Why Email Marketing Compliance Matters
€20M
Maximum GDPR fine (or 4% of annual revenue)
$51,744
CAN-SPAM fine per violation (per email)
$10M CAD
Maximum CASL fine for businesses
Disclaimer: This guide provides general information only. It is not legal advice. Always consult a qualified attorney for your specific situation and jurisdiction.
GDPR (General Data Protection Regulation) - EU
Who Must Comply?
Any business that processes personal data of EU residents, regardless of where the business is located.
Example: A US company emailing EU subscribers must comply with GDPR.
GDPR Requirements for Email Marketing
1. Explicit Consent (Opt-In)
You must obtain clear, affirmative consent before sending marketing emails.
- • ✅ Checkbox that users actively check (unchecked by default)
- • ✅ Clear explanation of what they're signing up for
- • ❌ Pre-checked boxes (not valid consent)
- • ❌ Implied consent from purchase (must be separate opt-in)
2. Double Opt-In (Recommended)
Send confirmation email requiring subscribers to verify their email address. Provides proof of consent.
3. Right to Access
Subscribers can request a copy of all personal data you hold about them. Must provide within 30 days.
4. Right to Erasure ("Right to be Forgotten")
Subscribers can request deletion of their data. You must comply within 30 days unless you have a legitimate reason to retain it.
5. Right to Data Portability
Subscribers can request their data in a machine-readable format (CSV, JSON).
6. Privacy Policy
Must clearly explain:
- • What data you collect
- • How you use it
- • How long you store it
- • Who you share it with
- • How subscribers can exercise their rights
7. Data Security
Implement appropriate technical and organizational measures to protect personal data (encryption, access controls, regular backups).
8. Unsubscribe Mechanism
Easy, one-click unsubscribe in every email. Process requests immediately (no delay).
CAN-SPAM Act - United States
Who Must Comply?
Any business sending commercial emails to US recipients. Applies to B2B and B2C.
CAN-SPAM Requirements
1. No Opt-In Required
You can email anyone (opt-out model). But they must be able to unsubscribe easily.
2. Accurate Header Information
From, To, and Reply-To fields must be accurate and identify the sender.
3. No Deceptive Subject Lines
Subject line must accurately reflect email content. No misleading or false information.
4. Identify Message as Advertisement
Must disclose that the email is an advertisement (though this is often interpreted loosely).
5. Include Physical Mailing Address
Valid physical postal address (can be PO Box or registered agent address).
6. Clear Unsubscribe Mechanism
Requirements:
- • Visible and easy to find
- • Works for at least 30 days after sending
- • No login required to unsubscribe
- • No fee to unsubscribe
- • Can't require more than email address
7. Honor Opt-Out Requests Within 10 Business Days
Stop sending emails within 10 business days of unsubscribe request.
8. Monitor Third-Party Senders
If you hire someone to send emails on your behalf, you're still responsible for compliance.
CASL (Canada's Anti-Spam Legislation) - Canada
Who Must Comply?
Any business sending commercial emails to Canadian recipients. CASL is stricter than CAN-SPAM.
CASL Requirements
1. Express Consent Required
You must obtain explicit opt-in consent before sending commercial emails. No implied consent for marketing.
2. Clear Identification
Clearly identify yourself and your business in every email.
3. Contact Information
Include valid physical mailing address and either phone number, email address, or web address.
4. Unsubscribe Mechanism
Easy, free unsubscribe in every email. Must be functional for at least 60 days. Process within 10 business days.
5. Record Keeping
Keep records of consent (who, when, how) for as long as you email them + 3 years after they unsubscribe.
Email Marketing Compliance Checklist
✅ Pre-Send Checklist
Common Compliance Mistakes to Avoid
❌ Buying Email Lists
Purchased lists violate GDPR and CASL (no consent). Even under CAN-SPAM, they have terrible deliverability and high spam complaints.
❌ Pre-Checked Opt-In Boxes
Not valid consent under GDPR or CASL. Checkbox must be unchecked by default.
❌ Hidden or Difficult Unsubscribe
Tiny text, same color as background, requiring login—all violations. Unsubscribe must be obvious and easy.
❌ Ignoring Unsubscribe Requests
Must process within 10 business days. Continuing to email after unsubscribe is a serious violation.
❌ No Physical Address
Required by CAN-SPAM, GDPR, and CASL. Use your business address or registered agent.
❌ Misleading Subject Lines
"Re:" or "Fwd:" when it's not a reply, fake urgency, or subject lines unrelated to content—all violations.
How to Stay Compliant
1. Use a Reputable ESP
GetResponse, ActiveCampaign, and other major ESPs have built-in compliance features (unsubscribe links, consent tracking, data security).
2. Implement Double Opt-In
Provides proof of consent and improves list quality. Highly recommended for GDPR and CASL.
3. Keep Detailed Records
Document when and how you obtained consent. Store consent records for 3+ years after unsubscribe.
4. Regular Compliance Audits
Review your email practices quarterly. Check unsubscribe links, privacy policy, consent forms, and data security.
5. Consult a Lawyer
Laws change. Get legal advice specific to your business, industry, and target markets.
Compliant Email Platform
GetResponse
GetResponse is GDPR-compliant with built-in consent tracking, double opt-in, automatic unsubscribe links, data encryption, and compliance tools for global regulations.
Try GetResponse Free for 14 DaysFrequently Asked Questions
Do I need consent to send marketing emails?
Depends on jurisdiction. GDPR (EU) and CASL (Canada) require explicit opt-in consent. CAN-SPAM (US) allows opt-out (you can email anyone, but they must be able to unsubscribe). Always get consent to be safe.
What happens if I violate email marketing laws?
GDPR: up to €20M or 4% of annual revenue. CAN-SPAM: $51,744 per violation. CASL: up to $10M CAD for businesses. Plus damage to sender reputation and deliverability.
Can I email customers who purchased from me?
Transactional emails (order confirmations, shipping updates) are allowed. Marketing emails require separate consent under GDPR and CASL. Under CAN-SPAM, you can send marketing emails but must provide unsubscribe.
Is double opt-in required?
Not legally required but highly recommended. Double opt-in provides proof of consent, improves list quality, and reduces spam complaints. Essential for GDPR compliance.
How long do I need to keep consent records?
GDPR: as long as you're emailing them. CASL: duration of relationship + 3 years after unsubscribe. Best practice: keep all consent records for at least 3 years.
Stay Compliant with GetResponse
GDPR-compliant platform with built-in consent tracking, double opt-in, and automatic compliance features.
Start Your Free 14-Day TrialNo credit card required • Cancel anytime