All articles

Newsletters and advertising emails under Georgian law: consent and unsubscribing

Published · 12 min read

Listen to the article · read by an AI voice

A newsletter, a discount offer or a reminder with a promotion looks like routine business mail. Under Georgian law, such messages are treated as direct marketing, and the rules for them are strict. The Law of Georgia on Personal Data Protection allows a business to use personal data for this purpose only with the consent of the recipient. The recipient may withdraw that consent at any time, and the business must then stop within a short deadline.

This concerns every business that writes to customers or prospects with offers: a shop with a customer list, a restaurant with a mailing for regular guests, a service provider with a monthly newsletter. This article explains what the rules say, what you must be able to prove, which further rules apply to advertising emails and what a violation can cost. A checklist and a description of how we run our own newsletter follow.

What the rules cover

The current Law of Georgia on Personal Data Protection entered into force on 1 March 2024, including Articles 1–5 and 7–30. It replaced the earlier law of 28 December 2011 (Article 89). Direct marketing is regulated in Article 12. In the old law the same subject was in Article 8, which is why older texts and guides may still refer to that number.

The Law of Georgia on Electronic Commerce adds a second layer. It defines “commercial communication” (Article 2(b)) as offering goods or services through electronic means, or as notifications that directly or indirectly promote goods, services or natural or legal persons. A newsletter or an advertising email can fall under this definition. For undesirable commercial communication, Article 5(2) of that law refers to the personal data law. It still names Article 8, the article of the earlier version, while direct marketing now sits in Article 12 of the current law.

In short: when you send an advertising email, two sets of rules apply at once. The personal data law governs the use of the address and the consent. The electronic commerce law and the Law of Georgia on Advertising govern how the message itself looks.

Article 12(1) is short and clear. Irrespective of the ground for collecting or obtaining the data and of their accessibility, data may be processed for direct marketing only with the consent of the data subject.

The sentence about “accessibility” matters in practice. An email address that is publicly available, for example on another company’s website, is not free to use for advertising. As an example: you find the address of a possible customer in a public directory. You may not add it to your newsletter list just because anyone can read it. You need that person’s consent. The same applies to addresses from business cards, from an old customer file or from a purchased list. Where the address came from does not change the rule.

Article 12(2) sets a stricter condition for more data. Name, surname, address, telephone number and email address may be used for direct marketing with consent. Any other data may be processed only with the written consent of the data subject. As an illustration, not as wording of the law: a date of birth or a purchase history would be such other data. If you want to send offers tailored to what a customer bought, you need to ask for that more carefully than for a plain newsletter subscription.

Informing recipients and the right to refuse

The law does not only ask for consent at the start. Article 12(3) requires that, before obtaining consent and while carrying out direct marketing, you inform the person in clear, simple and understandable language of two things: the right to withdraw consent at any time and the way to do so. This is why a short note belongs next to the sign-up form, and why every single email should show how to unsubscribe.

For the withdrawal itself, the law sets a deadline: after receiving an appropriate request, you must stop processing the data for direct marketing within a reasonable period, but no later than 7 working days (Article 12(4)). The seven days are an upper limit. A reasonable period can be shorter, so stopping at once is the safer practice.

The person must be able to request the end of the marketing in the same form in which it is carried out, or you must determine other available and adequate means (Article 12(5)). For an email newsletter, an unsubscribe link or a reply to the email fits this. The means must be simple, and the person must receive a clear and easily understandable instruction on how to use them (Article 12(6)). No fee or other restriction may be imposed for withdrawing consent (Article 12(7)).

An example from daily business: a bakery sends a weekly offer. A customer replies to one email with “please stop”. The bakery should treat this reply as a request to stop and remove the address from the list at once, rather than use the full seven working days.

Proof: who has to prove what

Article 12(8) puts the burden of proof on the business. In direct marketing, the controller or processor must be able to prove:

  • that the consent exists,
  • that the means of objection are simple,
  • that the instructions on using them are easy to understand, accessible and adequate.

If a recipient claims never to have agreed, “it was on our list” is not an answer. You need a record.

Article 12(9) says what the record must contain. You must record and keep the date and the fact of the consent and of its withdrawal. You keep it for the duration of the direct marketing and for 1 year after it has been discontinued.

A simple way to meet this is a newsletter system that stores the time of sign-up and the time of withdrawal for each address. The law does not prescribe a confirmation link. A confirmation step is, however, a practical way to have the proof the article asks for: the system then shows when the address owner confirmed the subscription. We describe below how we do this ourselves.

Further rules for advertising emails

Besides consent and withdrawal, other laws set requirements for the message itself:

  • Recognisable as advertising. Under Article 5(1) of the Law of Georgia on Electronic Commerce, commercial communication must be clearly identifiable. The Law of Georgia on Advertising (Article 4(1)) says the same from another angle: an advertisement must be immediately perceived as an advertisement, without special knowledge or technical means. A subject line and a layout that make the promotional character obvious are the simple way to follow this.
  • Sender identifiable. The natural or legal person in whose name the message is sent must be explicitly identifiable (Article 5(1)). Put the name of your business in the sender line and in the footer.
  • Conditions of offers. Discounts, special offers, gifts and the conditions that determine the benefits must be easily available and understandable. Promotional games or competitions must be clearly identifiable, and the conditions for participation must be easily available and understandable. If your email announces “20 % off”, the conditions (period, products, limits) should be one click away.
  • Language. Under the Law of Georgia on Advertising, advertisements are disseminated in the official language throughout the territory of Georgia. If your mailing targets customers in Georgia, we suggest you check with a lawyer how this applies to your messages and offer a Georgian version where in doubt.

A recipient who thinks the provider does not meet its duties under Article 5(1) of the Law of Georgia on Electronic Commerce may turn to the Georgian Competition and Consumer Agency. More on the information duties of websites and online services is in our article Legal notice and information duties for websites in Georgia.

Supervision and what a violation costs

Since 2 March 2026 the State Audit Office is the supervisory authority for data protection in Georgia (Law No. 1289 of 17 December 2025). The current text of the personal data law names the State Audit Office of Georgia.

Article 71 of the law is devoted to processing data for direct marketing in violation of the rules. Article 71(1) provides a warning or a fine of GEL 2,000 for natural persons, public institutions and non-commercial legal entities, as well as for legal persons, branches of foreign enterprises and individual entrepreneurs with an annual turnover of up to GEL 500,000. For legal persons (except non-commercial ones), branches of foreign enterprises and individual entrepreneurs with an annual turnover above GEL 500,000, the result is a warning or a fine of GEL 3,000.

Article 71(2) provides higher amounts when the same violation is committed with aggravating circumstances: a fine of GEL 4,000 for the first group and GEL 6,000 for the group with an annual turnover above GEL 500,000.

Article 62 names the aggravating circumstances:

  • the same offence repeated within 1 year after a penalty was imposed,
  • processing large quantities of data subjects’ data in violation of the law, or a risk thereof,
  • processing minors’ data in violation of the law,
  • committing the offence for financial or other gain,
  • committing it on grounds of discrimination.

The amounts above come from the English text of the law as adopted on Matsne. Laws are amended from time to time, so please check the current text on Matsne before you rely on a number.

Where the newsletter tool runs

A newsletter needs a system that stores addresses and sends the emails. This is easy to overlook: email and newsletter services are among the services through which data leave Georgia unnoticed. If you use an external provider, the addresses of your recipients are transferred to the country where the provider runs its servers.

A transfer to a state on the list of the State Audit Office needs no permit. The list contains 49 states, among them all EU member states. The United States are not on the list. So before you choose a newsletter tool, find out where it stores the data and where the emails are sent from. Our article Data transfers from Georgia explains the rules and the list.

For the sender domain, we explain the records SPF, DKIM and DMARC in SPF, DKIM and DMARC explained.

Checklist for small businesses

  • Send advertising emails only to people who have consented, including addresses that are publicly available.
  • Ask for written consent if you want to use more than name, address, telephone number and email address.
  • Next to the sign-up form, state in clear words that consent can be withdrawn at any time and how.
  • Put an unsubscribe link and a short instruction in every email. Make sure a reply to the email also works.
  • Do not charge anything for unsubscribing and do not add hurdles such as a login.
  • Remove an address at once after a withdrawal, and in any case within seven working days.
  • Record the date and fact of every consent and every withdrawal. Keep the record while you send and for one year after the subscription ends.
  • Make the email recognisable as advertising, name the sender and make the conditions of offers easy to find.
  • Check in which country your newsletter tool stores data and sends from, and compare it with the list of the State Audit Office.

How we handle our own newsletter

Our own newsletter is direct marketing within the meaning of Article 12. Its legal basis is consent (Article 5(1)(a) and Article 12(1)). We process the email address, the language of the page and the times of sign-up and confirmation.

After sign-up we send an email with a confirmation link. The newsletter arrives only after the link was clicked. Sign-ups that are not confirmed are deleted after 30 days. Withdrawal is possible at any time, free of charge and without giving reasons, via the unsubscribe link in every email or by a short email. We stop using the address immediately, at the latest within seven working days (Article 12(4)).

Our privacy policy states openly that we record opens and clicks of the newsletter, that this measurement is part of the consent, and that whoever wants no measurement can unsubscribe at any time. As Article 12(9) requires, we keep a record of the date and fact of consent and of its withdrawal for one year after the subscription ends, then delete the data entirely.

The newsletter system runs on our own server in Helsinki, Finland. The emails are sent by our own mail server on servers in Finland and Germany. Both states are on the list, so no permit for a transfer is needed. Details are in our privacy policy. Business email from epicsoft also runs on our own mail servers in Finland and Germany, with SPF, DKIM and DMARC set up for the customer’s domain; see Email. We do not sell a newsletter service. This description shows only how we run our own newsletter and does not promise that following the checklist makes any business compliant.

This article informs in general, as of November 2026, and is no legal advice. For your own mailings, please consult a lawyer in Georgia.

Sources

More articles

Ready for the next step?

There has never been a better time to start. Tell us about your project.

Get in touch