Caution with “double opt-in procedures” for obtaining consent for telephone advertising under data protection law

The later plaintiff is active in the field of insurance brokerage, investment and financing and had a call center conduct telephone advertising calls. A couple complained about this to the competent data protection authority. In a statement, the later plaintiff stated that the telephone number called had previously been entered on a website in the course of a lottery participation. By going through a so-called “double opt-in procedure” in full, they had given their consent to the advertising calls. The authority issued an order to restrict processing and delete the personal data pursuant to Article 58 (2) of the GDPR, which was confirmed first by the Saarlouis Administrative Court and then by the Saarland Higher Administrative Court.

According to Art. 6 (1) sentence 1 DSGVO, the processing of personal data is only lawful if there is a legal basis, such as the consent of the data subject. In practice, a “double opt-in procedure” is often used to obtain such consent. In this process, a user who has entered his or her e-mail address in a distribution list (“single opt-in”) is given the opportunity to confirm the registration in a subsequent e-mail. If the user does so, the registration and the “double opt-in” are completed. In contrast to the single opt-in process, this ensures that the application actually originates from the specified e-mail.

In the present case, the required consent under data protection law could not be obtained by the “double opt-in procedure” described, at least not for the subsequent telephone advertising approach. If one sends a telephone number in the application for participation, in this case in connection with a sweepstake, the “authenticity” of the telephone number cannot be verified by the described verification process. The provision of a false telephone number is obvious in this context. Thus, the subsequent data processing in the form of the advertising calls cannot be based on this consent. This may be assessed differently with regard to direct marketing by e-mail.

The “double opt-in procedure” remains a recognized option for obtaining consent under data protection law. This applies in particular to advertising approaches by e-mail. To minimize the risk of fines, data controllers should always carefully check whether there is a legal basis for the specific type of data processing.

Therefore, if you have any further questions about the “double opt-in process”, please feel free to contact us. Simply contact us!