What is the difference between soft opt-in and explicit consent?

Explicit consent requires an active checkmark placed by the customer — required for SMS, telephone, and email marketing to new leads. Soft opt-in is the exemption under Section 10(2) of the Marketing Practices Act: if the customer has made a purchase from you, you may send emails regarding similar products, provided the customer has a clear option to unsubscribe in every email.

Can we send an SMS to a customer who bought a car from us?

No, not without explicit consent for SMS. The soft opt-in (Section 10(2)) only covers email. SMS always requires an active opt-in from the customer — even if they are existing customers.

How much does it cost to send a single SMS without consent?

The Consumer Ombudsman's established practice is typically €1,340 per unsolicited SMS or email. The fine increases in case of repeat offenses or deliberate violations. Actual cases against Danish businesses have resulted in fines of €13,400 to €201,000 — and the GDPR ceiling is 4% of global turnover or €20 million.

Skal samtykker fornyes?

Yes. There is no statutory expiration date, but the Data Protection Agency and legal precedent point to 12–24 months for marketing consents. Outdated consent will not hold up in a case if it was given too long ago. Set a validity period and run an automated renewal flow 30 days prior to expiration.

Can the salesperson take the customer database with them?

No. Consent is granted to the dealership entity (the CVR number), not to the individual salesperson. If the salesperson takes the customer list, it constitutes both a GDPR breach (unauthorized data processing) and a potential marketing law violation if the new employer contacts them. Use a system where customer data does not reside in the salesperson's own Outlook.

What qualifies as 'similar products' in the automotive industry?

A narrow interpretation applies. Did you sell a family car? Then servicing, tires, insurance, and a newer model of the same type are considered 'similar'. A loaner car agreement, a sports car, or a general newsletter about the entire business is NOT. Borderline cases are typically decided in favor of the customer.

Can legitimate interest be used for marketing purposes?

Only to a limited extent. GDPR Art. 6(1)(f) permits legitimate interest, but Section 10 of the Marketing Practices Act takes precedence and strictly requires consent for electronic marketing regardless of the GDPR basis. Legitimate interest can be used for internal analytics and service communications — not for commercial push campaigns.

What must we keep on file as documentation?

At a minimum: the exact wording of the consent text, timestamp, IP address, the channel through which consent was given (signing page, online form, email), the purpose it covers, and any partner names. Plus an audit log of every change and withdrawal. Without this, you have no documentation to present to the Data Protection Agency.

Is double opt-in sufficient to make consent valid?

No. On 3 June 2026, the Consumer Ombudsman notified three car dealerships that their double opt-in model (verbal consent followed by SMS/email confirmation) did not inherently make the consent valid. If the customer did not receive clear information at the initial stage regarding which companies were permitted to contact them, via which channels, and covering which product categories, the entire consent is invalid — regardless of how well structured the confirmation flow is. Source: Kromann Reumert / Consumer Ombudsman, 3–4 June 2026.

We are part of a dealer network or automotive group — who carries the liability?

The company dispatching the marketing. In the 2026 ruling, the Consumer Ombudsman was explicit: liability cannot be outsourced to the dealer or partner who originally obtained the consent. If you send out a campaign based on consent collected by an affiliate or authorized partner, and that consent proves invalid, you will receive the fine. Always check the consent wording and documentation prior to dispatch.

Can we use a single joint consent across the entire automotive group?

Only if the wording is specific. Broad 'consent for marketing from the group and its partners' does not satisfy the requirement for informed consent. In the 2026 case, the Consumer Ombudsman emphasized that the consent covered a 'very large number of companies and multiple communication channels' — which increases the requirement for clear, precise information. The solution is either to explicitly name the companies (and optionally link to an always up-to-date list) or to collect separate consents for each company.

Consent management · GDPR-compliant

GDPR-compliant· Audit log · Marketing Act § 10

Consent management for car dealers: what's allowed, what does a mistake cost?

One SMS without consent can cost €1,340 per recipient — and cases against Danish dealers have ended at up to €200,000. Get consent management in one place: documented, auto-renewed and ready for the data authority.

Last updated: 2026-06-10

Short answer

Explicit consent is required for email/SMS marketing to new leads and prospects. Existing customers may receive emails about similar products under Section 10(2) of the Danish Marketing Practices Act (soft opt-in). Double opt-in is not a free pass: on 3 June 2026, the Consumer Ombudsman ruled that if the initial (e.g. verbal) consent does not clearly state who may contact them, via which channels, and regarding which products, it is invalid — even if the customer confirms via SMS/email afterwards. Everything must be documented — text, timestamp, channel, purpose, companies — and opt-out must work in one click. CARRUSLiNK provides consent workflows, renewals, and audit logging out of the box.

Where dealerships typically fail

Sending SMS messages to old leads without valid consent — the Consumer Ombudsman typically charges €1,340 per unsolicited SMS, and it quickly adds up
Reusing buyer's email for newsletters about the entire vehicle fleet — violates Section 10(2), which only covers genuinely similar products
Pre-ticked checkboxes on mandatory items — invalid consent under GDPR Art. 7 (must be an active, affirmative action)
Tying marketing consent to the purchase itself ("you must accept marketing to get the car") — forced consent is invalid
No documentation of when, how, and on which version of the text consent was given — the burden of proof rests 100% with the dealer
Sharing customer data with financing or insurance partners without separate consent
Ignoring expiration — consent has a practical validity of 12–24 months; stale consent will not hold up in a dispute
Sales rep takes the customer database upon resignation — consent was granted to the dealership, not to the individual
Using the "similar products" exemption too broadly (selling a Skoda Octavia → sending newsletters about Tesla and courtesy cars)
Using double opt-in as a technical fix — the Consumer Ombudsman (3 June 2026) reprimanded three car dealers because the initial verbal consent failed to inform the customer which companies, channels, and product categories the consent covered. The confirmation SMS will not save you if the basis is unclear
Letting "group/network consent" cover everything — the more companies and channels a single consent must cover, the stricter the requirements for clear wording. Generic "Volkswagen Group and partners" does not hold up
Believing liability can be outsourced to a partner or dealer in the network — the company sending the marketing carries the risk if consent fails to hold up

9 steps to consent that holds up in a case

1. Never pre-tick mandatory fields

GDPR Art. 7 and Data Protection Authority precedent are unambiguous: pre-ticked boxes constitute invalid consent. Soft opt-in (Marketing Practices Act Section 10(2)) is the sole exception — and only for email marketing of similar products to existing customers.

2. Separate marketing from the contract

The mandatory 'I accept the contract terms' must stand alone. Marketing consent must be visually and textually separate and clearly labeled 'Optional — does not affect contract conclusion'. Otherwise, it constitutes forced consent.

3. Separate checkbox per channel and per purpose

SMS, email, phone, profiling, sharing with finance partner — each requires its own toggle and distinct wording. A blanket 'I accept all' does not satisfy GDPR specificity requirements.

4. Retain full documentation

Every consent must be logged with: exact text version, timestamp, IP, channel where it was granted, and the user who captured it. The burden of proof lies with the dealer — without an audit log, you have no defense.

5. One-click opt-out + List-Unsubscribe header

All marketing emails must include a visible unsubscribe link that works without logging in. The List-Unsubscribe header (RFC 8058) ensures Gmail and Outlook display their native unsubscribe button — and is now a de facto requirement for inbox delivery.

6. Renewal workflow 30 days before expiration

Set a validity period (24 months for marketing is standard, 12 months for partner sharing). Send a renewal email 30 days prior — the customer confirms the consents they wish to retain. The rest expire automatically.

7. Limit 'similar products' to genuinely similar offerings

Did you sell a Skoda Octavia? Then servicing, insurance, and a new Octavia are 'similar'. A Tesla, a courtesy car agreement, or a newsletter covering the entire dealership is NOT. A strict interpretation protects against complaints.

8. Separate consent for sharing with partners

If you intend to share customer data with a financing or insurance partner, the full legal partner names must be specified. Generic 'we share with partners' does not hold up.

9. Audit log + sales team training

Log all consent events (granted, modified, revoked) for auditing. Train sales reps: a single illegal SMS costs more than the commission on a car — and results in publicity no dealership wants.

10. Use double opt-in correctly — or do not use it at all

The Consumer Ombudsman's case of 3 June 2026 against three car dealerships shows that double opt-in does NOT save unclear consent. The initial step (typically verbal at the sales desk or service counter) must already disclose: (1) specifically which companies/CVR numbers may contact the customer, (2) which channels (email, SMS, phone), and (3) which product categories. The confirmation email is merely an audit trail — not a second chance to provide information. If you use a dealer network or group-wide consent: name the companies.

What you gain from a professional consent flow

Out-of-the-box compliance

Separate consents per channel and purpose, documentation, opt-out, renewal, and audit log — all included in the standard package. No legal review needed for every campaign.

Signature workflows that respect the rules

Mandatory acceptance stands on its own. Marketing is visually separated under 'Optional — does not affect the agreement'. Soft opt-ins are pre-checked (legal under Section 10(2)), the others never are.

Automatic renewal

30 days before expiration, the customer receives an email detailing their consents. They confirm or revoke them. The rest expire automatically. No 5-year-old consents that will not hold up in a dispute.

Permanent unsubscribe page without login

The link works from all emails. The customer sees what they have agreed to and can revoke individually or entirely — without sales rep involvement. Built-in List-Unsubscribe header for inbox deliverability.

Sales staff transitions without consent breaches

Consent is granted to the dealership entity, not the individual sales rep. Sales reps cannot take the customer database with them — protecting you from both GDPR breaches and a lost customer base.

Audit log ready for Data Protection Agency inspection

Every view, modification, and revocation is logged with user, IP, timestamp, and text version. When a complaint arises, you can pull up proof in 30 seconds — instead of searching through emails and spreadsheets.

Explicit consent vs. soft consent (Marketing Practices Act § 10(2))

Aspekt	Udtrykkeligt samtykke	Soft opt-in (Marketing Practices Act Section 10(2))
Lovgrundlag	Marketing Practices Act Section 10(1) + GDPR Art. 6(1)(a)	Marketing Practices Act Section 10(2)
When	New leads, prospects, all SMS and telephone outreach	Existing customers who have purchased from you
Krav	Active opt-in, clearly worded, voluntary, specific	Obtained during the sale, similar products only, clear opt-out in every email
Tilladt kanal	Email, SMS, phone — depends on consent wording	Kun e-mail
Holdbarhed	12–24 months practice, then renewal	As long as the customer relationship remains active
Bilbranche-eksempel	Lead from Bilbasen → may only be contacted with explicit consent	Customer purchased an Octavia → may receive emails regarding servicing and their next Octavia
Bevisbyrde	The dealer must be able to document text, timestamp, and channel	The dealer must be able to document the sale + opt-out option in every email

Source: Marketing Practices Act Section 10, Datatilsynet, and Consumer Ombudsman practice. In case of doubt, always confirm exact interpretation with legal counsel prior to distribution.

Frequently asked questions

Book a 30-minute demonstration of the consent module

We will guide you through the entire workflow — from the signature page and renewal email to the permanent unsubscribe page and audit log. And show you how to ensure compliance without extra workload for your sales staff.