Email marketing and the law

The law that applies is the reader's, not yours: an email opened in Canada falls under Canada's law, wherever it was sent from. One set of habits meets all six of the big markets at once, so follow it everywhere. This is general guidance, not legal advice.

The short version

• Ask first, everywhere, and keep proof of every yes: when, where, and the words they saw. Only the US lets you email without asking, and mailbox providers reward asking everywhere.
• Existing customers can be emailed about similar products without a new yes in the UK and the EU, if you offered them a "no" when they gave the address and in every email since. In Canada that lasts two years from their last purchase.
• Say who you are: your business name, a postal address and one more way to reach you, in every marketing email.
• An unsubscribe in every email: free, one step, no login, no questions first. Act on it at once; the slowest legal limit is 10 business days.
• Keep the link and your details working for at least 60 days after every send.
• An honest from name, and a subject line that matches what's inside.
• A receipt stays a receipt. Lead with the transaction, or the law treats it as marketing.
• Never buy, rent or scrape a list. Its consent was never given to you.
• Sending for a client? Their name goes on the email, and both businesses are answerable.

Whose law applies

• Canada: any message opened on a computer in Canada.
• Australia: a message opened in Australia, or by someone who's there when they open it.
• New Zealand: messages sent to, from or within New Zealand.
• European Union: the GDPR covers a business anywhere that offers goods or services to people in the EU.

When you don't know a reader's country, apply the strictest rule. A country field on the sign-up form is the usual way to know.

The six markets side by side

The penalties are the most the law allows; real fines are set case by case.

One set of habits for every market

The US "advertisement" label is the one rule a permission list escapes: it doesn't apply when the reader agreed to the email.

Consent

In the EU and the UK, consent is an active choice. "Silence, pre-ticked boxes or inactivity should not therefore constitute consent" (the GDPR, Recital 32). You must be able to show it was given, ask for it apart from anything else on the form, in plain words, and make it "as easy to withdraw as to give".

A free guide in exchange for joining. Say plainly at sign-up that the guide comes with the emails. Regulators don't all read this point the same way.

The soft opt-in, in the UK and the EU. You may email a customer about your own similar products if you took the address in a sale, or in the UK also while negotiating one, such as a quote, and offered a free, simple "no" then and in every email since. Since 5 February 2026, UK charities have their own version for supporters.

Canada's implied consent runs on a clock: a purchase or contract within two years, an inquiry within six months. Ask for express consent before it runs out. An email asking for consent is itself a commercial message there, so it needs consent too.

Sensitive topics, such as health, religion, sexuality, ethnicity or politics, need explicit consent in the EU and the UK before you use them, even as a segment.

Collect only what you need, and at sign-up say who you are, how to reach you, and what the address is for.

Who you are, and the way out

• US: a valid postal address in every email: a street address, a registered PO box or a registered private mailbox. Honest From, Reply-To and routing details, and a subject line that reflects the content.
• Canada: your name, and your client's when you send for one; a mailing address; and a phone number, an email or a website. They may sit on a linked page if the email can't hold them.
• Australia and New Zealand: who's responsible and how to contact them, accurate for 30 days.
• The EU and the UK: never disguise or conceal the sender, and give a valid address for opting out.

The unsubscribe:

• It's in the email itself, in every market. The one-click button Gmail and Yahoo require sits on top of the link, never instead of it.
• It covers all your marketing, not one list. The US requires an option "to stop all marketing messages from you", and under the GDPR a person objects to direct marketing as a whole.
• No fee, no login, no reason required. A "why are you leaving?" question may follow the unsubscribe, never come before it.
• In the US, you may never sell or pass on the address of someone who's left.

Receipts and other service emails

• US: an email only about a transaction is exempt from most of CAN-SPAM. A mixed one counts as marketing if its subject line suggests an advert, or if the transaction doesn't come first.
• Canada: quotes, receipts, warranty, safety and account updates need no consent, but still need your details and an unsubscribe.
• Australia: purely factual messages need no consent or unsubscribe, but still need your details.
• New Zealand: a link to your website in the signature of an otherwise non-commercial email makes it commercial.

So a receipt leads with the receipt, says so in its subject line, and leaves the promotion for its own email.

Business-to-business email

• US: "The law makes no exception for business-to-business email."
• UK: the consent rule covers people, so a company's address can be emailed without consent. But sole traders and most partnerships count as people, the rules on saying who you are and offering a way out still apply, and a named person's work address is personal data.
• EU: each country decides how companies are protected. Check the country first.
• Canada, Australia and New Zealand: a work address counts only if it was published openly, with no "no marketing" note beside it, and the email fits the person's job. Canadian organisations that already have a relationship are outside the law for email about the receiving organisation's work.

A bought "B2B list" fails all of these.

Bought lists

Consent has to be given to the business that sends. Canada's request for consent must name who's asking, GDPR consent must be specific and shown, and New Zealand's regulator says a bought database needs consent for each address. Australia bans address-harvesting software and harvested lists outright, and the US treats harvesting as an aggravated offence that can bring criminal penalties.

A "do you still want to hear from us?" email isn't a way round it. It's for people whose consent is old or poorly recorded, never for addresses that never gave it.

Keep proof

The burden of proof is yours in Canada, New Zealand, Australia, the EU and the UK. For each consent, record:

• the address, and the date and time;
• where it was given: the form, the page, the event, the checkout;
• the exact words the person saw, including the label on the box;
• how: the confirmation click, if they confirmed;
• what they agreed to.

Record every unsubscribe and re-subscribe too, with when and how. A spoken yes counts in Canada and New Zealand if you write it down. Double opt-in makes the strongest record: a click from the inbox itself. No law sets how long to keep records, so keep them as long as the address is on any list, including the list of people who've left.

Sending for someone else

Every market holds the business behind an email answerable, not only the one that sends it. Canada wants the client named on the email, Australia who authorised it, and New Zealand accurate details of the business it's for. Under the GDPR, the business is the controller and a platform that sends for it is a processor, with a written contract between them. So an agency's emails for a client carry the client's name and address, and both are answerable.

When to ask a lawyer

Before mailing a new country at scale, before reviving an old list, when a regulator writes to you, or when you can't show consent for a large part of a list.

Doing it here

• Every email's footer carries your business name and postal address from your brand, a link to manage preferences and an unsubscribe link, and its legal lines stay in English: One brand, everywhere.
• Before a campaign launches, it checks that your brand has a postal address, and asks you if it can't find one.
• Every email carries the one-click unsubscribe headers. The footer's link takes effect once the person confirms, the mail app's own button at once, and either one covers all your lists: Unsubscribes, honoured everywhere.
• When someone asks to leave by phone, in a reply or face to face, take them off yourself in Unsubscribes: Handle unsubscribes.
• A form can ask people to confirm their address first. It's off until you switch it on: How a sign-up form fills your list.
• Your website's checkout can ask whether buyers would like your emails: Set up delivery and payments.
• Every list you upload needs the consent of everyone on it, and you confirm that as you upload it: Can I upload a list I bought?
• What stays yours: proof of consent for the lists you bring, your postal address, the words on your forms, and the law of each country you mail.