Newsletter and SMS consent: Poland’s Electronic Communications Law

Before 11.11, Black Friday (27 November this year) and the holidays, companies send the most newsletters and promotional SMS messages. It is a good time to sell, but also to slip up. A single mailing to an “old Excel list” in which half the people never agreed to advertising can cost more than the whole campaign brings in.

Since 10 November 2024, the rules for sending offers by email and SMS have been in a single provision: Art. 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej, PKE). This is not legal advice: I describe the law as of 26 October 2026, and in an unusual situation it is worth asking a lawyer.

What Art. 398 of the Electronic Communications Law says

Art. 398 of the Electronic Communications Law prohibits sending commercial information, including direct marketing, by email, SMS, phone, messaging apps and automated calling systems, unless the recipient has previously consented.

In practice this means four things:

• Consent first, then the message. You don’t send a promotion with a note saying “if you don’t want more offers, reply”. That is the wrong order.
• Companies are protected in the same way as private individuals. In its response to parliamentary interpellation no. 12146 of 30 September 2025, the Ministry of Digital Affairs writes that the protection covers natural persons, sole proprietorships and companies on equal terms.
• Consent must meet GDPR requirements. Art. 400 PKE refers to data protection law. Consent must be voluntary, specific, informed and unambiguous, and you must be able to demonstrate it.
• The old legal bases are out of date. The PKE replaced the Telecommunications Law (Prawo telekomunikacyjne), and Art. 10 of the Act on Providing Services by Electronic Means (ustawa o świadczeniu usług drogą elektroniczną) was repealed. If your form or privacy policy cites those provisions, it is time to fix it.

The message also cannot be sent at the recipient’s expense (Art. 398(3)).

What a mailing without consent can cost

For the lack of consent, the President of UKE (Urząd Komunikacji Elektronicznej, Poland’s electronic communications regulator) can impose a penalty under Art. 446(5) PKE: up to 3% of the previous year’s revenue or up to PLN 1,000,000, with the higher amount applying. For a small business the upper limit is therefore PLN 1 million, even if 3% of its revenue comes to only a few tens of thousands. UKE sets the amount of the penalty according to the nature and scope of the violation.

On top of that come:

• a petty offense under Art. 448 PKE: sending commercial information without consent is punishable by a fine, and the case starts at the request of the injured party, usually the person who received the message,
• an act of unfair competition (Art. 398(4)), that is, the risk of a lawsuit from a competitor,
• a complaint to UODO (Urząd Ochrony Danych Osobowych, Poland’s data protection authority), if you process recipients’ data in breach of GDPR.

In the same response, the Ministry of Digital Affairs stresses that the business must be able to demonstrate consent, also when it uses someone else’s contact list, so the list seller’s assurance alone is not enough.

What good consent should look like

Five rules for good consent:

1. The checkbox is not pre-ticked. No reaction, or a default setting, is not consent.
2. Email and SMS separately. According to the Ministry of Digital Affairs, a specific consent means naming the communication channel. Consent to a newsletter does not cover SMS messages.
3. Not in the terms and conditions. GDPR requires that the request for consent be clearly distinguishable from other statements. A single checkbox saying “I accept the terms and conditions and agree to offers” does not meet this condition.
4. Not as a condition of purchase. The customer must be able to place an order or book an appointment without consenting to advertising.
5. Clear: who, about what and how to opt out. The company name, the type of messages and how to withdraw consent.

Beware of a common trap: an email address given for an order is not consent to a newsletter. Art. 398(2) allows consent by providing an address, but only when someone provides it precisely to receive commercial information, for example in a “Subscribe to the newsletter” field.

Sample checkbox wording for your form:

[ ] I want to receive the [company name] newsletter with promotions and news by email. I can withdraw my consent at any time using the “Unsubscribe” link in every message.

[ ] I want to receive [company name] promotional SMS messages at the phone number I have provided. I can withdraw my consent at any time by writing to [email address] or following the instructions in the message.

Below the checkboxes, add a short note on who the data controller is, and a link to the privacy policy.

Unsubscribing in one click

Art. 7(3) GDPR says it outright: withdrawing consent must be as easy as giving it. If signing up took a second, opting out cannot require logging in, a letter or a phone call.

In practice:

• in every email an “Unsubscribe” link in the footer that works without logging in,
• in an SMS a short opt-out instruction; if you send with a sender name instead of a number, the recipient can’t reply, so give a short link or an email address,
• an unsubscribe list: add people who have opted out to a suppression list so they don’t come back into the database at the next import from the store or a spreadsheet.

Mailbox providers have their own requirements too. In its sender guidelines, Google requires every sender to keep the spam report rate below 0.3%, and senders who send more than 5,000 messages a day to Gmail accounts must also offer one-click unsubscribe. The fewer spam reports, the better your later emails are delivered. I describe how to set up your domain so that messages don’t land in spam in my guide on SPF, DKIM and DMARC.

The old list: which consents are still valid

There is a transitional provision for consents collected before 10 November 2024. Art. 100 of the act introducing the PKE says that such consents remain valid if the original way they were given meets the conditions of the new act. A good consent from years ago still works, and a weak one has not become better because the law changed.

Here is how it looks in a typical list:

The law does not set an expiry date for consent. But if someone hasn’t opened a single message in several years, send them one email asking whether they still want to receive the newsletter. If they don’t reply, remove the address from the list.

What is not marketing, and where it is easy to overdo it

According to the Act on Providing Services by Electronic Means, commercial information is any information intended to promote goods, services or a company’s image. That is why an order confirmation, a tracking number, an invoice or an appointment reminder generally don’t require marketing consent. The trouble starts when you add “Black Friday -30% on everything” to such a message.

Be careful with:

• an abandoned cart reminder: it encourages a purchase, so it is safer to treat it as marketing (at Sklep Żukowscy, such emails go out only with the customer’s consent),
• holiday greetings: the definition also covers promoting a company’s image, so mass greetings sent to people without consent are a gray area, and greetings with a discount code are already promotion,
• an email or SMS asking for consent sent to people who haven’t given it: lawyers assess this differently, and the Ministry of Digital Affairs points out that you must not ask for consent to an offer during a phone call. The safest approach is to ask for consent where the customer is filling something in anyway: in the order, when creating an account, in the booking form.

Tidying your list before 11.11 in 6 steps

There are more than two weeks left until 11.11 and a month until Black Friday. That is enough:

1. Export contacts from your newsletter tool, your store and your SMS gateway into a single spreadsheet.
2. Add columns: channel (email or SMS), date of consent, source (which form) and the wording of the checkbox the customer ticked.
3. Divide contacts into three groups: email consent, SMS consent, no proof of consent. The third group gets no promotions.
4. Fix your forms according to the five rules described above, and record the date the consent wording changed.
5. Test unsubscribing: send a test email, click “Unsubscribe” and check that the address really disappears from the list.
6. Secure your consent register so that it survives a change of mailing tool. In an inspection you must be able to show who consented, when and to what.

Double confirmation of sign-up (double opt-in), that is, an email with a “Confirm subscription” link, is not required by law, but it provides strong proof of consent. This is how the newsletter I implemented at Sklep Żukowscy works. You will find the full plan for preparing your store for November in the guide Black Friday 2026 in a small store.

Summary

Before a holiday mailing, check three things: whether every recipient has consented to that specific channel, whether you can demonstrate it, and whether unsubscribing works in one click. Set aside contacts without proof of consent, even if they are your regular customers.

If you want consents, sign-ups and unsubscribes to run on their own, I can set it up: a newsletter with double opt-in and domain configuration, an SMS gateway with templates, and I can keep your customer data together with the consent register on a separate server in the European Union. Write to me: I reply within 24 hours.