After the yes/yes sticker: start building an address database now

Since the introduction of the 'yes/yes' sticker, in a growing number of Dutch municipalities you may only deliver unaddressed advertising material to households that explicitly request it with a sticker. For entrepreneurs, this means that a large proportion of households are no longer reachable via leaflets. The smart move: start building your own GDPR-compliant address database now for addressed campaigns, so that you continue to reach your target audience effectively, regardless of the sticker regulations.

What exactly is the yes/yes sticker?

The yes/yes sticker reverses the old rule. Previously, an opt-out system applied: every household received unaddressed advertising unless they indicated otherwise with a no/no or no/yes sticker. The yes/yes sticker turns this into an opt-in system : unaddressed advertising material is now only delivered to households that have placed a yes/yes sticker on their mailbox. No sticker means no leaflet.

The Municipality of Amsterdam was the first to introduce the measure, on January 1, 2018. The goal is to reduce paper waste and general litter. In practice, however, only a minority of households request such a sticker, causing the reach of unaddressed leaflets to drop significantly.

Is the yes/yes sticker legally permitted?

Yes. After the introduction, the leaflet industry, together with PostNL subsidiary Spotta, took the matter to court. The Amsterdam Court of Appeal ruled that the municipality was authorized to introduce the opt-in system. The Supreme Court confirmed this ruling in September 2021: the introduction of the opt-in sticker by the Municipality of Amsterdam is not unlawful. Municipalities derive the leeway to establish these types of rules to prevent waste from waste regulations.

This establishes the legal basis. Since then, many other municipalities have followed suit, including major cities such as Rotterdam, Utrecht, and Tilburg, and the number of participating municipalities has continued to rise. It is expected that this number will continue to grow. It is best to check with the municipality itself whether your municipality is participating, as policies vary by location and are subject to change.

However, case law did make an important distinction: a free door-to-door newspaper with editorial content is not unaddressed advertising material and therefore does not automatically fall under the yes/yes rule. Consequently, the opt-in system does apply to pure advertising leaflets, but the situation is more nuanced for news media.

What does the yes/yes sticker mean for entrepreneurs and marketing?

The opt-in sticker is not necessarily bad news for advertisers. Those who still have a sticker indicate that they wish to receive advertising. It is plausible that the return on investment is relatively high among this group, while distributing less printed material in total and thus saving on marketing costs.

The real point of concern lies with the households you can no longer reach via unaddressed printed matter. For that group, your own address database more valuable. With addressed mail or email, you reach people in a targeted manner, even if they do not have a 'yes/yes' sticker. However, as soon as you collect and use address data, you enter the realm of privacy legislation.

Address database and the GDPR: these are the rules

A postal address, just like an email address, is personal data. Consequently, collecting and using it falls under the General Data Protection Regulation (GDPR). This does not mean that you are not allowed to do anything, but rather that you must do so carefully and demonstrably.

You always need a valid legal basis

You need a legal basis for every processing of personal data. For direct marketing by post, these are particularly relevant:

• Consent – ​​the data subject indicates, through a clear, active action, that they wish to receive your mail (an opt-in). Consent must be given freely and must always be able to be withdrawn.
• Legitimate interest – the GDPR lists direct marketing as a potential legitimate interest. However, you must conduct and document a balancing of interests, and the data subject must be able to reasonably expect the processing.
• Performance of a contract – for existing customers, advertising for similar products or services may align with the purpose for which you originally obtained the address details.

Note the supervisory authority's strict line. The Dutch Data Protection Authority takes the position that relying on legitimate interest is primarily appropriate for an existing customer relationship, and that marketing to people with whom you have no relationship often constitutes too great an infringement on their privacy. For so-called cold calling to unknown recipients, legitimate interest is therefore a shaky basis; in such cases, consent is the more obvious choice. Anyone relying on legitimate interest must always be able to substantiate the balancing act performed.

Also note the difference with email and telephone marketing: additional, often stricter rules apply to these via the Telecommunications Act. For targeted advertising by post, explicit consent is not always required, but a proper opt-in is generally the safest and most customer-friendly route.

Build your database with an opt-in

If you want to be sure and build a high-quality database at the same time, choose an opt-in. Collect addresses via a clear, confirming action, for example:

• creating an account on your website;
• downloading an e-book or whitepaper;
• participation in a promotion, giveaway, or newsletter.

Anyone who signs up here shows genuine interest. And anyone who unsubscribes later sends a clear signal: you would be better off spending your marketing budget elsewhere. Always ensure that unsubscribing (withdrawing the opt-in) is just as simple as signing up.

Also take into account your duty to provide information

In addition to a legal basis, you have an obligation to inform. Tell data subjects who you are, what you use their data for, on what legal basis, and how long you retain it. You record this in a privacy statement. A clear privacy statement prevents disputes and builds trust with your target audience.

Step-by-step plan: make your address list GDPR-compliant

1. Determine your legal basis. Choose consciously between consent, legitimate interest, or contract, and document that choice with your balancing of interests.
2. Collect data properly. Use a clear opt-in and do not ask for more data than you need (data minimization).
3. Inform the data subjects. Refer to your privacy statement when you request the data.
4. Make unsubscribing simple. Offer a simple opt-out in every communication and process unsubscribes immediately.
5. Secure and restrict. Store the file securely, restrict access, and delete data you no longer need.

The Dutch Data Protection Authority supervises compliance with the GDPR. A well-designed process prevents complaints, reputational damage, and potential enforcement action.

Frequently asked questions about the yes/yes sticker and address details

Does the yes/yes sticker apply throughout the Netherlands?

No, it is not a national rule. Each municipality decides for itself whether to introduce an opt-in system. More and more municipalities are doing so, but the policy varies by location. Check with your municipality to see which regulations apply there.

Am I still allowed to distribute unaddressed leaflets?

In municipalities without a yes/yes sticker, this is in principle still permitted, with respect for no/no and no/yes stickers. In municipalities with a yes/yes sticker, you may only deliver to households displaying the sticker. Addressed mail falls outside these sticker rules but must still comply with the GDPR.

Do I need permission to send advertising mail?

Not always. For targeted advertising by post, an existing customer relationship can also serve as a legal basis. According to the regulator, legitimate interest is a shaky basis for soliciting unknown recipients; consent is therefore the most secure and customer-friendly choice. Moreover, separate, often stricter rules apply to email and telephone marketing.

How long am I allowed to retain address details?

The GDPR does not specify a fixed term. The basic principle is that you do not retain data longer than necessary for the purpose for which you collected it. Therefore, establish a logical retention period and delete or anonymize the data thereafter.

What if someone cancels?

Then you must respect that request and remove the person from your marketing database. Make the unsubscribe process as simple as possible and process it as quickly as is reasonably possible.

What specifically do I need to do now as an entrepreneur?

Don't wait until leaflets disappear completely in your municipality. Start building your own GDPR-compliant address database now: choose a legal basis, collect addresses via a clear opt-in, link a clear privacy statement to it, and track unsubscribes. This way, you build a valuable customer base that you can target, independent of sticker regulations.

Need help with a GDPR-compliant address database?

Do you want to grow with targeted marketing without privacy risks? MKB Juristen helps you set up an address database that is correct: from the right legal basis and opt-in to a comprehensive privacy statement. With our GDPR package , we draft the necessary documents for you so that you comply with the requirements of the GDPR.

Want to know more about privacy and data protection for your business? View our expertise in privacy and GDPR or schedule a no-obligation intake directly. We are happy to discuss your needs.