Last reviewed:
Translated from German; if the versions differ, the German version applies.
Not legal advice: Legal content on this page appears only as verbatim quotations from statutes, court rulings or authority papers, with their source; quotations from German texts are our working translations. We do not assess them ourselves, and no lawyer has reviewed this page. It is no substitute for legal advice in your individual case.
Segmentation and personalisation
Not every message suits every recipient. Segmentation means dividing the mailing list into groups and sending each group only what concerns it. Personalisation means adapting individual parts of an email – the greeting, a section, an offer – to the person. Both can save readers time and prevent unsubscribes. What the EU General Data Protection Regulation (GDPR) and the German data protection authorities write about this is quoted verbatim further down.
Useful criteria, from simple to elaborate
| Criterion | Example | Data source |
|---|---|---|
| Self-selected topics | “Courses” and “club news” can be ordered separately | information given at sign-up or in the settings |
| Language or region | issues in German and English; dates only for one’s own town | information given by the person |
| Relationship | members, customers, prospects | your own master data |
| Time of sign-up | a separate welcome series for new subscribers | date of sign-up |
| Behaviour | who clicked a particular link or bought something | analysis of clicks, orders |
Our experience: the first two rows bring the greatest benefit with the least effort. Anyone who lets readers choose what they receive does not have to guess.
Profiling: what the GDPR and the data protection authorities write
The GDPR defines: “‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements” (Art. 4(4) GDPR).
Quotations from German laws, court rulings and authority papers are our working translations; only the German wording is authoritative (see the German version of this page). In its guidance on direct marketing, the German Data Protection Conference (Datenschutzkonferenz, DSK) describes “practical cases of balancing of interests” and states first: “Subject to the specific balancing in the individual case and the supplementary explanations in points 1.4 and 1.5, the following broad categories may become relevant for the balancing in practice. The practical cases deal exclusively with the processing activities at the controller itself, not with transfers to other controllers.” (our translation) The two cases read:
“a) Sending advertising after an order without selection or after selection without additional insight (without profiling)
As a rule, the interests of the data subjects worthy of protection do not prevail if, following an order, an advertising catalogue or an advertising letter for the purchase of further products of the controller is sent by post to all customers (without selection). If a selection criterion leads to a division into advertising groups (e.g. by postcode or alphabet), but the selection does not yield any additional insight through individualisation (profiling), the balancing of interests will as a rule also come out in favour of the controller.”
“b) Sending advertising after an order and selection (profiling)
More intrusive measures such as automated selection procedures to create detailed profiles, behavioural predictions or analyses that lead to additional insights, on the other hand, indicate that the data subject’s interest in the exclusion of the data processing prevails. In these cases it is profiling that can no longer be based on Art. 6(1) subpara. 1(f) GDPR and therefore requires obtaining explicit consent (cf. Art. 22(2)(c) GDPR) before the data processing. A reference to the right to object under Art. 21 GDPR is not sufficient.
The creation of a profile using external data sources (e.g. information from social networks) for direct marketing purposes (advertising scores) will also as a rule lead to the interests of the data subject worthy of protection prevailing.” (our translation) — DSK guidance on direct marketing (February 2022), section 1.3.2, p. 5
The section is part of the chapter “balancing of interests” of the guidance. Whether and to what extent consent to a newsletter covers segmentation by clicks or purchases is not expressly answered by the GDPR or the guidance.
Objection, special data, data minimisation: the wording
- Objection. “Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.” (Art. 21(2) GDPR) “Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.” (Art. 21(3) GDPR)
- Special categories of personal data. The DSK writes: “Apart from explicit consent, Art. 9 GDPR contains no legal basis for processing special categories of personal data for advertising purposes. This may be relevant, for example, for companies and professions in the health sector (pharmacies, medical supply stores, opticians, orthopaedists, etc.). It must be examined in the individual case whether conclusions about a person’s health can already be drawn from the fact that someone is a customer of a particular company in the health sector.” (our translation; guidance, section 3.6, p. 14)
- Data minimisation. The GDPR says: “Personal data shall be: […] adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)” (Art. 5(1)(c) GDPR).
Personalisation without embarrassment
- Placeholders with a fallback. “Hello {First name}” becomes “Hello ,” if no name is stored. Set a fallback for every placeholder (“Hello everyone”).
- Do not guess the form of address. Do not derive a title or gender from the first name. If you want a form of address, ask for it on a voluntary basis – or do without.
- Test with real edge cases. Empty fields, very long names, umlauts, hyphens.
- Do not get too personal. An email that shows how closely someone was watched (“Yesterday you looked at our prices three times”) tends to put people off rather than help.
Maintaining segments
Segments go out of date: interests change, customers become former customers. Offer a link to the settings in every issue where readers can change their topics themselves – next to the unsubscribe link, not instead of it.