Email Marketing GDPR and CAN-SPAM Compliance

CAN-SPAM Act (United States)

The CAN-SPAM Act applies to all commercial email messages sent to recipients in the United States. It does not require opt-in consent, meaning you can technically email someone who has not explicitly signed up, but it imposes strict rules on how you send and what you include. As a practical matter, sending unsolicited email destroys your deliverability and sender reputation, so opt-in is best practice regardless of the legal minimum.

Requirements you must follow:

• Do not use deceptive subject lines. The subject line must accurately reflect the email content.
• Identify the message as an advertisement if it is one. This can be subtle, but the commercial nature should be clear.
• Include your valid physical mailing address in every email. A PO Box or registered commercial mail receiving agency works if you operate from home and do not want to share your home address.
• Include a clear and conspicuous unsubscribe mechanism that works for at least 30 days after the email is sent.
• Honor unsubscribe requests within 10 business days. You cannot charge a fee, require the subscriber to log in, or ask for any information beyond the email address to process an unsubscribe.
• Do not sell or transfer the email addresses of people who have unsubscribed.

Penalties for CAN-SPAM violations can reach $50,120 per email sent in violation. If you send 1,000 non-compliant emails, the maximum penalty is over $50 million. In practice, enforcement targets the most egregious violators, but the risk is real and easily avoided by following the straightforward rules.

GDPR (European Union)

The General Data Protection Regulation applies to anyone processing personal data of EU residents, regardless of where your business is located. If you sell to customers in Europe, GDPR applies to you even if your store is based in the United States. The requirements are significantly stricter than CAN-SPAM.

Consent requirements:

• You must obtain explicit, affirmative consent before sending marketing emails. Pre-checked consent boxes do not count. The subscriber must actively check the box or click a button to opt in.
• Consent must be specific: the subscriber must understand what they are consenting to. "Sign up for updates" is acceptable. Burying marketing consent in a terms of service checkbox is not.
• Consent must be freely given, meaning you cannot require email signup as a condition of purchase. You can offer incentives (discounts), but the purchase must be completable without subscribing.
• You must keep records of when and how each subscriber consented, including the date, the form they used, and the text they agreed to.

Subscriber rights under GDPR:

• Right to access: subscribers can request a copy of all data you hold about them.
• Right to erasure (right to be forgotten): subscribers can request you delete all their data permanently.
• Right to data portability: subscribers can request their data in a machine-readable format.
• Right to withdraw consent at any time, and the withdrawal must be as easy as the original opt-in.

GDPR penalties reach up to 20 million euros or 4% of global annual revenue, whichever is higher. Enforcement has been active, with fines issued to companies of all sizes including small ecommerce businesses. Even without formal enforcement, GDPR compliance builds trust with European customers who are increasingly privacy-conscious.

Double Opt-In for GDPR

While GDPR does not technically require double opt-in (where a subscriber confirms their email address by clicking a link in a verification email), it is strongly recommended because it provides the clearest possible proof of consent. A subscriber who enters their email on your form AND clicks the confirmation link in the follow-up email has clearly and verifiably consented. Most email platforms support double opt-in as a list setting.

CASL (Canada)

Canada's Anti-Spam Legislation applies to commercial electronic messages sent to Canadian recipients. CASL is one of the strictest anti-spam laws in the world, requiring express consent before sending marketing messages. Implied consent exists for customers who have made a purchase within the last 24 months, but this is narrower than many marketers assume.

Key CASL requirements include identifying yourself clearly in every message with your business name, physical address, and contact information. Unsubscribe requests must be processed within 10 business days. Penalties reach up to $10 million per violation for businesses.

Practical Compliance Checklist

Regardless of which regulations apply to your customers, following this checklist keeps you compliant with all three major frameworks.

Signup forms: Use clear, specific language about what subscribers will receive. Include an unchecked opt-in checkbox (not pre-checked). For EU-targeted stores, use double opt-in. Store consent records including timestamp, form URL, and consent text for every subscriber.

Every email: Include your physical mailing address in the footer. Include a working one-click unsubscribe link. Identify your brand name clearly in the "From" field. Use subject lines that accurately describe the email content. Process unsubscribes within 48 hours (stricter than the 10-day legal requirement, but better for reputation and trust).

Data management: Honor data deletion requests promptly. Do not share or sell subscriber data to third parties. Regularly clean your list of inactive subscribers. Maintain consent records for at least 3 years. Have a documented privacy policy that explains how you collect, use, and store email data.

Third-party integrations: Ensure your email platform, CRM, analytics tools, and any connected services also comply with applicable regulations. You are responsible for how your vendors handle your subscribers' data. Review data processing agreements with your email marketing platform to confirm GDPR compliance if you serve EU customers.

How Compliance Actually Helps Your Business

Many store owners view compliance as a burden, but following these rules actually improves your email marketing performance. Explicit opt-in builds a list of genuinely interested subscribers who open and click at higher rates. Easy unsubscribe reduces spam complaints, which improves deliverability for everyone else on your list. Consent records protect you legally if a subscriber disputes their opt-in status. And privacy-respecting practices build customer trust, which directly translates to higher lifetime value.

The stores with the best email marketing results are almost always the most compliant because the same principles that drive compliance, respect for subscriber preferences, clear communication, quality over quantity, also drive engagement and revenue.