Caution with “double opt-in procedures” for obtaining consent for telephone advertising under data protection law

In its decision of February 16, 2021 (Case No.: 2 A 355/19), the Higher Administrative Court of Saarland determined that consent under data protection law to advertising approaches by telephone cannot be proven by the so-called “double opt-in procedure” in connection with an “Internet sweepstake”. The telephone advertising can then also not be based on a legitimate interest according to Art. 6 (1) lit. f DSGVO, as there is an anti-competitive processing.

Facts: Advertising calls after alleged participation in “Internet sweepstakes

The later plaintiff is active in the field of insurance brokerage, investment and financing and had a call center conduct telephone advertising calls. A couple complained about this to the competent data protection authority. In a statement, the later plaintiff stated that the telephone number called had previously been entered on a website in the course of a lottery participation. By going through a so-called “double opt-in procedure” in full, they had given their consent to the advertising calls. The authority issued an order to restrict processing and delete the personal data pursuant to Article 58 (2) of the GDPR, which was confirmed first by the Saarlouis Administrative Court and then by the Saarland Higher Administrative Court.

No data processing without a legal basis

According to Art. 6 (1) sentence 1 DSGVO, the processing of personal data is only lawful if there is a legal basis, such as the consent of the data subject. In practice, a “double opt-in procedure” is often used to obtain such consent. In this process, a user who has entered his or her e-mail address in a distribution list (“single opt-in”) is given the opportunity to confirm the registration in a subsequent e-mail. If the user does so, the registration and the “double opt-in” are completed. In contrast to the single opt-in process, this ensures that the application actually originates from the specified e-mail.

“Double opt-in procedure” unsuitable for obtaining consent for telephone advertising under data protection law

In the present case, the required consent under data protection law could not be obtained by the “double opt-in procedure” described, at least not for the subsequent telephone advertising approach. If one sends a telephone number in the application for participation, in this case in connection with a sweepstake, the “authenticity” of the telephone number cannot be verified by the described verification process. The provision of a false telephone number is obvious in this context. Thus, the subsequent data processing in the form of the advertising calls cannot be based on this consent. This may be assessed differently with regard to direct marketing by e-mail.

Conclusion: Close examination of the consent procedure and the type of subsequent data processing.

The “double opt-in procedure” remains a recognized option for obtaining consent under data protection law. This applies in particular to advertising approaches by e-mail. To minimize the risk of fines, data controllers should always carefully check whether there is a legal basis for the specific type of data processing.

Therefore, if you have any further questions about the “double opt-in process”, please feel free to contact us. Simply contact us!