What is a typical GDPR fine scenario for email misuse?

Here's how a GDPR fine for email misuse usually unfolds. A company has been sending marketing emails to people who never gave valid consent. Someone unsubscribes, the emails keep coming. Eventually, a frustrated subscriber files a complaint with their national data protection authority.

The authority opens an investigation. They request consent records. What they find (or don't find) determines the outcome. No records at all. Records that show pre-checked boxes. Evidence that opt-out requests were ignored. Any of these can trigger a fine, and fines under GDPR scale with company size and the severity of the violation.

Real enforcement cases follow similar patterns: sending millions of marketing emails without valid consent, continuing to contact individuals after they've exercised their data subject rights, or relying on consent that was bundled into terms of service instead of being freely given. Regulators across Europe have issued fines ranging from a few thousand euros for small businesses to hundreds of millions for large platforms.

The paperwork matters as much as the practice. You need records showing who consented, when, and how. If you can't produce that documentation, you can't defend yourself. Double opt-in is the cleanest evidence you have. A timestamp and a confirmed subscription are hard to argue with.

If you're worried about your current consent records or want to audit your list practices before a complaint lands, our SOS hotline is free and we've helped plenty of senders sort out exactly this kind of situation.