As part of its regular non-binding information on the General Data Protection Regulation (GDPR), the Bavarian data protection authority (the Authority) has issued a short paper on the topic of marketing. The Authority stated that the GDPR will replace the detailed provisions of the German Federal Data Protection Act on data processing for marketing purposes. In future, the relevant provision for assessing the legality of processing for marketing purposes will be Article 6(1)(f) of the GDPR, the processing of personal data for direct marketing purposes may be regarded as constituting a legitimate interest. However, the Authority holds that in the context of telephone or fax marketing, the balancing of interests will rather lead to the conclusion that such processing still requires prior and explicit consent. The Authority, among others, also affirmed a recent statement by the “Düsseldorfer Kreis”, according to which older consents (for receiving advertisements) remain valid if they were given in conformity with the GDPR.