Does GDPR apply if I'm not based in the EU?

Yes. If you have any subscribers based in the EU or EEA, GDPR applies regardless of where your business is located. When in doubt, treat your whole operation as GDPR-governed.

What if I use a third-party email service provider?

You need a signed Data Processing Agreement with them. MailerLite provides a Data Processing Addendum as part of its Terms of Use. Check all other tools you use for similar agreements.

How often do I need to get re-consent from subscribers?

There's no fixed expiry. Consent doesn't need refreshing on a set schedule, but it can become invalid if your purpose changes, the original consent language was vague, or subscribers have been completely inactive for a long period. Regular list audits are the practical answer.

What are the penalties for non-compliance?

GDPR has a two-tier structure: up to €10 million or 2% of global annual turnover for less severe violations, and up to €20 million or 4% for the most serious ones. Supervisory authorities can also order you to stop processing data entirely. Reputational damage from public enforcement actions often exceeds the fine itself.

Is GDPR the same as 'Cookie Law'?

Related but distinct. Cookie Law refers to the ePrivacy Directive governing tracking technologies on websites. GDPR covers all personal data more broadly. They overlap, for example, cookies that collect personal data must comply with both. If you use tracking pixels in your emails or on your site, both frameworks apply.

Can I send cold emails under GDPR?

Technically, yes…but it's complicated. Cold email is only permissible under GDPR if you can demonstrate a legitimate interest in contacting the recipient, the email is relevant to their professional role or business, and you provide a clear opt-out in every message. In practice, this is easier to justify in a B2B context (emailing a procurement manager about a relevant service) than B2C. Even where it's permissible, it's a legal grey area. If in doubt, build your list through opt-in rather than outreach.