Right to object to direct marketing — absolute (GDPR Art. 21(2))

GDPR Art. 21(2-3) establishes the strongest citizen right in the entire GDPR: objection to direct marketing is absolute. No balancing test, no substantiation duty, no negotiation — the business must stop, period. What falls under "direct marketing"? All forms of direct commercial communication: email marketing, postal mail, telephone sales, SMS marketing, push notifications, personalised ads (retargeting), customer loyalty programmes with marketing purpose, sponsored content targeted at the individual, in-app marketing messages. Also profiling for marketing purposes falls under this right. What must the business do? (1) Immediately stop all direct marketing against you. (2) Remove you from all marketing databases, segmentations, retargeting cohorts. (3) Stop profiling for marketing. (4) Do not share with third parties for marketing. (5) Confirm within 30 days. What is NOT allowed in response? (a) "Are you sure?" confirmation emails. (b) "We'll send one last email to confirm your choice". (c) "You'll miss our offers" retention flows. (d) Charging for unsubscribing. (e) Asking for a reason. (f) Offering "just less" instead. Cookies & ad tracking: objection also covers retargeting cookies + Custom Audiences on Meta/Google. Explicitly request removal from ad platforms. Telemarketing-specific (Dutch Telecoms Act 11.7): cold calls + auto-dialers require prior consent. The Dutch Do-Not-Call Register has been abolished — since then opt-in is the rule. Called without consent → complaint to ACM + AP. Postal mail: No/Yes sticker + Postfilter.nl for industry-wide opt-out. Individual companies must also respect direct objection. Enforcement: multiple AP fines issued 2023-2025 for unlawful direct marketing — e.g. Dutch political parties fined for political direct mail without opt-in.