1

looking for a little advice on HTML emails and GDPR re-permission.

With the new GDPR regulations I have to create an email to send out to an existing list requesting their consent to continue contacting them.

My intention is to have an 'I'm in' button in the email, which when clicked takes the user to another page/url which has a simple form on it requesting the users email address and checkbox for them to tick to opt in.

My question is can I achieve this another more simple way. For example in the email itself when the user clicks the 'I'm in' button, can a post submission be made automatically with their email address, that gets sent to clients email, and they then just get re-directed to a standard success message. Is something like this possible? It would save having to create a form somewhere and make the process easier for the user.

I don't normally do HTML emails so I'm a little unsure - any help on this would be greatly appreciated, thanks in advance

Paulie_D
  • 107,962
  • 13
  • 142
  • 161
CraigDev
  • 113
  • 1
  • 12
  • If you don't already have explicit consent, then sending an email to ask them to give you consent would be a violation of Privacy and Electronic Communications Directive 2002/58/EC (known in the UK as PECR). And if you already had explicit consent, then you didn't need to ask for it again, not even because of the GDPR. – Mark Rotteveel May 28 '18 at 08:02

2 Answers2

2

Yes, you could embed their email in the query string of the URL and then have a webapp at that URL pick up their email from the querystring and process it. Obviously you'd need to code the webapp side accordingly.

E.g:

<a href="http://yourwebapp.com/?email=someemail@place.com">I'm in!</a>
Mark Wragg
  • 22,105
  • 7
  • 39
  • 68
  • @CraigDev, should you still have any doubt on how to implement the solution proposed by MarkWeagg, I've added a more detailed answer – don May 03 '18 at 16:12
  • While SO is _technically_ about tech stuff, I'd like to point out that providing plaintext email (personal data as per GDPR) via non-TLS connection (again, encrypted transfer is recommended by GDPR) looks like a bad, BAD idea. Simply put, you give out your subscriber's personal data to any host user will come through during packet exchange – Evgeniy Chekan May 16 '18 at 17:53
1

If you can still send an email to the user, the collection of consent can be quite simple. It will be sufficient to send each user an email containing a link to accept the newsletter (e.g. "Yes, I want to receive the newsletter"). The email should also contain the terms and conditions of the service, and the privacy policy. What come next can be either automated, or handled manually.

The best option would be to automate the process. This can be done in multiple way, the simplest being with a customized link for each user pointing to a website capable of interpreting the data transmitted by the link itself. To achieve this result, the link contained in each email should contain an identification code - which should be anonymized where possible - so that it will be possible to link the new consent to each user. In this way, when the user clicks the link, he or she will be taken to the website. At that point, the backend will be able to collect the code passed by the link, identify the user and, finally, re-subscribe the user to the newsletter.

In practical terms, in the email there could be a link with a value to be passed as a `GET« parameter:

<a href="https://www.example.com/re-subscribe?uuid=123xyz">Yes, I want to receive the newsletter</a>

The server-side logic could be as follows (in PHP synthax):

// re-subscribe.php
$uuid = $_GET['uuid'];
$user = getUserByUUID($uuid); // assumed function that gets the user infos by a UUID
subscribeUser($user); // assumed function that re-subscribes user to the newsletter
echo 'Thank you!'

This could even be accomplished manually, provided that a link tracker service/tool is used.

In this – less ideal – case, in the email there should only be a single clickable link, the one required to express consent (e.g. "Yes, I want to receive the newsletter"). This link could take the user wherever deemed most appropriate. What matters, in this case, is the ability, through the tracker service/tool, to know which users have clicked the link. As long as there is only one link in the email, this would inform us that the user has expressed his or her consent, and thus we could manually re-subscribe them to the newsletter. In this case, the link to the terms and conditions and to the privacy policy should be included as static text, and not as an actual clickable link.

For more info, check out our blog post, inspired by this question, at blog.autoprivacy.eu/2018/05/newsletters-after-gdpr-existing-and-new.html

don
  • 4,113
  • 13
  • 45
  • 70