Email marketing: Belgium's data protection authority fines a complex opt-out

On 17 July 2026, Belgium's Data Protection Authority (APD) approved a settlement with a Belgian entertainment company: a €5,000 fine, and more importantly, three corrective measures required within 30 days to 4 months. The case started from a simple complaint, unsolicited prospecting emails after a ticket purchase, but the failures identified show up in many Belgian SME campaigns. Here's what to check.

1. A simple complaint, three failures identified

It all started with someone who received several commercial prospecting emails after buying a ticket from the company involved. The APD found three failures. First, a lack of transparency: the website stated that ticket sales were exclusively online, when purchases were also possible on site, an incorrect statement about the data collection channel. Second, an insufficient right to object: the opt-out mechanism for prospecting wasn't simple or effective enough, in breach of Article XII.13 of the Belgian Code of Economic Law. Third, excessive retention: historical purchase data was used for commercial profiling without an adapted retention limit, particularly for customers who had become inactive.

2. What the settlement actually requires

Beyond the €5,000 fine, the company must prove, within 30 days, that its opt-out mechanism for prospecting has been fixed. It also committed to reducing its data retention period for inactive customers from five to three years, and to deleting or anonymising excess data within four months. The APD chose the amicable settlement route: a limited financial penalty, but binding and fast corrective measures, a signal that the authority is primarily seeking effective compliance.

3. What Belgian SMEs should check in their own campaigns

Three concrete checks come out of this decision. The description of the customer journey, where and how data is collected, must be scrupulously accurate, not just present in a generic privacy policy. The unsubscribe link must work in one click, with no account to create or form to fill in: the APD penalises friction as much as the outright absence of a mechanism. Finally, data retention periods should be differentiated between active and inactive customers, with a reasonable limit, the APD having validated three years for inactive customers in this case.

The AI angle, humans first

AI can audit dozens of email sequences and unsubscribe forms in minutes to spot friction or inconsistencies between what's stated and what's actually in place. But judging whether a statement meets the GDPR's transparency principle, or negotiating a settlement with the APD, remains human work. AI executes. Expertise decides, and watches.