Advertising seems ubiquitous today: As soon as you open your mailbox or email inbox, you are usually greeted by a series of letters and emails from companies wanting to promote their products. Often, they are personally addressed to you.
As the legal basis, these companies frequently rely on their “legitimate interest” or your consent—usually buried deep in a contract on a completely different subject.
Fortunately, you don’t have to put up with that. According to the General Data Protection Regulation (GDPR), you have the right to object to direct marketing. This is clearly stated in Art. 21(2) GDPR. You may also rise this objection if you have previously given consent for direct marketing.
The GDPR also offers you a number of other rights. You can find out more about those in our article about your GDPR rights.
How do I exercise this right?
The GDPR does not impose any requirements on how to raise this objection. In theory, you could simply write an informal letter and send it to the company. Even a phone call would do.
We do however recommend going with the written form, if only to be able to prove later that you have actually made the objection. And while you could also state informally that you object to your personal data being used for direct marketing purposes, we advise you to make a more formal request referring to the specific legislation. This ensures that the controller cannot talk their way out of their responsibility.
What does a letter like that have to contain?
Don’t worry, you don’t have to write this letter yourself. We have prepared a sample letter for you to copy and adapt for your purposes.
Here is our sample letter for objecting to direct marketing according to Art. 21(2) GDPR. You still have to fill in the data in curly braces.
To Whom It May Concern:
I am hereby objecting to the processing of personal data concerning me for direct marketing purposes according to Article 21(2) GDPR. This objection includes the use for profiling to the extent that it is related to direct marketing.
If I have given consent to the processing of my personal data for direct marketing purposes (e.g. according to Article 6(1) or Article 9(2) GDPR), I am hereby withdrawing said consent.
My request explicitly includes any other services and companies for which you are the controller as defined by Article 4(7) GDPR.
As laid down in Article 12(3) GDPR, you have to confirm the objection to me without undue delay and in any event within one month of receipt of the request.
I am including the following information necessary to identify me:
Enter your identification data here. This will usually—depending on the kind of advertising— be your name and your address or email address.
If you do not answer my request within the stated period, I am reserving the right to take legal action against you and to lodge a complaint with the responsible supervisory authority.
To make your life easier, you can also download the letter and use it directly with the word processor of your choice. You can choose between the following templates:
To whom do I send the letter?
You send the letter directly to the company that send you the ads. If they have a data protection officer, we recommend that you always address the letter directly to this person. Data protection officers are not only specially trained, but are also required to treat your request confidentially.
Isn’t there an easier way?
The idea behind Datenanfragen.de is to make it as easy as possible for you to exercise your rights regarding data protection. Therefore we have developed a generator, with which you can create requests like this automatically. We invite you to give it a try.