You found it. Exactly what you were looking for. You add the product to your online shopping cart, enter your email address, and then you hesitate. Do I really need it? You close the website. No purchase, no explanation, you're just gone.
But the webshop hasn't forgotten you. A few hours later, an email appears in your inbox: "You still have something in your cart. Would you like to complete your order?"
Sound familiar? This type of email is known as an abandoned cart email and is a specific application of a retargeting email. From a commercial perspective, it's understandable: between 65% and well over 80% of all online purchases are abandoned, depending on the industry.[1] The temptation to win back that group via email is significant. But is it actually allowed?
The short answer: no, not without prior consent or an existing customer relationship. Yet this practice is widely used by webshops and other organisations working with online forms or ordering processes. The German data protection authority in the state of Hesse (hereinafter: the Hessian supervisory authority) received multiple complaints about this and intervened.[2] It's time to examine this issue from a legal perspective.
Retargeting email is direct marketing and that requires an opt-in
A retargeting email is a marketing method whereby organisations send targeted messages to people who have previously visited their website but did not complete a purchase. The goal is to re-engage these users and encourage them to go ahead and make a purchase. Such emails fall under the category of direct marketing as soon as they are sent with the intention of prompting the recipient to take a specific action. What matters is the commercial or ideological intent of the sender, not the form in which the message is presented.
Retargeting emails therefore qualify as direct marketing within the meaning of the Telecommunications Act (Telecommunicatiewet, hereinafter: Tw). Under Article 11.7 Tw, sending commercial or promotional emails requires an opt-in: the sender needs the prior and explicit consent of the recipient, unless the customer relationship exemption applies.
The customer relationship exemption: not applicable for abandoned carts
The customer relationship exemption only applies if an actual prior purchase transaction has taken place and the email relates to similar products or services. In the case of an abandoned cart, no purchase agreement has been concluded. There is simply no customer relationship to rely on.
Even where a customer relationship does exist, additional conditions apply under the Telecommunications Act:
- The retargeting email must come from the same legal entity.
- The customer must have been given a clear and simple opportunity to object, free of charge, to receiving such emails.
- That opportunity must be provided at the time the email address is collected and in every subsequent email.
If these conditions are not met, the general rule applies here as well: without consent, no email.
How to do it correctly
Valid consent must be freely given, specific, informed, and unambiguous. In practice, this translates into a number of concrete steps.
1. Add a separate consent checkbox
Only send reminders about abandoned carts if an active opt-in for retargeting emails has been given, for example, when creating an account. Even where a customer relationship exists, it is advisable to record consent explicitly. This prevents any dispute about whether all conditions of the exemption have been met.
Example: "Yes, I would like to receive a reminder if my order has not been completed."
This checkbox must be separate from other consents and from the general terms and conditions.
2. Describe the use in your privacy statement
Clearly explain that the email address will be used for retargeting emails, on what legal basis this occurs, and how long the data will be retained. Transparency is not only a GDPR obligation, it also builds user trust.
3. Record the consent
Ensure you can demonstrate who gave consent, when, and for what purpose. This is necessary to comply with the accountability obligation under the GDPR.
4. Only send the email to those who have given consent
This requires that technical systems are configured in such a way that only contacts with recorded consent receive the retargeting email.
What did the Hessian supervisory authority do?
In all cases investigated by the Hessian supervisory authority, where individuals received a reminder about their abandoned cart without consent, an official warning was issued on the basis of the GDPR. No further measures were taken because the webshops involved had proactively deleted all unlawfully collected personal data and had adapted their systems to prevent future violations.
This applies more broadly than just webshops
The principles described are not limited to abandoned shopping carts. They apply to any form where an email address is entered without the process being completed. If an organisation then wants to use a retargeting email to encourage the user to complete the action, the same rules apply. This is relevant for, e.g.:
- Donation forms
- Brochure or quote requests
- Registration forms for events
- Product configurations or trial requests
In all these cases: no completed action means no customer relationship, and no customer relationship means no retargeting without consent.
In summary
Retargeting emails following abandoned carts or incomplete forms constitute direct marketing. They may only be sent on the basis of prior, freely given, and specific consent. Entering an email address in a form is not sufficient for this purpose.
The practical measures are straightforward: an active opt-in checkbox (for example, when creating an account), a clear description in the privacy statement, and a technical setup that records consent and only reaches people who have given it. Retargeting can then be deployed in a way that is both effective and lawful.
Do you want to use retargeting emails that comply with all legal requirements? We set up your opt-in, privacy policy and technical implementation in accordance with the Dutch Telecommunications Act, so your marketing strategy is both effective and lawful.
/39-1.png?width=600&height=300&name=39-1.png)
/20.png?width=600&height=300&name=20.png)
/56.png?width=600&height=300&name=56.png)
