Email marketing: what you may legally send, and what you may not, in Spain and Chile

Email marketing: what you may legally send, and what you may not, in Spain and Chile

Buying a database and firing off a campaign is the quickest route to a penalty. What consent requires, when you may write to a customer without asking, and what every send must carry.

· Marketing

Email is still the commercial channel with the best return for a small business, and also the one with the clearest and most widely broken rules. The good news: doing it properly does not merely avoid penalties, it works better. A small list of people who want to hear from you outperforms a large one of people who do not.

The general rule: prior consent

In Spain, sending commercial communications by email requires the recipient's prior authorisation. And under the GDPR that consent has to be freely given, specific, informed and unambiguous, through a clear affirmative action.

Translated into what a form has to do:

  • An unticked box by default. A pre-ticked box is not consent.
  • Separate from accepting the terms. Folding marketing consent into «I accept the terms» invalidates both.
  • Informed: who processes the data, what for, and how to exercise your rights.
  • Recorded: you must be able to show who consented, when, and to what wording. If you cannot prove it, you do not have it.

In Chile, Ley 19.628 and its progressive replacement by Ley 21.719 point the same way — consent freely given, specific, informed and unambiguous, with reinforced rights and a supervisory authority — and consumer protection rules additionally require identifying the sender and offering a way to unsubscribe. The sensible way to operate across both countries is to apply the stricter standard to everything rather than run two procedures.

The exception that does exist: your own customers

There is one case where commercial mail may be sent without prior consent, and it is worth knowing well because it underpins any legitimate email marketing:

Where there is a prior contractual relationship, the data was lawfully obtained in the course of that relationship, and the message concerns similar products or services to the ones bought. You must also offer the chance to object at the point of collection and in every message.

The limits of that exception are strict: «similar» means similar, not your whole catalogue; and the relationship has to be real, not a contact form from three years ago.

What is never lawful

  1. Buying databases. No purchased list brings valid consent for you, however firmly the seller says so in writing. You are the one responsible for the send.
  2. Scraping addresses from websites or directories. An address being public does not turn it into consent.
  3. Adding someone who wrote to you about something else. A person who asked for a quote has not signed up to a newsletter.
  4. Hiding or obstructing the unsubscribe. It has to be simple, free and effective.
  5. Carrying on mailing someone who unsubscribed. It is the most reported breach, and nearly always a technical slip: the opt-out is processed in one tool and not in the other.

What every send must carry

  • Clear identification of the sender, with the company's details.
  • That it is recognisable as a commercial communication from the subject line.
  • A visible unsubscribe link, working and one click deep.
  • Information on the processing of data and how to exercise your rights.
  • If there is a promotion or prize draw, its terms accessible.

What also makes it work

Complying and being effective point the same way, which is the nice part of this subject:

  • Your own, clean list. Better 300 people expecting you than 5,000 marking you as spam — and spam complaints degrade your sending reputation until you stop reaching anybody.
  • A stated frequency, honoured. If you say «once a month», once a month.
  • Useful content ahead of promotion. The ratio that sustains a list is far more content than offer.
  • Periodic cleaning of people who have not opened for months. Deleting hurts, but deliverability improves.
  • Correct technical setup of your domain to authenticate your mail. Without it, your messages land in junk for technical reasons rather than editorial ones.

Before your next send, check

  1. Can you evidence consent for every address on your list, with a date?
  2. Does the unsubscribe work and propagate to all your tools?
  3. Do your full company details appear in the footer?
  4. Is the commercial communications activity in your record of processing?

If any answer is no, there is this week's work. The record of processing is explained in how to do the record in an afternoon.

If this sounds like you

Building the whole channel — forms with valid consent, sending automations and content people read — is digital marketing and content; the compliance side is AI and data compliance. And writing what you send so that it converts is in your website copy.

We are Mindset & Code: automation, data and development for small businesses. You can see what we do and what it costs.

Sources: Ley 34/2002 on information society services, articles 21 and 22; Regulation (EU) 2016/679, articles 6 and 7; Ley 21.719 on personal data protection in Chile and Ley 19.496 on consumer rights. General guidance; it does not replace legal advice.