Email Marketing Compliance:
CAN-SPAM, GDPR, CCPA & Beyond
One non-compliant campaign can cost your business millions in fines and permanently damage sender reputation. Here is everything you need to know.
by Alkan Balkaya · Last updated: 2026-10-18Email marketing compliance means following the laws that govern commercial email: CAN-SPAM in the United States, GDPR in the EU, CCPA and CPRA in California, and CASL in Canada. Each law sets rules for consent, unsubscribe mechanisms, sender identification, and data rights. Meeting all four protects your business from fines reaching millions and preserves your sender reputation.
Every email you send carries legal weight. Whether you are a solo founder sending a monthly newsletter or a marketing team managing millions of subscriber records, email marketing compliance is not optional. It is the foundation that determines whether your campaigns reach inboxes or trigger enforcement actions.
The regulatory landscape has only intensified since GDPR went into effect in 2018. The United States enforces CAN-SPAM at the federal level while California layers on CCPA and CPRA protections. Canada maintains its own rigorous framework through CASL. Violating any of these laws exposes your business to fines that can reach tens of millions of dollars, and the reputational damage often costs more than the penalties themselves.
New here? Start with our primer on Email Deliverability & Authentication for the fundamentals, then come back to this guide.
This guide breaks down the four major email marketing laws, explains exactly what each requires, and gives you a practical checklist you can implement today. No legal jargon without explanation. No vague advice. Just the specific rules that keep your email program compliant and your sender reputation intact.
Quick context: Mailsoftly bakes compliance into every send, with transparent pricing and human support. 500 contacts and 2,000 emails per month, no credit card.
Start free with Mailsoftly →
Key Takeaways
Compliance matters because it directly controls deliverability, brand trust, and revenue, not just legal exposure. Internet service providers use engagement signals and complaint rates to decide whether your emails reach the inbox or the spam folder. A single spam complaint spike caused by non-compliant practices can tank your sender reputation for months.
The financial stakes are real. CAN-SPAM violations carry penalties of up to $51,744 per individual email. GDPR fines can reach 4% of annual global turnover or 20 million euros, whichever is greater. According to the CMS GDPR Enforcement Tracker, regulators have issued more than 7.5 billion euros in fines across over 3,000 cases since the regulation took effect.
Beyond fines, non-compliance erodes subscriber trust. When recipients feel their data is mishandled or that they cannot easily unsubscribe, they mark your messages as spam. That feedback loop damages your domain reputation across every mailbox provider simultaneously. The legal risk and the deliverability risk are two sides of the same coin.
Read enough? Try Mailsoftly free with 500 contacts and 2,000 emails per month, no credit card.Start free with Mailsoftly →
CAN-SPAM requires seven things in every commercial email: honest header information, a truthful subject line, a disclosure that the message is an ad, your physical postal address, a clear opt-out mechanism, opt-out processing within 10 business days, and oversight of anyone who emails on your behalf. The CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography and Marketing Act) has governed commercial email in the United States since 2003, and it remains actively enforced today.
A critical nuance: CAN-SPAM does not require prior consent to send commercial email. It operates on an opt-out model. You can email someone who has not explicitly opted in, as long as every message meets all seven requirements above. This is fundamentally different from GDPR and CASL, which require opt-in consent before the first email is sent.
Transactional emails (order confirmations, shipping notifications, account updates) are largely exempt from CAN-SPAM, but only if their primary purpose is transactional. If you add promotional content to a transactional email to the point where it becomes primarily commercial, all seven rules apply. Building a healthy, permission-based list from day one makes this entire set of rules easier to satisfy, which is why email deliverability fundamentals and compliance reinforce each other.
GDPR requires explicit, freely given consent before you send marketing emails to EU residents, plus honoring a defined set of subscriber rights such as access, erasure, and portability. The General Data Protection Regulation applies to any business that sends marketing emails to residents of the European Union or European Economic Area, regardless of where that business is located. If you have even one EU subscriber, GDPR applies to how you collect, store, and process their data.
Valid consent under GDPR must be freely given, specific, informed, and unambiguous. In practice, this means:
Double opt-in (where a subscriber confirms their email address via a confirmation link) is not technically required by GDPR, but it is strongly recommended because it provides clear evidence of consent that holds up during audits.
Data processing agreements (DPAs) are mandatory under GDPR whenever you share subscriber data with third-party processors. This includes your email marketing platform, analytics tools, and any integration that touches personal data. If your email platform stores subscriber data on servers outside the EU, adequate data transfer mechanisms (such as Standard Contractual Clauses) must be in place.
CCPA and CPRA require California-facing businesses to disclose what personal data they collect, let consumers opt out of its sale or sharing, honor deletion requests, and never retaliate against people who exercise those rights. The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), protects California residents and applies to any for-profit business that meets at least one of these thresholds: annual gross revenue exceeding $25 million, processing personal information of 100,000 or more California consumers, or deriving 50% or more of revenue from selling or sharing consumer data.
For email marketers, CCPA/CPRA differs from GDPR in several important ways. According to HubSpot’s marketing research, a large majority of marketers now collect data from California residents, making CCPA/CPRA compliance functionally mandatory for most businesses with a US audience.
The key CCPA/CPRA obligations for email marketers include providing a clear “Do Not Sell or Share My Personal Information” link, responding to consumer data requests within 45 days, maintaining a privacy policy that discloses all categories of personal information collected, and never retaliating against consumers who exercise their rights (for example, by charging them higher prices or providing degraded service).
CPRA also introduced the concept of “sensitive personal information,” which includes precise geolocation, race, religion, and health data. If your email segmentation uses any of these categories, consumers have the right to limit how that data is used.
CASL is Canada’s Anti-Spam Legislation, and it differs from CAN-SPAM in one decisive way: it requires express or implied consent before you send the first commercial electronic message, rather than allowing an opt-out model. It is widely considered the most stringent email marketing law in North America.
CASL recognizes two types of consent:
Every commercial electronic message under CASL must include the sender’s name and contact information (mailing address plus phone number, email, or web address), a clear statement of purpose, and a functioning unsubscribe mechanism. Unsubscribe requests must be processed within 10 business days. Penalties for CASL violations reach up to $10 million CAD per violation for businesses and $1 million CAD for individuals.
At a glance, the four laws split into two consent philosophies: CAN-SPAM and CCPA/CPRA are opt-out regimes, while GDPR and CASL are opt-in regimes that require consent before the first message. The table below summarizes the consent model, who is protected, and the ceiling on penalties so you can see where your program needs the most attention.
The practical lesson is simple: build your program to the strictest common denominator. If you default to opt-in consent, honor unsubscribe requests instantly, and keep consent records, you satisfy CAN-SPAM and CCPA automatically while also meeting GDPR and CASL. One high standard removes the need to track which subscriber falls under which law.
A complete compliance checklist covers consent capture, unsubscribe handling, sender identification, data rights, and list hygiene across all four laws. Use the checklist below to audit your email marketing program. If you can check every box, your program meets the highest global standard.
The most common violations are sending without valid consent, broken or missing unsubscribe mechanisms, ignoring opt-out and data requests, and using deceptive sender details. Understanding what other companies have gotten wrong helps you avoid repeating their mistakes. Here are the patterns that trigger enforcement actions most often:
Sending without valid consent (GDPR/CASL). This is the most frequent violation in GDPR enforcement. Companies that inherited email lists from acquisitions, scraped addresses from websites, or assumed consent from a business card exchange have all faced penalties. The burden of proof lies with the sender: if you cannot produce evidence of consent for a specific subscriber, you are in violation.
Missing or broken unsubscribe mechanisms. Under all four laws, the unsubscribe process must work reliably. Links that lead to error pages, require a login to complete, or redirect subscribers through multiple steps have all triggered enforcement. Usability research from the Nielsen Norman Group on form and interaction design shows that friction-heavy flows push users toward abandonment, which in the unsubscribe context means more spam complaints instead of clean opt-outs. Google and Yahoo’s 2024 sender requirements now mandate one-click List-Unsubscribe support, adding a technical requirement on top of the legal one.
Failing to honor opt-out requests promptly. Continuing to send emails after a subscriber unsubscribes is a violation under every major regulation. Even a single email sent after an unsubscribe request constitutes a violation. Across the industry, delayed unsubscribe processing is one of the top drivers of spam complaints, which compounds the legal risk with deliverability damage.
Ignoring data subject access requests. Under GDPR and CCPA, failing to respond to a consumer’s request for their data within the mandated timeframe (30 days for GDPR, 45 days for CCPA) is itself a violation, separate from any underlying data handling issues.
Using deceptive sender information or subject lines. CAN-SPAM explicitly prohibits misleading headers and subject lines. Using a personal name as the sender when the email is from a company, or subject lines that imply urgency that does not exist, both fall under this category.
Mailsoftly helps you stay compliant by making the compliant behavior the default: built-in double opt-in, one-click unsubscribe with List-Unsubscribe headers, automatic suppression, address injection, and one-click data export or deletion. Email marketing compliance should not require a legal team for every campaign.
Built-in double opt-in. Every new subscriber goes through a confirmation step that creates an auditable consent record. The timestamp, source form, and IP address are logged automatically, giving you the evidence GDPR requires without any manual tracking.
One-click unsubscribe with List-Unsubscribe header. Every email sent through Mailsoftly includes both a visible unsubscribe link in the footer and the List-Unsubscribe header that Gmail, Yahoo, and Apple Mail use to surface their native unsubscribe buttons. Opt-out requests are processed instantly and synced across all lists.
Automatic suppression management. When a subscriber unsubscribes, bounces, or files a complaint, they are added to a global suppression list that prevents any future sends. This applies across all campaigns and automations, eliminating the risk of accidentally emailing someone who has opted out.
Physical address injection. Your business address is configured once in account settings and automatically inserted into every email footer. No risk of forgetting to include it in a rushed campaign.
Data export and deletion tools. When a subscriber exercises their right to access or erasure, Mailsoftly provides one-click data export and permanent deletion directly from the contact record. This keeps your response time well within the 30-day GDPR and 45-day CCPA windows.
Mailsoftly’s free plan includes all compliance features at no cost (as of 2026-10-18): 500 contacts and 2,000 emails per month with your Gmail, Outlook, Google Workspace or Microsoft 365 account, with full access to double opt-in, suppression management, and data handling tools. There is no compliance paywall. The Starter plan is $15 a month (billed yearly, or $19 month to month) for 1,000 contacts and 10,000 emails, and lets you send from your own domain.
For the broader picture on this topic, see our complete Email Deliverability & Authentication guide, which covers strategy, fundamentals, and advanced playbooks.
Yes. CAN-SPAM applies to any commercial email that is sent to a recipient in the United States, regardless of where the sender is located. If you have US subscribers on your list, you must comply with all seven CAN-SPAM requirements. The FTC has jurisdiction over messages received in the US, not messages sent from the US.
Not always. GDPR allows a “soft opt-in” exception for existing customers under the legitimate interest legal basis, but only for marketing related to products or services they have already purchased. You must still provide an easy opt-out in every email, and you must have offered the option to object at the point of data collection. For marketing unrelated to their purchase, separate explicit consent is required.
CAN-SPAM uses an opt-out model: you can send commercial email to anyone as long as you include an unsubscribe mechanism and honor opt-out requests. CASL uses an opt-in model: you need express or implied consent before sending the first message. CASL is significantly more restrictive and carries higher penalties per violation.
No, not safely. Under CAN-SPAM alone, technically yes, because the law does not require prior consent. However, this violates GDPR, CASL, and most email service providers’ terms of service. Purchased lists also contain spam traps and invalid addresses that destroy your sender reputation. No legitimate email marketing strategy relies on purchased lists, and every compliance framework beyond CAN-SPAM explicitly prohibits them.
For as long as you process the person’s data, plus a buffer afterward. GDPR does not specify a fixed retention period for consent records, but it requires you to be able to demonstrate valid consent for as long as you are processing that individual’s data. In practice, retain consent records for the entire duration of the subscriber relationship and for a reasonable period after (most legal advisors recommend at least three years post-unsubscribe to cover the statute of limitations for regulatory actions).
Ready to switch?Start free with Mailsoftly →
500 contacts, 2,000 emails per month. Free hands-on migration. No credit card.
Ready to boost your email marketing?
Send beautiful, targeted emails that convert. Free plan available, paid plans from $15 a month.
Try Mailsoftly FreeNo credit card required
