This week, inboxes are filled with messages from companies asking recipients to stay subscribed.
"We're updating our privacy policy." "Click here to keep hearing from us." Some of these messages come from businesses that recipients do not remember giving their address to, which illustrates the problem. Most people appear to be clicking on very few of them, and many mailing lists are about to become considerably shorter.
Tomorrow, May 25, the GDPR applies. The European Union's General Data Protection Regulation was adopted in 2016 with a two-year transition period. Many businesses spent those two years without preparing and the last two weeks rushing to comply.
Our assessment, which differs from the prevailing view, is that this regulation will benefit small business marketing.
Why does GDPR matter for a business outside Europe?
The scope is what surprises many businesses. The regulation applies to organisations outside the EU when they offer goods or services to people in the EU, or monitor their behaviour. A guesthouse in Asia with German guests on its mailing list is therefore covered. A Canadian shop selling online to France is covered. A dive centre in Indonesia where half the guests are European is also covered; this applies to us and to every operator we know in the area.
The fines are what make the headlines: up to 20 million euros or 4% of worldwide annual turnover, whichever is higher. Realistically, no small business will face the maximum, but the figure has drawn attention in a way that general appeals to respect privacy never did.
For the full text, the complete GDPR is presented article by article on gdpr-info.eu. It is more readable than many expect. Articles 6 and 7, on lawful basis and consent, are the ones most relevant to small businesses.
What does GDPR require for newsletter consent?
This is the most significant change for any business with a mailing list. Under the GDPR, consent must be freely given, specific, informed and unambiguous. A pre-ticked box does not qualify. Neither does the assumption that a single past purchase allows a business to send emails indefinitely.
Each business therefore needs to review its list and answer a difficult question: for each person, can we show how and when they agreed to hear from us?
For most small businesses, the honest answer is "partially." Names from a sign-up sheet at an event, addresses copied from bookings, a business card collected at a trade show. This explains the emails currently filling everyone's inbox: re-permission campaigns. The business emails everyone once, explains the situation, and keeps only the people who say yes.
Lists will shrink, some of them substantially. Last year, the British pub chain Wetherspoon went further and deleted its entire customer email database. Most small businesses will not go that far, but many will lose a large share of their list.
Our expectation, however, is that the remaining lists will perform better. People who actively said yes open more, click more and complain less. A smaller list of people who want to hear from you is more valuable than a large one of people who do not. We have held this view for years, and the GDPR will lead many businesses to observe it for themselves.
How should a plain-language privacy policy be written?
The other document businesses are rushing to update is the privacy policy. Most were copied from elsewhere, contain legal filler, and describe data practices the business does not actually have.
The GDPR expects the information provided to people to be concise, transparent and written in clear, plain language. This principle works well for a small business, which typically does little with data. The policy should simply describe what you do:
- What you collect (name, email, possibly a phone number for bookings).
- Why you collect it.
- Who else has access to it, such as your email platform or booking system.
- How long you keep it.
- How someone can ask you to delete it, and whom to contact.
Five short sections, written as you would explain them to a customer at the counter. For most small businesses, this is sufficient, and it inspires far more trust than six pages of boilerplate that nobody reads.
How should a business handle cookie consent and tracking?
A problematic pattern is already emerging. The response to cookie consent requirements is becoming large banners designed to prompt visitors to click Accept. Meanwhile, the site underneath loads a dozen tracking scripts the owner is not aware of: a Facebook pixel from an old ad campaign, three analytics tools, a chat widget, and embeds that send data elsewhere.
We recommend reducing tracking before addressing the banner. Open your site, review what it loads, and remove anything you do not use. If you consult only one analytics dashboard, you need only one analytics tool. Fewer scripts mean fewer consent issues, a faster site, and less to explain in your privacy policy. Setting up conversion tracking and analytics properly usually begins with removing tools, not adding them.
What does GDPR mean for a business in Canada?
Having co-founded a web agency in Vancouver, we frequently receive this question from Canadian businesses. If you have customers in Europe, the GDPR can apply to you. Tourism businesses in particular should assume that it does.
Canada also has its own rules. CASL, the anti-spam law, has required consent for commercial emails since 2014, so a Canadian business should already be able to explain how each person signed up. If it cannot, that is a problem regardless of Europe. In addition, under PIPEDA, the federal private-sector privacy law, mandatory reporting of data breaches takes effect on November 1 this year. Canadian businesses will therefore need to know what data they hold and why in any case.
This article does not constitute legal advice. If you handle sensitive data, we recommend consulting a lawyer. For a typical small business, however, the practical work fits in a short list: know where every email address came from, write your privacy policy in plain language, and stop loading scripts you do not need.
If your email newsletter list combines genuine subscribers with addresses collected along the way, we recommend sending the re-permission email. The short-term loss is quickly offset: the result is a list of people who genuinely want to hear from you, which is the only kind of list with real value.