For bulk email in Germany, the starting point is simple: marketing email without prior express consent is an unreasonable nuisance under § 7 UWG, and the DSGVO makes you prove that consent. The law never says "double opt-in", but since the BGH ruling of 2011 a confirmed double opt-in with stored records is how German senders prove it, so it is the norm. A setup that holds up has four parts: double opt-in, stored proof, hosting in Germany or the EU with a signed data processing agreement (AVV), and a working unsubscribe in every email.
This is general information on what the rules say, not legal advice for your case.
What the law actually says
| Rule | What it requires | Source |
|---|---|---|
| § 7(2) No. 2 UWG | marketing email needs prior express consent | § 7 UWG |
| § 7(3) UWG | narrow exception for existing customers, 4 conditions | same |
| Art. 6(1)(a) DSGVO | consent as the legal basis for processing | DSGVO |
| Art. 7(1) DSGVO | the sender must be able to prove consent | Article 7 GDPR |
| Art. 28 DSGVO | a data processing agreement (AVV) with every processor | DSGVO |
| BGH I ZR 164/09 (2011) | consent must be fully documented, stored and printable | case law |
Read the first and fourth rows together. The UWG says you need consent, the DSGVO says the burden of proving it is yours. A signup form alone proves nothing, because anyone can type anyone's address into it.
Why double opt-in is the norm
Double opt-in solves the proof problem. The person signs up, gets a confirmation email, and clicks. That click shows the address owner really asked. You store the record: the time of signup, the time of the click, the IP address and the form text they agreed to.
Double opt-in turns signups into provable consent
Expect to lose some signups at the confirm step. If 1,000 people sign up and 700 click, you mail 700, and those 700 are the people who wanted your mail. That also helps deliverability: confirmed lists produce fewer spam complaints and almost no hard bounces. Our post on double opt-in vs single opt-in covers the deliverability side.
Keep the confirmation email plain. German courts have split on whether a confirmation email is itself advertising (OLG Munich 2012 said it can be, OLG Düsseldorf 2016 said no). One sentence, one confirm link, your sender details, nothing promotional.
The existing-customer exception
§ 7(3) UWG lets you email existing customers without new consent, but only if all four conditions hold.
| Condition | What it means in practice |
|---|---|
| Address came from a sale | they bought from you and gave the address then |
| Your own similar products | no partner offers, no unrelated range |
| No objection | they have not opted out |
| Clear notice | told at collection and in every email they can object, free |
Courts read this strictly, and many shops miss the "told at collection" part. If you are not sure you meet all four, get consent.
Where your data should live
Hosting decides who else processes your list. With a typical email platform, your contacts sit on their servers, often outside the EU, and you need their AVV plus a legal basis for any transfer. With your own server in Germany, the list stays on a machine you rent, and the only processor is the hosting company.
Where the list is stored decides what paperwork you need
| Setup | Where the list lives | Paperwork |
|---|---|---|
| Own SMTP server in Germany | German data centre | AVV with the host |
| EU-based email platform | the platform's EU servers | AVV with the platform |
| US-based email platform | often the US | AVV plus a transfer basis such as the EU-US Data Privacy Framework |
For the wider EU picture, see EU-hosted SMTP for GDPR.
Hosting your email server in Germany
German data centres are a normal choice for this. Before you order, check two things with the host:
- Outbound port 25. Some hosts keep it closed on new accounts until you ask, or until the first invoice is paid. Without it your server cannot deliver mail.
- Their AVV. Most German hosts offer one in the customer panel. Sign it and keep a copy.
Then set up the sending side properly: SPF, DKIM and DMARC on your sending domain, a PTR record that matches the server name, and a bounce mailbox. These are the same rules Gmail and Yahoo apply to every bulk sender, German or not.
The DSGVO checklist for bulk email in Germany
Seven things to have in place before the first send
- Double opt-in on every signup form.
- Stored proof per contact: signup time, confirm time, IP, form text.
- Plain confirmation email, no promotion.
- AVV signed with your host and any other processor.
- Unsubscribe link in every email that works in one click.
- Your Impressum details in the email footer, as German practice expects.
- A privacy notice that names what you send and how often.
Our guide to unsubscribe link requirements covers item 5, and the GDPR overview covers the basics of consent.
What it costs
| Item | Cost |
|---|---|
| Basic plan, 25,000 emails a day | $549 one-time |
| Advance plan, 200,000 emails a day | $1,199 one-time |
| Hosting, paid to your host | about $11 a month (Basic) or $49 a month (Advance) |
| Domains | about $10 a year each |
EU visitors see our fees in euros on the pricing page. Hosting is paid directly to your host, so a German data centre bills you in euros too.
How BulkEmailSetup helps
We set up a dedicated SMTP server on hosting you choose, including a German data centre, so your list stays in the EU and only your host processes it. Every plan includes SPF, DKIM, DMARC and PTR, a bounce mailbox, a campaign platform and a warm-up plan.
There is no monthly fee to us, no contact limit and a 15-day money-back guarantee. Start with the Basic plan or compare all pricing.
Frequently asked questions
Is double opt-in required in Germany?
The law does not name double opt-in. § 7 UWG requires prior express consent for marketing email, and the DSGVO puts the burden of proof on the sender. Since the BGH ruling of 2011 (I ZR 164/09), a confirmed double opt-in with stored records is the accepted way to prove that consent, so in practice German senders treat it as required.
Which bulk email servers meet DSGVO?
No server is DSGVO-compliant on its own. What counts is how you collect consent, where the data is stored and who processes it. A server hosted in Germany or the EU, a signed data processing agreement (AVV) with every provider that touches the data, documented double opt-in and working unsubscribes together make a setup you can defend.
Can I host my email server in Germany?
Yes. German data centres are common and keep data under EU law. Check two things with the host first: that outbound port 25 is open or can be opened for your account, and that you can sign their data processing agreement. Your own dedicated server in Germany means your list never leaves the EU and no email platform processes it.
What does bulk email cost in euros?
BulkEmailSetup's plans are a one-time setup fee plus hosting, and visitors in the EU see the fees in euros on BulkEmailSetup's pricing page. In US dollars the Basic plan is $549 one-time for 25,000 emails a day, with hosting around $11 a month. Advance is $1,199 for 200,000 a day with hosting around $49 a month.
Can I email existing customers without double opt-in in Germany?
Only under § 7(3) UWG, and all four conditions must hold: you got the address from the customer in a sale, you promote your own similar products, the customer has not objected, and you told them clearly at collection and in every email that they can object at any time at no extra cost. Miss one and you need consent.
Is the double opt-in confirmation email itself advertising?
German courts have disagreed. The OLG Munich held in 2012 that a confirmation email can count as advertising, while the OLG Düsseldorf in 2016 held it permissible. The safe practice is a plain confirmation email with no promotion in it at all: one sentence, one confirm link, your sender details.
What are the fines for breaking DSGVO with email?
Under Article 83 DSGVO, the top fines reach €20 million or 4% of worldwide annual turnover, whichever is higher. In practice the more common risk for German email senders is a cease-and-desist letter (Abmahnung) under the UWG from a competitor or consumer group, with legal costs attached. Records of consent are your defence in both cases.
