Introduction
The legal framework governing customer satisfaction surveys by e-mail has recently become the subject of renewed discussion in German data protection practice. In particular, a recent article published in Datenschutz Nachrichten (“Kundenzufriedenheitsbefragungen per E-Mail – eine rechtliche Einschätzung”) argues that customer satisfaction surveys will regularly fall outside the scope of the “existing customer exemption” under § 7(3) UWG because such surveys allegedly do not relate to “similar products or services”.
At the same time, the recent judgment of the Court of Justice of the European Union in Case C-654/23 has created considerable uncertainty regarding the relationship between the GDPR and the ePrivacy framework in the context of direct marketing communications. In particular, the judgment raises important questions concerning the scope of Art. 95 GDPR, the role of Art. 13 of the ePrivacy Directive, and the extent to which the GDPR can still serve as a legal basis for advertising-related processing operations.
This article argues that the current debate surrounding customer satisfaction surveys is framed too narrowly. The decisive issue is not whether such surveys constitute advertising — according to the case law of the German Federal Court of Justice (BGH) dated 10 July 2018 (Case No. VI ZR 225/17), they clearly do. Rather, the key question is how broadly the concept of “similar products or services” under Art. 13(2) of the ePrivacy Directive and § 7(3) UWG should be interpreted in the context of modern digital customer relationships.
Against this background, this article will:
- briefly analyse the implications of C-654/23 for the relationship between the GDPR and the ePrivacy regime,
- explain the remaining scope of the GDPR in the context of electronic direct marketing,
- and critically assess whether customer satisfaction surveys may, under certain circumstances, still fall within the scope of the existing customer exemption.
Implications of C-654/23
In Case C-654/23, the Court of Justice of the European Union addressed the relationship between the GDPR and the ePrivacy Directive in the context of direct marketing communications. While the case itself did not specifically concern customer satisfaction surveys, its implications for electronic advertising and customer communication are significant.
The case originated from a dispute concerning a Romanian online media publisher that operated a partially subscription-based legal news platform. Users could create a free account to access additional articles and, unless they opted out during registration, received a daily e-mail newsletter containing summaries of recent legislative developments together with hyperlinks to relevant articles on the platform.
The Romanian supervisory authority took the view that the publisher had unlawfully processed users’ personal data for the purpose of sending this newsletter because it allegedly lacked valid consent under the GDPR. In particular, the authority argued that the users’ data had originally been collected for the performance of the subscription contract, but were subsequently used for an incompatible purpose, namely the distribution of the newsletter.
The referring court therefore had to assess whether such communications could be justified on the basis of a “legitimate interest” under Art. 6(1)(f) GDPR and how this interacts with the specific rules governing electronic communications under Art. 13 of the ePrivacy Directive and corresponding national anti-spam provisions such as § 7 UWG.
The Court confirmed that direct marketing may in principle constitute a legitimate interest within the meaning of Art. 6(1)(f) GDPR. At the same time, however, it emphasised that the GDPR does not replace or supersede the specific requirements of the ePrivacy regime. In particular, where electronic communications such as e-mails are concerned, the permissibility of the communication itself must primarily be assessed under Art. 13 of the ePrivacy Directive and national implementations such as § 7 UWG.
Such a reading, however, risks oversimplifying the Court’s reasoning.
The decisive point of the judgment is not that the GDPR suddenly legitimises broader e-mail marketing practices. Rather, the judgment reinforces the systematic relationship between the GDPR and the ePrivacy framework. In particular, the Court highlights that the GDPR does not displace sector-specific rules governing electronic communications.
This follows directly from Art. 95 GDPR, which provides that the GDPR shall not impose additional obligations where the ePrivacy Directive already contains specific rules pursuing the same objective.
The practical consequence is crucial:
Where electronic direct marketing falls within the material scope of Art. 13 of the ePrivacy Directive — for example in the context of e-mail advertising — the permissibility of the communication is governed primarily by the ePrivacy framework and corresponding national implementations such as § 7 UWG.
The GDPR does not disappear entirely. It continues to apply to related processing operations, including:
- transparency obligations,
- data security,
- storage limitation,
- documentation requirements,
- and the exercise of data subject rights.
However, the GDPR no longer primarily determines whether the marketing communication itself is permissible. That assessment is governed primarily by the ePrivacy regime and corresponding national anti-spam provisions. And this distinction is frequently overlooked in current discussions surrounding C-654/23.
The judgment therefore does not create a general “legitimate interest” gateway for electronic advertising communications. In particular, it does not remove the need to comply with:
- Art. 13 ePrivacy Directive,
- national anti-spam rules,
- or consent requirements under § 7 UWG and § 25 TDDDG.
What the judgment does clarify is that discussions concerning the legality of customer-related e-mail communications must first be analysed through the lens of ePrivacy law before turning to the GDPR.
The Court’s reasoning in paras. 44 and 45 of the judgment further supports a broad and functional interpretation of the concept of direct advertising under Art. 13 ePrivacy Directive.
The CJEU explicitly clarified that the mere fact that a communication contains informational or editorial content does not remove it from the scope of electronic direct marketing rules. Rather, the decisive criterion is whether the communication ultimately pursues a commercial objective.
In the Court’s view, the newsletter at issue qualified as direct marketing because it was designed to encourage users to consume additional content on the platform and ultimately promote paid subscriptions. The Court therefore adopted a functional and economically oriented interpretation of the concept of advertising.
This reasoning is fully consistent with the established case law of the German Federal Court of Justice (BGH), which likewise interprets the notion of advertising broadly and functionally. According to the BGH, communications intended to maintain customer relationships, improve customer retention, or indirectly promote future business transactions may already constitute advertising, even where the communication contains informational or service-related elements.
Importantly, however, the qualification of a communication as “advertising” does not predetermine whether the communication may nevertheless benefit from the existing customer exemption under Art. 13(2) ePrivacy Directive and § 7(3) UWG. These are distinct legal questions that must not be conflated.
This distinction is particularly relevant in the context of customer satisfaction surveys.
The decisive legal question is therefore no longer whether customer satisfaction surveys qualify as advertising — they generally do — but whether such communications may fall within the scope of the existing customer exemption under Art. 13(2) ePrivacy Directive and § 7(3) UWG.
Customer Satisfaction Surveys and the Existing Customer Exemption
Against this background, the discussion surrounding customer satisfaction surveys must be approached with greater nuance than is often reflected in current commentary.
While customer satisfaction surveys sent via e-mail generally qualify as direct advertising, this does not automatically mean that such communications necessarily fall outside the scope of the existing customer exemption under Art. 13(2) ePrivacy Directive and § 7(3) UWG.
Some commentators argue that customer satisfaction surveys can rarely concern “similar products or services” because the survey itself is not a product or service comparable to the originally purchased good or service. This interpretation appears overly formalistic and insufficiently attentive to the realities of modern digital customer relationships.
The restrictive interpretation is also reflected in the 3rd Activity Report of the Thuringian State Commissioner for Data Protection and Freedom of Information (TLfDI), in section 4.6. There, the authority takes the position that customer satisfaction surveys sent by e-mail after an online purchase generally fall outside the scope of § 7(3) UWG because such surveys allegedly do not concern “similar products or services”. According to the authority, the survey merely serves the improvement of the online shop and is therefore not sufficiently related to the original transaction.
This reasoning appears overly formalistic because it isolates the survey from the broader economic and functional context of the existing customer relationship.
First, the argument relies on a very narrow understanding of the concept of “similar products or services”. It artificially separates the original service from processes aimed at evaluating and improving that very service. In modern digital business models, however, feedback and evaluation mechanisms are often functionally inseparable from the customer relationship itself.
Second, the reasoning overlooks the broader purpose of Art. 13(2) ePrivacy Directive and § 7(3) UWG.
This interpretation is also difficult to reconcile with Recital 41 of the ePrivacy Directive, which explicitly frames the existing customer exemption within the broader context of an “existing customer relationship”. The recital does not suggest an excessively narrow or purely product-based understanding of “similar products or services”. Rather, it reflects the idea that certain follow-up communications within an ongoing customer relationship may reasonably be expected by the customer, provided that appropriate opt-out mechanisms are available.
This broader relational approach becomes particularly relevant in digital business models where customer interaction, feedback mechanisms, and service optimisation are integral parts of the overall service experience.
The existing customer exemption is not limited to pure product advertising in a narrow sense. Rather, it seeks to facilitate reasonable follow-up communication within an ongoing customer relationship without requiring consent for every single interaction.
A customer satisfaction survey following an online purchase may therefore very well maintain a sufficiently close factual and functional connection to the previously used service — particularly where the survey directly relates to:
- the purchasing process,
- the delivery experience,
- customer support,
- usability of digital services,
- or the quality of the purchased content itself.
The decisive question should therefore not be whether the survey itself constitutes a “similar service”, but whether the communication still forms part of the same commercial and functional customer relationship.
This does not mean that all customer surveys automatically fall within § 7(3) UWG. Surveys detached from the original transaction, combined with broader promotional activities, behavioural profiling, or unrelated marketing objectives will regularly require prior consent.
However, the blanket conclusion that customer satisfaction surveys can never benefit from the existing customer exemption risks ignoring the economic and technical realities of modern digital services and customer lifecycle management.
Conclusion
The discussion surrounding customer satisfaction surveys demonstrates that the legal assessment of electronic customer communication cannot be reduced to simplistic formulas.
Case C-654/23 does not establish a general “legitimate interest” basis for unsolicited e-mail marketing under the GDPR. Rather, the judgment reinforces the systematic priority of the ePrivacy framework in the field of electronic communications and highlights the importance of Art. 95 GDPR as a lex specialis mechanism.
As a consequence, the legality of customer satisfaction surveys sent by e-mail must primarily be assessed under Art. 13 ePrivacy Directive and corresponding national provisions such as § 7(3) UWG. The GDPR continues to apply only in a supplementary manner with regard to the subsequent processing of personal data.
At the same time, the current debate risks interpreting the scope of the existing customer exemption too narrowly. The decisive issue is not whether a customer satisfaction survey constitutes advertising — it clearly does — but whether the communication maintains a sufficiently close factual and functional connection to the existing customer relationship and the previously used products or services.
In modern digital business models, customer feedback mechanisms frequently form an integral part of service optimisation, quality assurance, and customer relationship management. A blanket exclusion of customer satisfaction surveys from the scope of § 7(3) UWG therefore appears difficult to justify.
Ultimately, the assessment must remain context-specific. The closer the survey is linked to the original transaction and the concrete customer experience, the stronger the arguments for applying the existing customer exemption. Conversely, where surveys primarily serve broader promotional purposes or become detached from the original customer relationship, prior consent will generally remain necessary.
The real challenge after C-654/23 is therefore not whether customer surveys are “advertising”, but where exactly the boundaries of permissible customer relationship communication should be drawn in an increasingly digital and data-driven economy.
