# ePrivacy Directive Article 13 — Unsolicited communications > The anti-spam article. Marketing calls, texts and email need prior consent (opt-in), with a narrow existing-customer exemption, and hidden-sender marketing is always prohibited. Citation: *Directive 2002/58/EC (as amended by Directive 2009/136/EC)* Last reconciled with canonical source: 2026-09-06 Canonical: https://eur-lex.europa.eu/eli/dir/2002/58/2009-12-19 Source: https://consenttheater.org/law/eprivacy/art-13/ --- ## In plain language Article 13 is Europe's **anti-spam rule**, and it works on a simple default: marketing messages are forbidden unless the recipient agreed to them first. The core rule in 13(1): automated marketing calls, faxes and **email for direct marketing** may only be sent to people who gave their **prior consent**. This is a genuine opt-in — the burden is on the sender to show the recipient said yes before the first message. One narrow exemption, 13(2): if you collected a customer's email address while selling them something, you may email them about **your own similar products** — provided the customer was offered a free, easy way to object **at collection and in every message since**. That's the "soft opt-in", and it doesn't travel: the address can't be sold, rented, or reused by a different company. 13(4) is absolute — no consent or exemption can save it: marketing email that **disguises the sender**, hides behind a fake return address, lacks a working opt-out address, or points to a website that breaks the e-commerce information rules is prohibited outright. Also worth knowing: "email" here is defined broadly by Article 2(h) — any text, voice, sound or image message stored until collected. Regulators read that as covering SMS and newsletters. And because consent is involved, the GDPR's definition applies — see [Article 7](/law/gdpr/art-7/). Note also that the recipient's **country** decides the regime, not the sender's: opt-in is the default, but 13(3) lets Member States choose opt-out instead, so the strictness varies by member state. **UK:** PECR **regulation 22** carries the same prior-consent rule for marketing email, calls and texts to individuals, with the same existing-customer soft opt-in. See the [UK mapping page](/law/uk-gdpr-and-pecr/). ## How we use this on consenttheater.org - Article 13 governs the **email address forms** embedded in cookie-consent flows — newsletter signups, marketing checkboxes pre-ticked inside a banner, and "share your email for a discount" widgets. Those are direct marketing by electronic mail: they need prior consent, and a consent banner is not that consent. - Our observations regularly catch newsletter and email-marketing scripts loading **before** any consent interaction — for a GDPR-defined consent standard, that is exactly the pre-consent state Article 13(1) forbids for marketing messages. ## Original text Reproduced verbatim from *Directive 2002/58/EC* (consolidated version, as amended by Directive 2009/136/EC), published by the Publications Office of the European Union on [eur-lex.europa.eu](https://eur-lex.europa.eu/eli/dir/2002/58/2009-12-19). The official source is authoritative; this rendering is a navigation convenience. > **1.** The use of automated calling and communication systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent. > > **2.** Notwithstanding paragraph 1, where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details at the time of their collection and on the occasion of each message in case the customer has not initially refused such use. > > **3.** Member States shall take appropriate measures to ensure that unsolicited communications for the purposes of direct marketing, in cases other than those referred to in paragraphs 1 and 2, are not allowed either without the consent of the subscribers or users concerned or in respect of subscribers or users who do not wish to receive these communications, the choice between these options to be determined by national legislation, taking into account that both options must be free of charge for the subscriber or user. > > **4.** In any event, the practice of sending electronic mail for the purposes of direct marketing which disguise or conceal the identity of the sender on whose behalf the communication is made, which contravene Article 6 of Directive 2000/31/EC, which do not have a valid address to which the recipient may send a request that such communications cease or which encourage recipients to visit websites that contravene that Article shall be prohibited. > > **5.** Paragraphs 1 and 3 shall apply to subscribers who are natural persons. Member States shall also ensure, in the framework of Community law and applicable national legislation, that the legitimate interests of subscribers other than natural persons with regard to unsolicited communications are sufficiently protected. > > **6.** Without prejudice to any administrative remedy for which provision may be made, inter alia, under Article 15a(2), Member States shall ensure that any natural or legal person adversely affected by infringements of national provisions adopted pursuant to this Article and therefore having a legitimate interest in the cessation or prohibition of such infringements, including an electronic communications service provider protecting its legitimate business interests, may bring legal proceedings in respect of such infringements. Member States may also lay down specific rules on penalties applicable to providers of electronic communications services which by their negligence contribute to infringements of national provisions adopted pursuant to this Article. Note: the references to Directive 95/46/EC must be read as references to the GDPR by virtue of Article 94(2) of Regulation (EU) 2016/679. The "consent" required here is therefore the consent defined in [GDPR Article 7](/law/gdpr/art-7/). Prefer the canonical version? [Open this article on eur-lex.europa.eu →](https://eur-lex.europa.eu/eli/dir/2002/58/2009-12-19) --- ## Reproduction notice The text reproduced on this page is taken from the consolidated version of *Directive 2002/58/EC (as amended by Directive 2009/136/EC)*, an official act of the European Union. EU legislative texts are excluded from copyright protection (recital 22 of Directive (EU) 2019/790). ConsentTheater is not affiliated with, endorsed by, or sponsored by any EU institution. For binding legal use always consult the official source on [eur-lex.europa.eu](https://eur-lex.europa.eu/eli/dir/2002/58/2009-12-19). We re-verify each reproduction against the canonical text on the date shown at the top of this page.