An email marketing compliance checklist
8 min read
Compliant email marketing comes down to sending only to people who agreed to hear from you, identifying yourself honestly, and making it easy to stop. In the US, CAN-SPAM sets rules on content and unsubscribes; in the UK and EU, GDPR and PECR generally require prior consent for marketing email to individuals. This checklist summarises the basics and is not legal advice.
Consent and list building
Under GDPR and PECR, marketing email to individuals usually needs clear, affirmative consent, with a limited soft opt-in exception for existing customers in some cases. Pre-ticked boxes are not valid consent.
- Collect consent with an unticked box or explicit action
- Record when, where and how each person subscribed
- Never buy, rent or scrape email lists
- Consider double opt-in to confirm addresses
CAN-SPAM essentials
CAN-SPAM applies to commercial email in the US. It does not require prior consent, but it does set firm rules on how messages are presented and how opt-outs are handled.
- Accurate From, To and routing information
- Subject lines that are not deceptive
- Identify the message as an advertisement where required
- Include a valid physical postal address
- Provide a clear opt-out and honour it within 10 business days
Unsubscribe and provider rules
Gmail and Yahoo require bulk senders to support one-click unsubscribe as defined in RFC 8058, honour requests promptly and keep spam complaint rates below 0.3 percent. A visible unsubscribe link in every marketing email is good practice everywhere.
Automation and your responsibilities
Tools that automate your own mailbox do not change these obligations. Using the extension to monitor your own campaigns or warm your own mailboxes is separate from sending marketing email, and it must never be used to send unsolicited mail. Provider terms of service also apply to automated activity, and you are responsible for how you use it.
Frequently asked questions
Does CAN-SPAM require opt-in consent?
No. CAN-SPAM is an opt-out law, but it requires honest headers, non-deceptive subjects, a postal address and a working opt-out honoured within 10 business days.
Can I email business contacts without consent under GDPR?
Rules differ by country and by whether the recipient is an individual or a corporate address. Many cases require consent, so check the specific rules for your audience or take legal advice.
Is this checklist legal advice?
No. It summarises common requirements. For decisions about your own program, consult a qualified adviser.
Also useful: Documentation · Free email tools