Contracting party
The contracting party is The Rocket Science Group LLC, trading as Mailchimp. Mailchimp is part of the Intuit group.
EU compliance setup · Mailchimp
Mailchimp, set up GDPR-compliant
Mailchimp is many people's first newsletter tool, and its defaults are American: whoever submits the form is subscribed straight away. For Austria and Germany that has to be turned around.
- Facts checked on 3 October 2026, each with its source.
- Fixed price € 890 for your whole stack, not per tool.
- Technical setup, not legal advice.
What we looked up for Mailchimp
Hosting
According to its security page, Mailchimp's own servers are in data centres in the United States.
EU-US Data Privacy Framework
The certification is held by Intuit Inc.; 'The Rocket Science Group d/b/a Mailchimp' is listed as a covered entity. Status on 3 October 2026: active, next recertification due on 11 December 2026.
Data processing agreement
The data processing agreement is incorporated directly into the Standard Terms of Use and does not require a signature.
Double opt-in
Audiences use single opt-in by default: whoever submits the form is added straight away. Double opt-in has to be switched on.
Proof of consent
For sign-ups, the export contains the OPTIN_TIME and OPTIN_IP fields with the date, time and IP address of the sign-up.
GDPR fields
With GDPR fields enabled, Mailchimp records a plain-text version of the form for sign-ups through hosted forms or landing pages.
Sending domain
Your own domain needs 2 CNAME records for DKIM and 1 TXT record for DMARC.
List import
Contacts imported as 'subscribed' do not go through the sign-up process. You have to be able to verify the permission yourself.
This page is not legal advice and we are not a law firm. We report what the vendor itself documents, with a date. Vendors change their terms; the linked source in its current version always prevails.
Where Mailchimp setups snag in Europe
Single opt-in is the default
A new audience accepts every sign-up straight away. Without confirmation you cannot show that the address belongs to the person who entered it. If this was never changed, the list has no reliable proof.
Imports skip confirmation
Imported contacts get no OPTIN_TIME or OPTIN_IP from a Mailchimp sign-up, because they never go through one. You have to bring the proof from the old source.
How we set up Mailchimp
Reconfigure the audience
Switch on double opt-in, enable GDPR fields, write the consent wording in the right language, adjust the confirmation email.
Authenticate the domain
DKIM and DMARC on your domain, so Mailchimp does not sign with its own domain and the emails arrive.
List and proof
Save an export with the OPTIN fields, separate imported contacts without proof, record the US transfer in your records of processing.
What people ask about Mailchimp
Is Mailchimp GDPR compliant?
No tool is compliant on its own; it depends on the setup. Mailchimp provides double opt-in, GDPR fields, a data processing agreement and coverage under Intuit's Data Privacy Framework certification. The data sits in the US, and the default is single opt-in.
Does Mailchimp have double opt-in?
Yes, but not by default. Audiences start with single opt-in; double opt-in has to be switched on.
Does Mailchimp store the sign-up IP address?
Yes. For sign-ups, the export contains OPTIN_TIME and OPTIN_IP. Imported contacts never go through a sign-up, so you have to bring their proof from the old source.
Is Mailchimp under the Data Privacy Framework?
Yes, through its parent: Intuit Inc. is certified and Mailchimp is covered as 'The Rocket Science Group'. On the list you therefore have to search for 'Intuit', not 'Mailchimp'.
There is usually more than one tool
The setup costs € 890 for your whole stack. The other tools we have checked the same way:
Tell us how Mailchimp runs for you.
Tell us which tools you use and where your contacts come from. In the first call we will tell you whether € 890 covers it or whether more needs fixing, honestly either way.
Request the setup