Stricter Enforcement of German Advertising and Marketing Rules Effective September 1
Time 2 Minute Read

As of September 1, 2012, all personal data in Germany may only be processed and used for marketing purposes (including address trading) with the express opt-in consent of the affected individuals. Furthermore, the consent language must have been specifically drawn to the attention of the relevant individual as part of the terms and conditions governing the use of his or her personal data.

When the German Federal Parliament amended the rules of the Federal Data Protection Act on the use and disclosure of personal data for advertising purposes in 2009, it provided companies with a three-year temporary grace period during which they could process and use existing data sets under the old law, which did not require the express opt-in consent of the individual. This grace period expired on August 31, 2012, meaning that explicit opt-in consent is now necessary.

There are a number of exceptions to this opt-in consent requirement:

  • Companies and other private entities may continue to use certain types of personal data (e.g., name, title, academic degree, address, date of birth, occupation, industry or business name) without the individual’s consent for marketing. This exception applies only when a company promotes its own offers and the data were received directly from the individual or from public records.
  • Advertising third-party offers is also permitted without an individual’s consent if the advertisement clearly indicates where the relevant personal data are stored and which company is responsible for the advertisement.
  • Companies may market with data obtained from address-selling businesses when they log the sources of the relevant personal data and are able to provide further information about such sources. In addition, the advertisement must indicate which company initially collected the data.

It should be noted, though, that even when a relevant exception to the consent requirement applies, the individuals concerned may object to the use or transfer of their data and must be informed in the advertisement itself about their right to object.

You May Also Be Interested In

Time 6 Minute Read

On February 9, 2026, trade association NetChoice filed a lawsuit challenging South Carolina’s newly passed Age-Appropriate Code Design (“SC AACD”) on First and Fourteenth Amendment grounds. The SC AACD was signed into law on February 5, 2026, making South Carolina the fifth U.S. state to enact such a law, following California, Maryland, Nebraska and Vermont.

Time 2 Minute Read

On January 30, 2026, the Cybersecurity Administration of China released a Q&A document on policies and regulations for the security management of cross-border data transfers. 

Time 1 Minute Read

On January 26, 2026, the Brazilian data protection authority (“ANPD”) announced that Brazil and the European Union agreed to mutually recognize the adequacy of each other’s data protection networks.

Time 2 Minute Read

On January 15, 2026, the UK Information Commissioner’s Office published updated guidance on international transfers of personal data under the UK GDPR.

Search

Subscribe Arrow

Recent Posts

Categories

Tags

Archives

Jump to Page