Search MailerLite
Start typing to search

No results

Gintarė · 9 min read · Tips and resources · September 6, 2021

The Omnibus Directive: Is this the new GDPR for customer rights protection?

Breaking news: there’s a new law on the horizon of consumer rights protection—and we’re here to tell you all about it!

If you’re selling goods and services online (such as with MailerLite and Stripe), then this law could mean something for you. The Omnibus Directive is meant to protect consumer rights—whether they buy products in-person or online.

It came into force in the European Union (EU) on 7 January 2020, and all member states (aka, EU countries and states) are expected to fully comply with it by 28 May, 2022.

The clock is ticking, but have no fear! We’re going to walk you through the new rules to help your business stay compliant. Let’s start with the basics!

“Omnibus” is the Enforcement and Modernisation Directive (EU) 2019/2161. Here’s what that means:

The Omnibus Directive ensures the protection of consumers’ rights and is applicable whether the customers purchase and use physical goods/services or they buy it online.

When did it come into force?

It was adopted by the EU on 27 November 2019, and it came into force on 7 January 2020. By 28th of November 2021, businesses based in the EU must adopt and publish the measures necessary to comply with this new law. They are then expected to fully apply those measures from 28th of May, 2022. So, this is the right time to get acquainted with how these changes may impact email marketing and the online marketplace. 

Why was it adopted?

With the continuous development of digital tools and services around the world, the EU consumer protection law needed some tweaks. These changes will particularly impact the online marketplace, email marketing and services.

The Omnibus Directive amends 4 key elements related to ensuring and modernizing EU consumer protection: 

  • Council Directive 93/13/EEC (unfair contract terms) and 

  • Directives 98/6/EC (price indications) 

  • 2005/29/EC (unfair commercial practices)

  • 2011/83/EU (consumer rights)

What are its aims?

The aim of the Directive is to:

  • Harmonize the application of contract rules in the EU 

  • Improve consumer protection measures

  • Apply more consistent sanctions for infringements of consumer rights 

  • Increase transparency in the online marketplace 

In other words, this legislation implements modernized rules that keep up with the world’s fast-paced digital development. 🚀

This Directive is specifically meant to protect consumer rights. This means that if you’re selling physical or digital goods and services and completing online transactions, then the new rules do indeed apply to you

Even if you’re based in the US or the UK, for example, you’ll still be expected to comply with the Omnibus Directive if you’re selling to EU consumers, as it’s designed to protect their rights, regardless of the business’s location. 

This Directive will change 5 main things in the physical and online business world. Let's break these down, and explore practical ways that you can adapt to the changes.

1. Exchanging personal data for goods and services

Sometimes, digital content and services will be offered in exchange for the consumer’s personal data. For example, instead of paying for an ebook, you might download it for free by submitting your email address. Or to download an app, you might have to share your personal data.

The Omnibus Directive classifies these transactions as “payments”, because you are exchanging your personal data to access a good or service. This means that traders will have to clearly inform people about this in their terms and conditions.

2. Posting online reviews

A lot of customers pay attention not only to the description of the product or services but also to its reviews. The more customers use or enjoy a product or service, the more likely others are to follow. Unfortunately, on websites or review platforms, posted reviews are not always authentic. 

Four star review with mouse hovering over the star icons

The Directive forbids submitting fake responses, assessments, recommendations, or “likes” on social media. It also forbids justifying consumer reviews and endorsements, such as only publishing positive reviews and repealing the negative ones. 

Traders are responsible for ensuring that the feedback comes from actual customers. Business owners will have limited ability to post a review, so only verified, real customers can do it. 

Since positive reviews remain a key for traders to sell their products or services, the best way to get them is to make sure that you are offering excellent products and/ or services. If you continue to tamper with customer reviews, then you may have to pay a fine. 

3. The identity of the seller

Consumers must also be informed about whether the person selling the goods or services online is a trader (someone who owns a business) or a non-trader (a regular person selling things, without their own business).

If a customer purchases something online from a non-trader, it is also necessary to specify that they won’t be able to receive the appropriate consumer protection guarantees. 

4. Creating price reductions and sales

“-40% off today only!” Have you seen this kind of advertisement recently?

40% off summer surprise sale pop-up

From now on, the Directive will regulate the rules for changing prices. 

The previous price must be the lowest price charged by the trader during a period of at least 30 days before a sale. This means that for every price reduction, traders must maintain the primary price for at least 30 days beforehand. For example, if you have a big clothes sale coming up, you'll have to keep the original pricing the same for 30 days before launching the sale.

Similarly, traders must inform consumers if the displayed price is chosen on the basis of an automated decision. For example, this could be through a personalized profile of them as buyers, such as having a discount coupon for their birthday. People often check prices multiple times from the same IP address, and they see the prices start to rise and feel the pressure to buy instantly. 

5. Automating the online purchasing process

Business owners will also be forbidden to operate a software that automates the process of online buying.

For example, they can’t use bots to buy tickets to cultural or sports events and then resell them at a much higher price. This would be breaching the rules set by the event organizer, the prime ticket seller.

Email marketers will need to take care not to breach this legislation, whilst also maintaining compliance with the GDPR. To justify the authenticity of feedback and reviews, it will be necessary to: 

  • Collect and store the personal data of actual customers

  • Update customers’ consent forms for personal data processing (if necessary) 

  • Supplement the information provided in email marketing campaigns and (or) online marketplaces 

  • Review/ update other internal documents such as Privacy Policy or Terms of Use

National authorities will have the power to designate effective and proportionate penalties when they work jointly on major cross-border infringements that affect EU consumers. 

In these cases, national authorities will have the right to impose fines which can be up to 4% of the trader’s annual turnover in the EU country or state where the infringement took place. If the information on their turnover is unavailable, then they can fine the trader EUR 2 million.

Some extra things to keep in mind...
  • In certain cases, a trader can also be a group of companies.

  • The Directive also ensures that all EU consumers have the right to individual remedies. This means that buyers should have access to compensation for damage and, where relevant, a price reduction or termination of the contract, in a proportionate and effective manner.

We highly recommend that you prepare for these changes in advance. The requirements of the Omnibus Directive are strict, so you’ll need to think outside the box and plan the appropriate changes on your email marketing campaigns and/or e-commerce websites.

Please note that these are our insights. Please do not consider this as legal advice. We strongly recommend consulting a lawyer to discuss the individual needs of your business.


Hello, I am Gintarė, Legal Counsel at The Remote Company. My name means “amber”, which is fitting because working as an in-house lawyer is a bit like looking for amber on the beach. You need to be attentive, passionate and know what and where to search. I enjoy doing all of these activities!