Emails and offers to past guests: when you can send them without consent and how to do it right (2026)

Updated: 10 November 2026

You have a list of past guests' emails and want to send them an offer or a newsletter. Can you? It depends on how you got the email and what you send. We read the EU ePrivacy Directive, the GDPR, Spain's LSSI and a report by the Spanish data protection authority (AEPD), the Italian Garante's guidelines, Greek law 3471/2006 with its data protection authority's leaflet, and the Booking.com and Airbnb terms (links at the end). Where we could not confirm something we say so. This is not legal advice: check with your adviser or data protection officer.

The general rule: consent first

Directive 2002/58/EC, art. 13(1), and in Spain LSSI, art. 21.1:

Sending advertising by email requires that the person asked for it or expressly agreed beforehand.
Buying an email list, or writing to someone who only asked for information, does not give you that permission.
This covers newsletters, seasonal offers and return-guest discounts.

The exception: your own customers

Directive 2002/58/EC, art. 13(2). You may write without prior consent if all these conditions are met:

The customer gave you the email in a sale: a booking and a stay with you.
You offer your own products or services similar to those bought: another stay, a short break, the hotel restaurant. Third-party businesses do not count.
When you collected the email, you gave a clear, simple, free way to refuse.
Every email includes a simple, free way to unsubscribe.
Art. 13(4): you may not hide who is sending, and you must give a valid address to ask you to stop.

What the GDPR adds

Regulation (EU) 2016/679:

When collecting the email, say who you are, what you will use it for and on what legal basis (art. 13(1)).
If you rely on consent, it must be freely given, specific, informed and unambiguous (art. 4(11)). Pre-ticked boxes do not count (recital 32).
You must be able to prove it was given (art. 7(1)), and withdrawing it must be as easy as giving it (art. 7(3)).
The customer may object to marketing at any time; from then on you may not use their data for it (art. 21(2) and (3)).

Spain: the LSSI and the AEPD's view

Law 34/2002 (LSSI), consolidated BOE text:

Art. 21.2: no consent is needed if there is a prior contractual relationship, you obtained the data lawfully and you offer your own products or services similar to those contracted.
Opting out must be simple and free, when collecting the data and in every message; by email, with a valid electronic address. Without it, the message is prohibited.
Art. 20.1: the email must be identifiable as commercial and it must be clear who sends it.
The AEPD (report 2018-0164) says the exception only covers the same business that obtained the email, and that the GDPR's «legitimate interest» does not replace the LSSI rule.

Spain: fines

LSSI, arts. 38 and 39:

Serious offence (art. 38.3.c): mass sending, or insistent or systematic sending to the same person, without meeting art. 21. Fine of EUR 30,001 to 150,000.
Minor offence (art. 38.4.d): other sending that does not meet art. 21. Fine of up to EUR 30,000.
The law sets no number of emails above which sending becomes «insistent».

Portugal

Portugal's electronic communications privacy law is Law 41/2004; according to law firm summaries, its art. 13-A contains the same customer exception, and the data protection authority (CNPD) issued direct marketing guidelines in 2022. We could not read the official current text or the guidelines, so we do not confirm the wording. Meet at least what the Directive requires and ask your adviser.

Italy: «soft spam»

Art. 130(4) of the Italian Privacy Code, as explained by the Garante in its guidelines of 4 July 2013 (section 2.7):

It only applies to email, not to SMS or automated calls.
The email must come from the sale of a product or service, and you may only offer your own similar services.
The customer must be properly informed and must not have objected.
Everything else needs consent: it may not be pre-ticked and, while it need not be in writing, you must be able to prove it (date and who gave it).

Greece: law 3471/2006, art. 11

Text of the law (copy on Lawspot, a private site) and the Hellenic Data Protection Authority's spam leaflet:

Art. 11(1): marketing email needs prior express consent.
Art. 11(3): exception for emails lawfully obtained in a sale or other transaction, for similar products or services, with a clear, easy and free way to object at collection and in every message.
Art. 11(4): identified sender and a valid address to unsubscribe.
The authority adds that a pre-ticked box is not consent and that the message must say it is commercial.

Direct guests versus Booking.com and Airbnb guests

The exception covers people who booked with you. With platform guests, their contracts also apply:

Booking.com (General Delivery Terms, clause 2.9.3): you may not use its messaging service or the guest's contact details to send unsolicited electronic communications. Guest data only as necessary, unless there is another legal basis such as consent.
Airbnb (Terms for European Users, 11.1): another member's data may only be used to facilitate the booking, and commercial messages need their express consent.
No official source we read says a platform email counts as obtained by the hotel in its own sale: do not apply the exception to those emails.
The prudent route: send offers only to people who gave you their email directly and agreed to receive them. What platforms allow and forbid, in detail, in our guide on Booking and Airbnb guests: /huespedes-booking-airbnb-reservar-directo-normas-2026.

Good practice for your newsletter

An unticked sign-up box, separate from the booking and from accepting terms.
Keep a record of each sign-up: date, how it was given, what text the guest saw.
A clear sender: the hotel's name and a real contact address.
An unsubscribe link in every email that works in one click, with no password.
Process unsubscribes promptly and never write again to someone who left.
Reasonable frequency and useful content: a few good offers beat many.

How iQuota helps

We publish your property in AI assistants with direct booking, payment at the property and no commission, so returning guests find you without you having to email them.

Want an official booking page AI can read and a connector with your real prices and availability, commission-free? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

Can I send offers to a guest who booked direct with me without asking?

Yes, if you offered an opt-out when collecting the email, you offer your own similar services and every message allows a simple, free unsubscribe (Directive 2002/58/EC, art. 13(2); LSSI, art. 21.2).

And a guest who came through Booking.com or Airbnb?

Not with the platform's data: Booking.com forbids using it for unsolicited communications and Airbnb requires express consent for commercial messages.

What is the fine in Spain for emails that break the LSSI?

Up to EUR 30,000 if minor; EUR 30,001 to 150,000 if serious, for example mass or insistent sending without meeting art. 21.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά