Email Marketing Laws: A Practical Compliance Guide

Email marketing laws require four things of you consistently: get permission appropriate to where your subscriber lives, say honestly who is sending and why, make leaving easy and act on it fast, and keep evidence of how each address arrived. Everything else is jurisdiction-specific detail layered on top of those four.

Compliance and deliverability are the same project wearing different hats. The behaviors that get you fined (vague consent, buried unsubscribes, mailing people who never asked) are the same ones that produce spam complaints and shred your domain reputation. I've never seen a team with genuinely clean consent practices struggle to reach the inbox.

Usual disclaimer, and I mean it: this is an operating guide, not legal advice. If you sell across borders, handle sensitive data, buy lists, or send on behalf of clients, get a lawyer to look at your edge cases.

Which rules apply to your list

That depends on where your subscribers are, where you operate, how the address was collected, and whether the recipient is a consumer or a business buyer. If you send across borders, design for the strictest regime you touch and stop maintaining four parallel processes; the operational savings are worth more than whatever extra addresses a looser standard would have won you.

CAN-SPAM governs US commercial email and is more permissive than most marketers assume. It doesn't require prior opt-in. It does require truthful headers and subject lines, ad identification where relevant, a valid physical postal address, a working opt-out, and honoring that opt-out within 10 business days, per the FTC's compliance guide.

GDPR covers personal data in the EU and EEA, and an email address attached to a person is personal data. It asks a different question than CAN-SPAM does: rather than "may I send this?", it asks what lawful basis permits you to process this person's information at all. The UK pairs UK GDPR with PECR, which adds electronic-marketing rules including the soft opt-in for some existing customer relationships; the ICO's direct marketing guidance is the most usable operational reference I've found in any jurisdiction.

CASL in Canada generally requires express or implied consent, sender identification, and a functioning unsubscribe. The federal CASL guidance explains where implied consent comes from and how long it lasts (that expiry catches people out).

Then there's the US state privacy layer, CCPA as amended by CPRA and its growing list of imitators. These aren't email laws exactly, but they shape your privacy notice, your data-rights process, and what counts as "sharing" a contact record.

CAN-SPAM in practice

Permissive doesn't mean unregulated. Five controls cover most of it.

Sender and routing information must be true. No fake person, no borrowed brand, no lookalike domain. When an agency sends for a client, write down in advance who is named as the sender and who owns opt-out processing; that ambiguity is where agency relationships fail an audit.

Subject lines have to describe the message. "Your invoice is ready" on a promotional email is the classic violation, and it's a violation whether or not anyone complains. Clever is fine. Misleading is not, and the line between them is less blurry than copywriters like to pretend.

Include a real physical address, keep the unsubscribe visible without requiring a login, and process opt-outs immediately at the platform level rather than riding the 10-day allowance. Then sync that suppression to your CRM, sales engagement tool, and any ad audience exports; the legal deadline is generous, but your subscriber's patience isn't.

Last, you can't outsource the liability. If a lead vendor, freelancer, or agency sends on your behalf and gets it wrong, that's still your problem, so build approval flows and keep the records.

What GDPR and PECR actually change

Five things, and only the first is about the checkbox.

Consent capture has to be unbundled and specific. An unchecked box, plain wording, and separate permission for separate purposes. "Download the guide" should not silently subscribe someone to every promotion you'll ever run; if the form does both, say so next to the submit button in words a tired person can parse.

Consent evidence is the part teams skip and later regret. Store timestamp, source URL, form version, the exact consent text shown, and which privacy policy version was live. When someone asks in eighteen months how you got their address, that record is the whole answer.

Data minimization pays for itself. Three fields instead of twelve means less risk, less to secure, less to delete on request, and better form conversion; I've yet to meet a marketer who missed the phone number field after removing it.

Rights handling needs to be a real process, not an inbox someone checks. Access, correction, deletion, objection, portability, on a clock. If you can't find every copy of one person's data across your stack within a day, that's the gap to close first.

Processor controls cover everyone touching the data: ESP, CRM, enrichment vendors, analytics. Data processing agreements, subprocessor lists, transfer mechanisms.

The honest tradeoff: doing this properly slows list growth. Clear consent language and no pre-ticked boxes will cost you signups. The contacts you do get complain less, engage more, and don't quietly poison your sender reputation, which is a trade I'll take every time.

Vetting a new contact source

Every new source gets reviewed before the first send. Not the first campaign after the honeymoon; the first send.

The dangerous moment is a CSV landing in your inbox because "sales says it's fine." Make people fill in an intake form: where did these come from, what were they told, did they opt in, are any of them in the EU, UK, Canada, or California, have unsubscribes been removed, when were they last mailed? Six questions, two minutes, and it has saved me from at least one genuinely bad import.

Then segment before you send. Region, consent source, lifecycle stage, and engagement status are compliance fields as much as marketing ones; email list segmentation covers turning them into campaign groups.

Vendors claiming their list is "GDPR compliant" deserve particular skepticism. Compliance isn't a property a list can have independent of your relationship with the people on it.

Treat unsubscribe as a system, not a footer link

The link at the bottom is the smallest part. What matters is a global suppression list that overrides every segment in every tool, synced to your CRM, sales engagement platform, event tools, and ad audiences. A contact who unsubscribes on Monday and gets a sales sequence on Tuesday has experienced a process failure, and they'll express that opinion by clicking "report spam."

Google's bulk sender requirements expect one-click unsubscribe on marketing mail and opt-out processing within two days, which is considerably tighter than CAN-SPAM's 10 business days. Design to the two-day standard and the legal one takes care of itself.

Preference centers are good when they offer real choices (frequency, topic, product versus promotional) and bad when they exist to hide the exit. Always include "unsubscribe from all marketing" as a visible option. Multi-brand companies need to decide explicitly whether opt-out is brand-level or group-level, then say which in the email.

Watch unsubscribe rate and spam complaint rate broken out by acquisition source. When co-marketing leads unsubscribe at four times your baseline, the consent language on that partner's landing page is usually the culprit, and the number tells you before the mailbox providers do.

One more system-level trap: overlapping automation triggers. Someone who leaves your newsletter shouldn't keep receiving nurture emails because a workflow still has them in a branch. Global suppression plus frequency caps, checked quarterly. The email marketing automation guide covers the flow design; review welcome, win-back, and referral sequences first, since those are the ones nobody has opened since launch.

Authentication sits alongside all this. SPF, DKIM, and DMARC don't make a non-compliant campaign lawful, but without them even permission-based mail struggles to land; our email deliverability guide walks through the setup, and the DMARC generator produces the record.

The pre-send checklist

Short enough that people use it, which rules out anything longer than this.

1. Name the message type. Transactional, relationship, commercial, or a mix (mixed needs a second opinion).
2. Confirm audience eligibility: region, consent status, suppression status, source. If you can't say why someone is on this list, don't send to them.
3. Check the email against the promise made at signup. Product updates means product updates, not partner offers.
4. Verify sender name, domain, subject line, and preheader describe the thing honestly.
5. Confirm footer elements: physical address, unsubscribe, privacy policy link.
6. Click the unsubscribe link in a test send and confirm the preference actually saves.
7. Save the audience criteria, creative, approver, and send time.

AI in the workflow makes step 4 and step 7 more important, not less. Generated copy will produce claims nobody verified and personalization built on inferences you have no basis for. Let it draft; keep a human on consent language, targeting logic, and anything touching personal data.

Cold email, transactional mail, and double opt-in

Can I send cold B2B email legally?

Sometimes, and the answer changes at every border. Under CAN-SPAM, US commercial email doesn't require prior opt-in as long as you follow the rules above. In the UK and EU it depends on whether you're emailing a corporate subscriber, a sole trader, or an individual, and the analysis is genuinely fiddly. My working rule: keep cold outreach targeted and easy to exit, send it from a separate domain, and never add a cold prospect to your newsletter without asking.

Do transactional emails need an unsubscribe link?

Genuine transactional email supporting a service relationship (receipts, password resets, security alerts) generally doesn't. The risk is drift; add enough promotional content to a receipt and it becomes a commercial message with commercial obligations. Keep the receipt a receipt.

Do any of these laws require double opt-in?

No law I'd point to mandates it outright, but double opt-in is the strongest consent evidence you can produce cheaply, and it filters out typos, bots, and malicious signups. I'd use it for EU and UK audiences, co-marketing lists, and anything sensitive; for a low-stakes discount signup where volume is the point, single opt-in with good records is defensible.