GPDR Soft opt-in requirements for pre-GDPR customers
<p>The UK ICO <a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/" rel="nofollow noreferrer">documentation on GDPR</a> definition of legitimate interest says that emails/text messages to existing customers – obtained using ‘soft opt-in’ are allowed.</p>

<p>From ICO <a href="https://ico.org.uk/media/for-organisations/documents/1555/direct-marketing-guidance.pdf" rel="nofollow noreferrer">Direct Marketing Guidance</a>: </p>

<blockquote>
  <p>The term ‘soft opt-in’ is sometimes used to describe the rule about
  existing customers. The idea is that if an individual bought something
  from you recently, gave you their details, and did not opt out of
  marketing messages, they are probably happy to receive marketing from
  you about similar products or services even if they haven’t
  specifically consented. However, you must have given them a clear
  chance to opt out – both when you first collected their details, and
  in every message you send.</p>
</blockquote>

<p>For 'hard opt-in' GPDR specifies strict requirements for opt-in, e.g. no pre-ticked checkboxes.</p>

<p>For soft opt-in on the other hand, the requirements seem looser and I cannot find any exact specification for what is needed. "Did not opt out" (and indeed the very concept of soft opt-in) implies that an explicit opt-in was not needed. In the case of my own customers each email sent contains an unsubscribe link, and while the original signup did not contain an opt out it clearly stated that opting out was possible by clicking unsubscribe on any email sent.</p>

<p>Rather than sending an email at the present time (pre GDPR start date) that requires explicit opt-in, is it acceptable instead to send an email reiterating that opt-out is possible at this stage?</p>

<p>It appears you are indeed just over the edge. The troublesome bit is "you must have given them a clear chance to opt out ... when you first collected their details" versus "the original signup did not contain an opt out ". If you correctly describe that first collection of their details, you failed to include an opt-out in just that one message, and it's technically therefore invalid.</p>

<p>And you're similarly just over the edge with the idea of that new email; since you are formally lacking consent you should now obtain opt-in consent. Offering a chance to opt out is insufficient.</p>

gdpr