Who counts as an existing customer under Dutch law?

Someone who gave you their email during a sale or negotiation with your business. That covers completed purchases, abandoned checkouts where the customer entered their email address, and quote or booking requests. A visitor who browsed your site but never started a transaction is not an existing customer for soft opt-in purposes under Telecommunicatiewet Art. 11.7 lid 3.

What does 'similar products or services' mean for a Dutch webshop?

Products in the same category as the original sale, or that a reasonable customer would expect from your shop based on what they bought. A running shoe seller can email past buyers about new shoes, insoles or socks. Emailing those same buyers about garden furniture does not qualify as similar, even if the shop happens to sell both.

Does the Dutch soft opt-in apply to B2B email marketing?

Yes. The ACM applies the same four conditions from Art. 11.7 lid 3 to B2B. Additionally, the Netherlands is one of the countries where limited B2B cold email is permitted under separate rules even without a pre-existing customer relationship, provided the message relates to the recipient's professional role and includes a clear opt-out.

How must the opt-out at collection look under Dutch law?

A clear notice at the point the email address is captured, stating that the customer may receive marketing about similar products, with a free and visible way to refuse. An unticked checkbox is the safe default. Every subsequent marketing email must also carry a working unsubscribe link that is processed without delay.

Can a Dutch webshop email customers who bought through Bol.com?

Generally no. Bol.com collected the email address, not the webshop. The customer relationship is with the marketplace. For the soft opt-in to apply under Telecommunicatiewet Art. 11.7 lid 3, the webshop must have collected the address itself through a direct interaction.

What fines can the ACM impose for soft opt-in violations in the Netherlands?

The ACM (Autoriteit Consument en Markt) can impose administrative fines for violations of Telecommunicatiewet Art. 11.7. For the AVG (GDPR) side of a complaint, the AP (Autoriteit Persoonsgegevens) can impose fines up to EUR 20 million or 4% of global annual turnover. Both authorities act independently and a single unsolicited email campaign can trigger separate investigations.

Newsletter

Soft Opt-in Netherlands: Email Customers Without Consent

Steven | TrustYourWebsite · 28 May 2026 · Last updated: May 2026

Most Dutch webshop owners assume they always need explicit consent to send marketing emails. Sign up, tick a box, confirm the address. That's the rule, right?

Not always. Dutch law includes a soft opt-in exception in Telecommunicatiewet Art. 11.7 lid 3 (the bestaande-klantrelatie exception) that lets you email existing customers about similar products without asking for fresh consent. If someone just bought a knife from your Amsterdam webshop, it should not be illegal to email them about a matching cutting board next week.

But the exception is strict. Missing one condition means you are sending spam in the eyes of the ACM and the Autoriteit Persoonsgegevens (AVG). Run a free scan to check whether your checkout forms already meet the rules before reading on.

The Dutch legal basis

The soft opt-in for email marketing in the Netherlands sits in Telecommunicatiewet Art. 11.7 lid 3. This article transposed Article 13(2) of the ePrivacy Directive (2002/58/EC) into Dutch national law and is the operative provision your webshop relies on when it sends a marketing email to a past buyer without first collecting a fresh opt-in.

The Telecommunicatiewet is enforced by the ACM (Autoriteit Consument en Markt). Where the same email also involves personal data processing, the AP (Autoriteit Persoonsgegevens) supervises the AVG (GDPR) side. Both authorities act independently, and a single non-compliant campaign can reach both desks.

The underlying logic is the same as across the EU. If someone already bought from you, forcing them through a full opt-in flow for related marketing is not proportionate. They know who you are. A follow-up email about a related product is not the same as cold outreach from a stranger.

This only works when there is a genuine existing customer relationship. Bought lists and scraped addresses never qualify.

The four conditions for Dutch webshops

All four conditions must be satisfied at the same time. Missing even one means the exception in Art. 11.7 lid 3 does not apply and you need explicit consent.

#	Condition	What qualifies	What does not qualify
1	Email collected during a sale or negotiation	Completed purchase, abandoned checkout where the customer entered their email, quote request, booking enquiry	Homepage visitor who left without starting a transaction. Email purchased from a list
2	Marketing your own similar products or services	Same category as the original sale (kitchen knives → cutting boards, knife sharpeners, kitchen tools)	Unrelated categories under the same brand (kitchen knives → garden furniture)
3	Clear opt-out offered at the moment of collection	Unticked checkbox with plain-language notice at checkout	Pre-ticked boxes (invalid since Planet49 C-673/17). Buried T&C clauses
4	Customer has not opted out	Working unsubscribe link in every email, opt-outs processed without delay	"Reply to unsubscribe". Links that return a 404. Opt-outs queued until after the campaign ends

If you cannot tick all four boxes for a given contact, you need AVG-grade consent before mailing them.

What "similar" means for a Dutch SMB

The ACM looks at customer expectation. Would a reasonable buyer expect the new promotion to arrive from the same seller based on what they originally bought? An online bike shop can email past buyers about bike accessories, replacement parts and cycling gear. Emailing those same buyers about a holiday insurance product the shop also sells crosses the line.

The key test is category fit from the customer's perspective, not the seller's product catalogue.

Opt-outs under Dutch law

The requirement to honour opt-outs without delay is enforced strictly by the ACM. "Without delay" means your mailing platform processes the unsubscribe before the next send, not at the end of the week or after the current campaign finishes. A broken or slow unsubscribe mechanism removes the Art. 11.7 lid 3 defence entirely, regardless of whether the other three conditions are met.

A Dutch SMB scenario

A Rotterdam webshop sells office stationery. A customer orders a set of notebooks and enters their email at checkout. The checkout page includes a clear sentence reading "We may send you offers about similar products. Uncheck this box if you prefer not to hear from us." The customer does not uncheck the box.

The webshop can now email about new notebook ranges, pens and desk organisers. It cannot email about a promotional deal with a coffee delivery service it also happens to partner with.

Six months later, the same customer replies to a newsletter asking to be removed from the list. The webshop's platform processes the request that day. Any send to that address after that point falls outside Art. 11.7 lid 3 regardless of product similarity.

Who enforces the rules in the Netherlands

Two Dutch authorities share oversight, each covering a different angle of the same email.

The ACM (Autoriteit Consument en Markt) supervises the Telecommunicatiewet, including Art. 11.7. The ACM can investigate complaints about unsolicited commercial email, issue binding instructions and impose administrative fines. The ACM has imposed fines in the tens of thousands of euros for systematic violations of the unsolicited-email prohibition.

The AP (Autoriteit Persoonsgegevens) supervises the AVG (GDPR) side. A complaint about an unsolicited marketing email typically raises both a Telecommunicatiewet issue (unsolicited commercial communication) and an AVG issue (processing without a lawful basis). The AP can impose fines up to EUR 20 million or 4% of global annual turnover for the most serious infringements. Both authorities act independently.

In practice, the ACM handles most email-marketing enforcement actions in the Netherlands. The AP is more likely to get involved when a campaign reveals a broader data-quality or lawful-basis problem, such as a merchant claiming soft opt-in while running off a purchased list.

What the soft opt-in does NOT cover

These common Dutch business scenarios fall outside the exception:

Third-party promotions. Art. 11.7 lid 3 covers your own products only. Sending promotions for a partner, supplier or affiliated brand requires separate consent from each recipient.

Unrelated product lines. A Dutch webshop that sells both cookware and fitness equipment cannot email cookware buyers about gym gear. Different category, different customer expectation.

Marketplace customers. If a buyer found your product on Bol.com or Amazon, Bol.com holds that email address. You need to collect the address directly through your own checkout before Art. 11.7 lid 3 can apply.

Newsletter subscribers who never purchased. A subscriber who opted into your blog updates but never placed an order is not a customer under Art. 11.7 lid 3. You need a proper GDPR-compliant signup form for those contacts.

Purchased or scraped lists. There is no existing customer relationship on a bought list. Claiming soft opt-in on a purchased database is unsolicited commercial email and can result in an ACM enforcement action.

Soft opt-in rules across nearby markets

Many Dutch webshops also sell into Belgium, Germany and the UK. The exception works differently in each country.

Country	Usable?	Key restriction
Netherlands	Yes	Art. 11.7 lid 3 Telecommunicatiewet. Four conditions. ACM + AP enforcement
Belgium	Yes	Art. XII.13 Code of Economic Law. Same four conditions. GBA + FOD Economie enforcement
United Kingdom	Yes	PECR Regulation 22(3). ICO enforces opt-out wording strictly
Ireland	Yes	S.I. No. 336/2011 Regulation 13(11). 12-month limit from last purchase or refusal
Germany	Avoid	§7 Abs. 3 UWG read very strictly. Competitor Abmahnungen common even on compliant sends
France	Risky	CNIL treats the exception cautiously. Collect explicit consent instead
Spain	Risky	AEPD applies a narrow similar-product carve-out. Collect explicit consent to be safe

For German subscribers specifically, use double opt-in and do not rely on the soft opt-in exception. The legal and commercial risk of an Abmahnung from a German competitor outweighs any benefit.

Common mistakes that lead to ACM complaints

No opt-out option on the checkout form

Your checkout collects the customer's email but never mentions marketing and offers no way to refuse. You have skipped condition three entirely. Without a visible refusal option at the point of collection, Art. 11.7 lid 3 does not apply regardless of how similar your follow-up products are.

Emailing across product categories

A Dutch outdoor clothing retailer collects emails during tent sales, then uses the same list to promote a travel insurance product it recently started offering. Outdoor clothing and travel insurance are different categories from the customer's point of view. The soft opt-in does not stretch across that gap.

Treating a dormant customer list as active

A webshop has a database of buyers from 2021. No one on that list was ever told their email might be used for marketing and no opt-out option was provided. Starting to mail that list in 2026 is not soft opt-in. It is cold email on an old list. Getting proper consent before any send is the only compliant path forward.

Processing opt-outs slowly

A customer unsubscribes via the link in your email. Your platform queues the request for processing at the end of the week. A campaign goes out two days later that includes that customer. This removes the Art. 11.7 lid 3 defence for that send and exposes you to an ACM complaint.

FAQ

Can I use the Dutch soft opt-in for B2B contacts?

Yes. The ACM applies the same four conditions to business email addresses. Additionally, the Netherlands permits limited B2B cold email even without a pre-existing customer relationship, provided the message is relevant to the recipient's professional function and includes a clear one-click opt-out. For B2C contacts there is no cold-email carve-out: you need either soft opt-in (Art. 11.7 lid 3) or explicit AVG consent.

How long does the soft opt-in relationship last?

The Telecommunicatiewet sets no specific time limit. As a practical rule: if a customer's last interaction with your business was more than 12 months ago and you have not emailed them in that window, starting now will look like cold outreach to the ACM. Getting fresh consent before resuming contact is the safer approach.

Does an abandoned cart qualify as a sale or negotiation?

Yes, provided the customer entered their email during the checkout process. Dropping items into a cart and leaving without entering details has not started a negotiation. The ACM looks at whether the customer took an active step in the transaction, such as entering their address, shipping details or payment information.

What if I collect emails through a contact form rather than a checkout?

A general contact form enquiry without any commercial context is not a sale or negotiation under Art. 11.7 lid 3. A quote request or a form where the customer is asking about pricing for a specific product is closer to a negotiation. The distinction matters because using a general-enquiry address for product marketing puts you outside the exception.

What happens if I get this wrong?

The ACM can open an investigation and impose fines for Art. 11.7 violations. The AP can act on the AVG side with fines up to EUR 20 million or 4% of global annual turnover for the most serious infringements. Beyond fines, high spam complaint rates damage your sender reputation with Dutch ISPs and email clients, reducing deliverability across your entire list for months.

Check your setup

Not sure whether your checkout forms and mailing practices already meet the Dutch rules? Run a free scan to check for missing unsubscribe links, pre-checked marketing boxes and other patterns that remove the Art. 11.7 lid 3 defence.

For more on Dutch email rules, see the guide on GDPR compliance in the Netherlands and make sure your privacy policy explicitly lists email marketing as a use of personal data.

Sources

Share this article

Check your website now

Scan your website for email issues and 30+ other checks.

Start free check

Website Guides

Email Marketing Consent Rules in the Netherlands

Email marketing consent rules for Dutch senders: AVG, Telecommunicatiewet Art. 11.7, ACM vs AP enforcement, plus a country-by-country comparison table.

Is Double Opt-in Required in the Netherlands?

Is double opt-in required in the Netherlands? No, but German subscribers change the rules. Learn what AVG and Telecommunicatiewet Art. 11.7 actually demand.

Newsletter Signup Forms: GDPR Requirements

Your newsletter signup form needs more than a checkbox. Here are the GDPR rules for email consent, what to store and how to avoid common mistakes.