Can a company continue sending marketing after I object?

No. Under Article 21(3) GDPR, once you object to direct marketing, the organisation must stop processing your data for that purpose immediately. This right is absolute — there are no grounds to refuse it.

Is a GDPR objection different from unsubscribing from emails?

Yes. Unsubscribing typically only removes you from one specific channel, such as a mailing list. A GDPR Article 21 objection covers all forms of direct marketing — email, post, phone calls, SMS, and any profiling used to build marketing segments.

Does this stop marketing from third parties the company has shared my data with?

Your objection covers only the organisation you send it to. If they have shared your data with third parties for marketing purposes, you should send separate objections to those parties as well.

What if the company keeps sending marketing after I have objected?

Continuing to send marketing after receiving an Article 21 objection is a breach of GDPR. You can lodge a complaint with your national data protection authority, such as the ICO (UK), the DPC (Ireland), or the CNIL (France), who can investigate and impose fines.

Article 21 Right to Object to Direct Marketing Template

Dear Data Protection Officer,

I am writing to exercise my right to object to the processing of my personal data for direct marketing purposes under Article 21(2) of the General Data Protection Regulation (GDPR).

I object to all processing of my personal data for direct marketing purposes, including any profiling carried out for such purposes.

Please:

Cease all direct marketing communications to me with immediate effect.
Ensure my personal data is no longer processed for direct marketing purposes.
Confirm in writing that you have complied with this request.

Under Article 21(3) GDPR, you must cease processing immediately upon receipt of this objection. There are no grounds to refuse this request.

Below is my information for your reference:

Name:
Email:
Address:

Thank you for your prompt attention to this matter.

Sincerely,

Text copied to clipboard

1. Copy and send this letter to the data controller of the organisation.

2. Follow up until you hear back. The GDPR requires a response within one month.

3. No response? Lodge a complaint with your local data protection authority.

No response after one month? File a complaint with your DPA →

Select your country to find your data protection authority: