(2)). First, the address must reasonably appear to you to be used mainly for their business or official work. Second, the message must be only about that work. A personal offer sent to the same address does not qualify. Sole traders are individuals too, and the Regulations set them no separate test.

Read word for word, Regulation 13(2) covers email addresses only. A marketing text to a person's mobile therefore needs consent under 13(1), or the soft opt-in if they are a customer. We found no DPC guidance on the point.

Once a company or a named person at work objects, you must stop. For a company, that is Regulation 13(4). For a named person, it is Article 21(3) of the GDPR, which says their data must no longer be processed for direct marketing. Neither rule sets a deadline for acting on the objection. The 28 days in Regulation 13(9) applies only to phone numbers newly added to the National Directory Database opt-out register. The compliance clocks article lists this as a rule with no set period.

Regulation 13 decides whether you may send the message. The GDPR still needs a legal reason (a lawful basis) for using the person's name and address. Without consent, the one to look at is legitimate interests (Article 6(1)(f)). Recital 47 says direct marketing may count as a legitimate interest. It also says the person's interests can outweigh the business's where they would not reasonably expect their data to be used that way.

The Court of Justice looked at this in KNLTB (C-621/22, 4 October 2024), a case about a tennis federation selling members' data to sponsors. It held that a lawful commercial interest can be legitimate. But the use of the data must be strictly necessary for that interest, and must not be outweighed by the person's interests, taking their reasonable expectations into account. The case was not about a newsletter, so it applies to one only by analogy.

If you found a business contact's address yourself, on a website or in a directory, you must tell them certain things (Article 14). These include who you are, your legitimate interest, where you got the address, and their right to object. They must have this within a reasonable period, at the latest a month after you got the address (Article 14(3)(a)), and no later than your first email to them (Article 14(3)(b)). The transparency guidelines endorsed by the European Data Protection Board read the month as the outer limit (WP260, paragraph 27). That first email must also point out their right to object, explicitly, clearly and separately from any other information (Article 21(4)). Objecting costs them nothing (Recital 70).

A bought list of individuals cannot use the soft opt-in, because those people never bought from you. The DPC says consent on promotional lists must be current, valid and legitimately sourced. Consent counts as informed only if the person knew at least who the controller was: the business deciding how their data is used (Recital 42). The European Data Protection Board says every other business that wants to rely on a consent should be named when it is given (Guidelines 05/2020, paragraph 65). If a person consented to the list's seller and you were not named, that consent does not cover your marketing.

The e-Commerce Regulations (S.I. No. 68 of 2003) add rules for businesses that provide online services, which the law calls information society services. The EU Directive behind them counts selling goods online, and sending commercial messages by email, among those services (Recital 18).

Under Regulation 8(1), a commercial message that is part of such a service must be clearly marked as commercial, and it must be clear on whose behalf it is sent. Your website, sign-up forms included, must also show prominently how people can record their choice about unsolicited commercial messages. Regulation 9(1) covers an unsolicited commercial message from a provider established in Ireland, such as a cold email to another business. As soon as it is received, it must say clearly and unambiguously that it is an unsolicited commercial communication.

The DPC can prosecute breaches of Regulation 9 (9(3)). Breaches of Regulation 8 were a matter for the Director of Consumer Affairs, whose role has since passed to the Competition and Consumer Protection Commission (Consumer Protection Act 2007, section 37; Competition and Consumer Protection Act 2014, section 39). The penalty is up to three months in prison, a fine of up to €3,000, or both (Regulation 25 of S.I. No. 68 of 2003). The Fines Act 2010 makes that fine a class B fine, up to €4,000 (section 5).

Every message needs these, even when you have consent:

Regulation 13(7) forbids adding marketing to an SMS sent for another purpose, an appointment reminder for example, unless the person has consented to it.

You cannot make a live marketing call to a landline if the person has told you they do not consent, or if the number is on the National Directory Database opt-out register (13(5)). The DPC says business numbers can be on the register as well as home ones. Callers can check numbers with the register's operator for a fee (14(6)(a)). The DPC's register FAQ also says a business the person already deals with can rely on consent arising from that relationship, whatever the register says. Regulation 13(5) itself contains no such exception. A customer who has told you not to call is covered by 13(5)(a) either way.

A marketing call to a mobile needs consent (13(6)), and the Regulation makes no exception for business mobiles. Every marketing call must give the name of whoever is making it, and of anybody it is made for (13(10)(a)). Google Ireland was prosecuted in 2024 over three sales calls made for it in four hours to a person who had opted out. It said an outside contractor had ignored the opt-out.

The DPC's 2025 annual report counts 245 new marketing complaints, 73% about email and 11% about texts. It also counts 275 investigations concluded and 50 warning letters, and records no marketing prosecution. The faults reported most were an opt-out that was ignored, not working or not provided, and marketing without consent.

Prosecutions have come after a warning. The 2024 report counts 49 warning letters and eight companies prosecuted, and says each of those companies had been warned first. The DPC does not have to try to settle a complaint by agreement before it prosecutes (Regulation 26(3)). The eight are in the table below, counted in charges, as the DPC's own pages record them. Where a DPC press release and a case study differ, both are given. Every donation was made instead of a conviction and fine.

Brown Thomas Arnotts faced 21 charges. On 7 September 2026 it pleaded guilty to five sample charges. Three were for giving no valid address to opt out, after a fault at its software provider made unsubscribing fail from time to time. Two were for marketing without valid consent, to people who had withdrawn it in person, by phone or otherwise. The DPC had warned it in March 2022. The court applied the Probation of Offenders Act and ordered €1,000 to Little Flower Penny Dinners and €1,000 towards the DPC's legal fees.

None of these cases ended in a fine, but the law allows fines. Each message or call is a separate offence (13(13)(b)). In the District Court (summary conviction) the maximum is a class A fine of €5,000 (13(15)(a); Fines Act 2010, section 3). On conviction on indictment, in a higher court, it is €250,000 for a company and €50,000 for an individual (13(15)(b)). The DPC's own power is to prosecute in the District Court (Regulation 26(1)), and every case in this section was heard there. A director, manager or other officer whose consent, connivance or neglect led to a company's offence also commits an offence (Regulation 25 of the ePrivacy Regulations).

A person who receives the marketing can also sue. Anybody who suffers loss and damage from a breach of the Regulations can claim damages from whoever broke them (Regulation 16(2)). It is a defence to show that you took all reasonable care to comply (16(3)). Where the GDPR is broken as well, the person can claim compensation for material or non-material damage (Article 82). They can bring that claim in the District Court, the Circuit Court or the High Court (section 117 of the Data Protection Act 2018).

Blaming a supplier does not help. After the October 2024 cases the DPC said businesses remain responsible for the actions of their processors, the suppliers acting for them. After Brown Thomas it said organisations remain the accountable party. Your contract with an email platform is a processor contract, covered in the GDPR guide for small businesses.

Unaddressed leaflets through the door. The DPC's 2019 guidance says unaddressed postal marketing received at home is not covered by data protection legislation. Post addressed to a named person is among the kinds of direct marketing the same guidance lists.

Messages through WhatsApp and other messaging apps are not covered here. No DPC guidance or decision on whether Regulation 13 reaches them was found.

Section 30 of the Data Protection Act 2018, which would make it an offence for a company to process a child's personal data for direct marketing, profiling or micro-targeting, is not in force. The Irish Statute Book's directory for the Act, updated to 6 October 2026, lists it as not yet commenced.

No change to the rules on marketing email, texts or calls is in force. The proposed EU ePrivacy Regulation, which would have replaced the Directive behind them, was withdrawn in the Official Journal of 6 October 2025. The Digital Omnibus proposal of 19 November 2025 would change the ePrivacy Directive's cookie rule and delete its Article 4. It leaves the rules on unsolicited marketing alone, and GDPR Articles 6, 7, 14 and 21 as well.

The Omnibus would also add a new GDPR Article 88b. Websites and apps would have to accept refusals of consent, and objections to direct marketing (Article 21(2)), sent automatically in machine-readable form, for example by a browser setting. This would cover processing on the person's device, and would start 24 months after the Regulation came into force. On 16 October 2026 the European Parliament's file showed the proposal awaiting a committee decision. The cookie side is in cookie banners in Ireland and what a website does before consent.

Work through it in this order. Sorting the list comes first because it decides the rest: