Email Marketing Rules in Estonia (2026): Consent Guide for SMEs

If you send marketing emails to people in Estonia, the main rule is simple. You need prior consent before emailing private individuals. Companies can be emailed without consent, as long as every message lets them opt out. Existing customers can receive offers for your own similar products under a “soft opt-in”. These rules are in § 103¹ of the Electronic Communications Act (Elektroonilise side seadus), and the Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) enforces them. Here is what that means in practice for an SME, a web shop or a freelancer selling into Estonia.

The legal framework in one paragraph

Estonia applies the EU GDPR to all personal data, including email lists. On top of that, the Electronic Communications Act (ECA) has a section on using “electronic contact details” for direct marketing. That covers email, SMS, MMS and fax. The ECA also points to the Information Society Services Act, which sets what a commercial message must disclose. The consolidated ECA text published on Riigi Teataja, the official legal gazette, was last updated in 2026. § 103¹ itself has not changed since 2019, when its consent rule was linked to the GDPR definition. AKI supervises both GDPR compliance and § 103¹.

The three groups of recipients

1. Private individuals: prior consent

Under § 103¹(1), you may use the electronic contact details of a natural person for direct marketing only with their prior consent. That consent must meet the GDPR conditions: freely given, specific, informed and unambiguous. AKI’s guidance for e-shops spells out what this means:

• Silence or inactivity is not consent.
• A pre-ticked consent box is invalid.
• The burden of proof is on the marketer. The ECA states this directly in § 103¹(5).
• Signing up for the newsletter must be a real choice the customer can freely make.

AKI has also confirmed that for email and SMS marketing to individuals, “legitimate interest” under the GDPR cannot replace consent. In a 2022 decision against a lending company, reported by DataGuidance, AKI said legitimate interest may cover activities outside the ECA, such as profiling, but not sending the messages themselves.

2. Companies and other legal persons: opt-out

Under § 103¹(2), you may send direct marketing to the electronic contact details of a legal person without prior consent if:

• every message gives a clear, free and easy way to refuse further use of the contact details, and
• the recipient can refuse through an electronic communications network, for example by email or a link.

Be careful with addresses like firstname.lastname@company.ee. The company is the legal person, but the address also identifies an individual, so the GDPR still applies. A 2026 AKI explanation letter says the sender must first decide whether it is using a natural person’s or a legal person’s address, and then apply the right rule.

3. Existing customers: soft opt-in

§ 103¹(3) allows a business that got a buyer’s electronic contact details in connection with a sale of a product or service to market its own similar products or services to that buyer without separate consent. Three conditions apply:

• When the details were first collected, the buyer got a clear, free and easy way to refuse this use.
• Every marketing message repeats that option.
• The buyer can refuse electronically.

The exception covers your own similar products only. It does not let you promote partners or unrelated product lines, and it does not let you share the list.

What every marketing email must include

§ 103¹(4) bans electronic direct marketing if:

• the sender on whose behalf the message is sent cannot be identified;
• the message has no instructions or information on how to refuse further messages;
• the message does not meet the commercial communication requirements of the Information Society Services Act;
• the message directs people to websites that do not meet those requirements;
• the recipient has already refused.

AKI’s e-shop guidance adds that unsubscribing must be simple. People should not have to log in or search several pages for the option. Service messages such as outages or changes to terms are not direct marketing, but AKI warns against hiding offers inside them.

Quick comparison

A practical compliance checklist for SMEs

1. Map your list. Tag each contact as consumer, customer (soft opt-in) or business, and record where and when you got it.
2. Fix your sign-up forms. Use an unticked checkbox, a short statement of what people will receive, and a link to your privacy notice.
3. Keep consent records. Store the timestamp, the form version and the wording shown. If AKI asks, you have to prove consent.
4. Use one-click unsubscribe. Put it in every email footer, process it automatically, and keep a suppression list so people are not re-imported.
5. Identify yourself. Use your business name, contact details and a recognisable sender address.
6. Check your landing pages. Pages linked from emails must also meet the information requirements for commercial communications.
7. Review purchased or partner lists. Consent collected for “EU marketing in general” or by another company is risky. Re-confirm it or don’t use it.
8. Measure what matters. Good list hygiene improves deliverability. If you are not sure your tracking, consent tools and analytics fit together, our Digital Performance Audit and Analytics & Reporting Setup can help you check the whole funnel.

What happens if you get it wrong

AKI usually acts on complaints. Published decisions show a typical path: AKI opens supervision proceedings and can issue a binding precept (ettekirjutus) ordering the company to stop. If the company ignores the precept, AKI can impose a penalty payment. In a 2024 precept against a company that kept emailing a person who had objected, AKI ordered it to stop and set a penalty payment of €2,500 if it did not comply. AKI noted such payments can be imposed repeatedly. AKI has also issued reprimands in cross-border cases filed through the EU’s IMI system, for example where a recipient could not withdraw from marketing. Beyond the cost, these cases affect your reputation and your email deliverability.

Common mistakes

• Treating a GDPR “legitimate interest” assessment as enough for B2C email in Estonia.
• Using a pre-ticked box or “by creating an account you agree to receive offers”.
• Applying the B2B opt-out rule to personal email addresses at companies without thinking about the GDPR.
• Using soft opt-in for partner offers or products unrelated to what the customer bought.
• Hiding the unsubscribe link, requiring a login, or not honouring opt-outs promptly.
• Losing proof of consent when you switch email platforms.

FAQ

Do the Estonian rules apply if my company is based in another EU country?

Each EU country implements the ePrivacy rules in its own law, and the details differ. If you target recipients in Estonia, follow Estonia’s § 103¹ as a minimum. Cross-border complaints can reach AKI through the EU cooperation system. For a comparison, see our guides to Germany’s double opt-in and the UK’s PECR rules.

Do I need double opt-in in Estonia?

The ECA does not require double opt-in by name. But you must be able to prove consent, and a confirmation email is one of the simplest ways to do that.

Does § 103¹ cover SMS and WhatsApp-style messages?

It covers “electronic contact details”, which the ECA defines to include email, SMS and MMS. It does not apply to real-time two-way voice calls.

Is a B2B cold email to info@company.ee allowed?

Generally yes, under the legal-person opt-out rule, provided the message identifies you, offers an easy electronic opt-out, and meets the commercial communication requirements.

Conclusion

Estonia’s email marketing rules are short but strict. Get consent from consumers, offer an opt-out to businesses, use soft opt-in only for your own similar products, and make unsubscribing easy in every message. Keep evidence of how each address was collected, because the burden of proof is on you. If you also run a website with tracking, read our guide to cookie banner rules for a related set of consent requirements.

This article is general information, not legal advice. For specific cases, consult a lawyer familiar with Estonian data protection law.

Sources

• Riigi Teataja – Elektroonilise side seadus (Electronic Communications Act), § 103¹
• Riigi Teataja – Electronic Communications Act, English translation
• Andmekaitse Inspektsioon – Data processing and transparency (e-shop guidance, direct marketing)
• Andmekaitse Inspektsioon – Precept under the Electronic Communications Act (2024)
• DataGuidance – Estonia: DPI warns IPF Digital for direct marketing failures