If you build an email list, sooner or later someone on it will live in the European Union. Maybe a reader found your free checklist through a search, or a friend who moved abroad signed up. Then a worry shows up: do I have to follow Europe’s privacy law, the GDPR, even though my business is a one-person operation in the United States?
This guide gives you a plain-words picture of how the GDPR touches a small list and a short set of habits that keep you on solid ground. It is general information, not legal advice, and rules differ by country. If your list is large or you handle sensitive data, ask a qualified professional.
Does the GDPR apply to a US side business?
It can. According to the European Commission’s guidance, the GDPR can cover a company outside the EU when it offers goods or services to people in the EU, whether paid or free, or when it monitors the behavior of people in the EU. The same page says that simply serving a customer who happens to be traveling in the EU does not trigger the rules, as long as you are not specifically targeting people there.
So a US blogger who runs a general-audience site and occasionally gets an EU subscriber is in a different position from one who prices in euros, writes for a specific European country, or advertises to EU readers. Where you fall is a judgment call, and the safest habit is to build one signup process that would be fine for either.
What counts as valid consent
Email marketing under the GDPR usually leans on consent. The Commission lists the conditions for valid consent, and they translate neatly into list-building habits:
- Freely given: people can say no without being penalized. Don’t make an unrelated newsletter signup a hidden condition of getting something they need.
- Specific: consent is for a stated purpose. If you will send a weekly newsletter and occasional product offers, say both.
- Informed: tell people who you are, what you will send, and that they can withdraw at any time.
- Unambiguous: consent needs a clear positive act, such as ticking a box yourself. Pre-checked boxes and “by visiting this site you agree” banners are the opposite of that. (The Commission page lists the positive act but does not discuss pre-ticked boxes, so treat that as a common-sense reading rather than a quote.)
- Clear: use plain, visible language rather than a wall of legal text.
- Withdrawable: an unsubscribe link in every email is the standard way to honor this.
A signup form that holds up
You do not need a lawyer’s template to improve your form. A short block of text next to the button does most of the work. Something like: “Get my weekly newsletter on building a side business. I’ll also send an occasional email about my guides. Unsubscribe any time. Privacy policy.” Link the policy to a page that explains what data you collect, which email service holds it, and how someone can ask you to delete it.
Many email services let you add a consent checkbox or a confirmation email to your forms. A confirmation email, often called double opt-in, also gives you a record that the person clicked. We cover the trade-offs in Double Opt-In or Single Opt-In? How to Choose for a Small Email List.
Keep simple records
If someone questions how they landed on your list, you will want to show where and when they signed up and what the form said. Most email services store a signup date, source and sometimes an IP address. Check what yours keeps, and save a screenshot or copy of the form text whenever you change it. A one-page note with the date and wording costs nothing.
Make leaving easy and honor it
- Put a working unsubscribe link in every message and process requests promptly.
- Don’t re-add someone you removed because they “seemed interested.”
- If someone asks you to delete their data, check what your email service, your spreadsheet and any other tool holds, and remove it everywhere you reasonably can.
- Don’t buy or rent lists. People who never asked to hear from you cannot have given informed consent.
The US rule for commercial email, CAN-SPAM, is a different set of requirements that centers on honest headers, a physical address and opt-outs. See our CAN-SPAM checklist for that side, and remember that following one law does not automatically satisfy the other.
What to do when you are unsure
Start with the strictest reasonable approach, since it costs little: clear wording, unchecked boxes, an easy unsubscribe, a privacy policy that matches what you actually do. If you later sell to a specific EU market, run an ad campaign there or collect more than an email address, get professional advice for your situation. Your email service’s own help pages also explain what their tools support, but they cannot decide what the law requires of you.
Why an honest list is worth the effort is covered in Why Your Side Business Needs an Email List, Even a Tiny One. A list built on clear permission tends to be smaller at first and far easier to trust.
Do this today
Open your signup form and read it as a stranger would. Add one sentence saying what you will send and how often, make sure no box is pre-checked, and confirm the unsubscribe link and privacy policy link both work. Save a screenshot with today’s date. That is thirty minutes or less.
More on Totally Relentless
- Double Opt-In or Single Opt-In? How to Choose for a Small Email List
- CAN-SPAM Basics for Small Lists: A Plain-Words Checklist
- Why Your Side Business Needs an Email List, Even a Tiny One
