FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Marketing

Mailchimp

MarketingOfficial website

Mailchimp (owned by Intuit) is a US-based email marketing platform used by millions of small businesses and creators. For European audiences, the key GDPR requirement is valid opt-in consent for email marketing: pre-ticked boxes, implied consent, and purchased lists are not compliant. All subscriber data is processed in the US requiring SCCs. Mailchimp provides built-in GDPR features including consent checkboxes, double opt-in, and unsubscribe management to help operators stay compliant.

Block Mailchimp until consentScan my site
Overview

What does Mailchimp do?

What is Mailchimp?

Mailchimp is an email marketing and automation platform owned by Intuit. It is one of the most widely used email marketing tools globally, particularly popular with small businesses, creators, and non-profits. Mailchimp provides list management, email campaign creation, marketing automation, audience segmentation, landing pages, and basic CRM features. It integrates with hundreds of e-commerce, CMS, and business platforms.

The GDPR consent requirement for email marketing

Under GDPR, sending marketing emails to EU contacts requires valid consent: freely given, specific, informed, and unambiguous. This means using an unchecked opt-in box, never using pre-ticked checkboxes, not bundling marketing consent with terms of service, and retaining evidence of consent (who, when, how). Mailchimp provides tools to help: GDPR-compliant signup forms, double opt-in, consent timestamp recording, and granular subscription management.

Email tracking and ePrivacy

Mailchimp email tracking pixels (open tracking) and click tracking constitute personal data processing. Open tracking works by embedding a 1x1 pixel image in each email: when loaded, it registers an open event linked to the subscriber. This is widely considered personal data processing under GDPR. Disclose email tracking in your privacy policy. Consider whether open tracking is necessary; many privacy-conscious senders disable it.

US transfers and DPA

All Mailchimp subscriber data is processed in the US. Sign the Mailchimp Data Processing Agreement (available via Mailchimp account settings under Extras) which includes SCCs for EU-US data transfers. Disclose Mailchimp as an email processor in your privacy policy.

Practical compliance steps

Sign the Mailchimp DPA. Enable double opt-in for all EU lists. Use GDPR-compliant signup forms with explicit unchecked consent checkboxes. Record and retain consent evidence. Never add contacts without consent. Honour unsubscribe and erasure requests promptly. Disclose Mailchimp and email tracking in your privacy policy. Purge inactive subscribers periodically to maintain data minimisation.

Compliance

Mailchimp and the GDPR

Mailchimp is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR) required for email marketing to EU contacts. GDPR requires a clear affirmative opt-in for marketing emails: pre-ticked boxes, implied consent, or purchased lists are not valid. Legitimate interest applies only in very limited B2B scenarios with existing customer relationships.
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive for email tracking pixels and cookies, SCCs for US data transfers

Impact assessment (DPIA)

A DPIA is generally not required for standard Mailchimp email marketing. It may become relevant for large-scale audience profiling, automated segmentation combining multiple data sources, or for email programmes targeting vulnerable populations.

Sample text for your banner

Yes, I would like to receive marketing emails from [Brand]. I understand I can unsubscribe at any time using the link in any email. My data will be processed in accordance with the privacy policy.
Cookies and trackers

What Mailchimp sets and contacts

Tracking method
Email marketing platform, email tracking pixels (opens, clicks), embedded signup forms, landing pages, first-party cookies, audience data enrichment
Server location
United States (Mailchimp/Intuit is a US company with US infrastructure)
Data transferred outside the EU
Mailchimp (owned by Intuit) is a US-based email marketing platform. All subscriber data is processed on US infrastructure. EU personal data transfers require Standard Contractual Clauses. Mailchimp provides a GDPR-compliant DPA.

Cookies set (1)

NameTypeDurationPurpose
_mc_userpersistent1 yearMailchimp user identifier for tracking email campaign engagement and subscriber analytics

Third-party domains contacted (3)

  • mailchimp.com
  • list-manage.com
  • mailchimpapp.net
Questions

Frequently asked questions about Mailchimp

Can't find your question? Write to us, we answer fast.

Does Mailchimp require GDPR consent?

Yes. Marketing emails to EU contacts require valid GDPR consent: unchecked opt-in, specific purpose, documented timestamp. Mailchimp provides GDPR-compliant forms with double opt-in.

What does double opt-in mean in Mailchimp?

Double opt-in sends a confirmation email subscribers must click to verify. Enable it for all EU lists via Mailchimp's List Settings.

Can I send marketing emails to existing customers without consent?

In limited B2B scenarios, legitimate interest may apply. This requires a documented LIA and a clear opt-out in every email. For consumer marketing, consent is always required.

Does Mailchimp transfer data outside the EU?

Yes. All subscriber data is processed in the US. Sign the Mailchimp DPA via Account Settings which includes SCCs.

Does Mailchimp email tracking constitute personal data processing?

Yes. Open and click tracking links engagement to subscriber profiles. Disclose this in your privacy policy.

How do I handle erasure requests in Mailchimp?

Permanently delete the contact in Mailchimp. Respond within 30 days and document all actions.

Can I import contacts from a CSV into Mailchimp?

Only if those contacts have valid documented consent. Never import contacts who have not specifically opted in to your marketing.

Are there EU-based alternatives to Mailchimp?

Brevo (France), Mailjet (France), and CleverReach (Germany) provide EU data residency with simpler GDPR transfer compliance.

Same category

More services: Marketing

See the whole category

OpnForm

OpnForm is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. OpnForm integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, OpnForm helps organizations maintain robust websites that meet user expectations and technical requirements.

Marketing

Wise Agent

Wise Agent is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Wise Agent enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Wise Agent empowers marketing teams to achieve measurable growth.

Marketing

CartStack

CartStack is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. CartStack supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, CartStack ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Marketing

Tripadviser.Widget

Tripadviser.Widget is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Tripadviser.Widget supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Tripadviser.Widget ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Marketing

Yotpo SMSBump

Yotpo SMSBump is an SMS marketing and messaging platform that enables businesses to reach customers through text messages. It provides bulk SMS sending, automated campaigns, two-way messaging, and audience segmentation. Yotpo SMSBump supports personalized messages, scheduling, and compliance management for SMS marketing regulations. With delivery analytics and integration capabilities, Yotpo SMSBump helps businesses drive engagement, send transactional alerts, and build direct communication channels.

Marketing

Ceros

Ceros is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Ceros enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Ceros empowers marketing teams to achieve measurable growth.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site