Separate permission to contact from credit-promotion compliance
A lawful route to send a marketing email does not establish that the credit promotion inside it is compliant. Two sets of questions arise. First, can this creditor or marketing partner contact this recipient through the chosen channel, using these data, for this purpose? Second, are the credit claims, rates, prices and eligibility statements lawful in the target jurisdiction? In the EU, Article 13 of Directive 2002/58/EC governs certain unsolicited communications, implemented through national legislation, while the GDPR governs personal-data processing. Consumer credit advertising also falls under the applicable national rules implementing Directive 2008/48/EC and general consumer law. Revised CCD2 advertising provisions in Articles 7 and 8 generally become applicable through national measures from 20 November 2026. An email campaign must pass both reviews rather than borrowing a single compliance approval for everything.
Consent and the existing-customer exception are conditional
Article 13 of the ePrivacy Directive generally requires prior consent for unsolicited email direct marketing, subject to conditions and national implementation. Its existing-customer exception concerns electronic contact details acquired in the context of a sale, marketing of that same organisation's own similar products or services, and a clear, easy, free opportunity to object at collection and in each message if the customer has not initially refused. It is not a blanket permission to advertise any financial product to every past applicant or prospective customer. Member State rules, the nature of the recipient and the relationship need review. Document the origin of the address, relevant consent or exception analysis, and whether a suppression request has been honoured. A contractual marketing list supplied by an affiliate is not proof that contact is lawful.
Keep credit terms and cost figures accurate in subject and body
An email subject line saying guaranteed acceptance, zero fees or low interest can create an expectation before the message is opened. Review both subject and preview text with the full body, landing page and offered agreement. Article 4 of Directive 2008/48/EC sets standard information requirements for covered advertisements indicating an interest rate or figures related to credit costs, subject to the relevant conditions and national implementing law. Article 8 of CCD2 revises this framework and introduces a borrowing-cost warning for covered advertising. Do not assume that information required in an advertisement can always be deferred to a linked page. The sender should check whether the promoted agreement is within scope, what figures appear, which standard information is triggered and what presentation works in the medium.
Personalisation and profiling require separate review
A lender might select customers using account activity, previous applications, credit bureau data or predictive scores. Such targeting can raise transparency, lawful-basis, fairness, data-minimisation and other GDPR questions, independent of the wording of the credit advertisement. Profiling for a promotional audience is not automatically a statutory creditworthiness assessment, nor does an apparent prequalification guarantee the recipient will receive the credit. Record how each recipient group was created, what the marketing claims imply, what data were used and whether the campaign's terms are actually available to the audience. Do not convert a general compliance article into personal advice about who should borrow. Where automated decisions have legal or similarly significant effects, separate GDPR obligations may arise and require specific review.
Operational checks for deliverability and unsubscribes
A practical pre-send review covers the sender's identity, reply and opt-out mechanism, suppression lists, lawful targeting, market exclusions, approved product terms and the final rendered creative. Article 13(4) of the ePrivacy Directive prohibits marketing email that disguises the sender or lacks a valid address for recipients to request that communications stop. Teams should test the unsubscribe route rather than assuming the presence of an icon is sufficient. Template systems can truncate rates or omit caveats in mobile preview panes. Scheduled mail and automated lifecycle campaigns need expiry dates when quoted promotions change. Outsourced email services and intermediaries should have clear instructions about permitted audiences, claims and the procedure for halting a campaign after a compliance issue.
Retain records and monitor national change
Maintain evidence of the campaign version, target country, recipient selection rules, permission-to-contact assessment, approved financial claims, statutory example calculations where applicable and date of publication. Record who authorised legal and editorial aspects separately, as well as the date and cause of any withdrawal. A complaint about unwanted communications is not the same issue as a complaint about a misleading borrowing-cost claim, even if both concern one email. The ePrivacy Directive and GDPR should be checked with national implementing legislation and regulator materials; the UK has separate PECR and FCA requirements and should not be treated as an EU Member State. Review the campaign when national CCD2 measures begin applying on 20 November 2026, when data practices change or when pricing and eligibility terms are revised.
Frequently asked questions
Is consent to receive a marketing email enough to make the credit advertisement compliant?
No. The legal basis for sending the message and the accuracy and completeness of credit advertising are separate questions.
Can an existing customer always receive credit marketing emails without consent?
No. The Article 13(2) exception has specific conditions and depends on national implementation.
When do revised CCD2 advertising measures apply?
Member States must generally apply their implementing measures from 20 November 2026.
Primary sources
Directive (EU) 2023/2225, Articles 7, 8 and 48 ↗Directive 2008/48/EC, Article 4 ↗Directive 2002/58/EC, Article 13 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.
Related research
consumer credit advertising and financial promotion compliance ↗