EU · Rights and requests

EU: you can tell them to stop marketing to you.

30 September 2026 · didntask.ai field notes

You do not need to write a miniature lawsuit to object to direct marketing. Say what you want to stop, identify the record they need to find, and keep a copy.

Objection and deletion are different requests

Where the GDPR applies, you can object to the use of your personal data for direct marketing, including related profiling. After an objection, the data must no longer be processed for that purpose. The European Commission explains the right to object.

Erasure is a separate right with conditions and exceptions. Some records may have to remain for legal obligations or legal claims. Asking a sales platform to stop marketing is not a guarantee that every public, commercial or statutory record about you disappears. See GDPR Articles 17 and 21.

Send it to the controller’s privacy contact

Use the company’s published privacy form or data-protection contact. Include the email address or profile URL that identifies your record. Avoid adding your home address, passport or other sensitive material unless the recipient can explain why proportionate verification is needed. A public business email can still be personal data when it identifies a person; a generic company address is a different case.

A starting point you can edit

This template combines an objection with a conditional erasure request. Check that it fits your circumstances before sending it yourself.

Subject: Objection to direct marketing and request for erasure

I object to the processing of my personal data for direct marketing, including related profiling, under Article 21 GDPR. Please stop using my data for those purposes.

The record I am referring to is:
[Email address or profile URL]

I also request erasure under Article 17 where its conditions apply. Please explain any data you must retain, the reason and the applicable retention period. If a limited suppression record is needed to respect my objection, please explain that separately.

Please confirm the action taken. If you need additional information to identify my record or verify this request, explain what is necessary.

[Your name]

Give the request a date, not an endless thread

GDPR Article 12 generally requires a response without undue delay and within one month. A necessary extension can add up to two months for complexity or number of requests; the controller must tell you within the first month and explain why. Refusal should also come with reasons and information about complaint and remedy routes. Read Article 12.

If a request is ignored or the answer seems inadequate, you can contact the relevant data-protection authority. Keep the original request, delivery evidence and response. The Commission’s individual rights page explains complaint options.