Email Compliance: GDPR, PECR, CAN-SPAM and CASL (2026)

#01Which law applies?

Our view: if you send to a global list, design to the strictest regime that covers a meaningful share of recipients and record the legal basis per contact. It is cheaper than running four separate programs.

#02What does GDPR add?

GDPR applies to the personal data in your list, including named work addresses like anna.schmidt@company.example.

• Lawful basis. Consent (Art. 6(1)(a)) or legitimate interests (Art. 6(1)(f)) are typical. Where ePrivacy law requires consent for the email itself, legitimate interests cannot replace it.
• Transparency. Your privacy notice must say what you do with the data and where it came from, including enrichment tools.
• Right to object. People can object to direct marketing at any time, and you must stop.
• Records. Keep proof of consent: what was shown, when, and how.
• Processors. Your ESP is a processor. Sign its data processing agreement and check where data is stored and transferred.

#03How does the soft opt-in work?

You may send marketing email without fresh consent when all of these are true (EU and UK framing):

1. You got the person's details during a sale or negotiations for a sale of your product or service.
2. You market your own similar products or services.
3. You offered a simple way to refuse at collection.
4. You offer an opt-out in every message.

A free trial signup is commonly treated as "negotiations for a sale" in UK guidance, but check national interpretation in the EU. A webinar registration for a partner's event is not a soft opt-in for you.

UK update: the ICO's summary of the Data (Use and Access) Act 2025 describes a charity soft opt-in for electronic mail that furthers charitable purposes. It applies to details collected on or after 5 February 2026, with an opt-out at collection and in every message. Published summaries also say PECR maximum fines were raised toward UK GDPR levels from that date. Confirm the current cap on the ICO site before you quote a number.

#04What does CAN-SPAM require?

The FTC's maximum civil penalty is \$53,088 per violating email. The September 2026 Federal Register notice made no 2026 inflation adjustment.

#05What about CASL?

CASL covers commercial electronic messages sent to or from Canadian computers. You need:

• Consent. Express (they agreed) or implied (for example, an existing business relationship within limited time windows, or a published business address with no "no spam" statement and a message relevant to their role).
• Identification. Who is sending and on whose behalf, with contact details.
• Unsubscribe. Functional and processed within 10 business days.

Implied consent expires, so track the date it started.

#06What do mailbox providers add?

Even where law is relaxed, Gmail and Yahoo require bulk senders to provide one-click unsubscribe (RFC 8058) plus a visible link, and to honour unsubscribes within 48 hours (Gmail) or 2 days (Yahoo). Microsoft requires an easy-to-find unsubscribe for high-volume senders. Lesson 5 covers the technical side.

#07How do you build a compliance checklist?

1. Map recipients by country. Most ESPs can segment by IP-derived country or form field.
2. Assign a legal basis per contact: consent, soft opt-in, corporate subscriber (UK), legitimate interest (cold, where allowed), CASL implied or express.
3. Store proof: source, timestamp, consent wording, form URL.
4. Standardise the footer: company name, postal address, why they are receiving it, unsubscribe and preference links.
5. Set unsubscribe processing to immediate in the ESP and sync opt-outs to the CRM and sales tools within an hour.
6. Maintain a global suppression list shared by ESP, CRM sequences and outbound tools.
7. Review vendors: DPAs with ESPs and enrichment tools, and contractual rules for agencies.
8. Re-check twice a year: laws and guidance change.

#08Worked example: Ledgerline

Ledgerline is a fictional accounts-payable software company. Figures are illustrative, not benchmarks.

Ledgerline has 42,000 contacts (illustrative): 50% US, 30% EU (mostly Germany and the Netherlands), 15% UK and 5% Canada. Nobody knows the legal basis for 9,000 of them, imported from a trade show three years ago.

Walkthrough

1. Segment by country using the CRM country field, falling back to the company domain's country.
2. Assign bases. Trial signups get soft opt-in where national guidance allows; newsletter signups get consent; UK company addresses get corporate subscriber status; US contacts get CAN-SPAM opt-out.
3. Quarantine the unknowns. The 9,000 trade-show contacts are excluded from marketing. EU and UK records among them are deleted after a review with counsel. US records receive one re-permission email with a clear opt-in button; non-responders are suppressed.
4. Fix the footer with Ledgerline's postal address, a reason line ("You signed up for the AP newsletter") and a preference centre.
5. Fix sync. The ESP pushes unsubscribes to the CRM in real time, and the CRM pushes them to the SDR tool every 15 minutes.

#09Common mistakes

• Treating CAN-SPAM as the global standard.
• Using legitimate interests to justify EU marketing email where consent is required.
• Assuming a trade-show badge scan is consent for marketing.
• Unsubscribes that reach the ESP but not the CRM or SDR tools.
• Missing postal address in a US-bound footer.

#10Try it yourself

Export contacts with country and source. Build a table: country, count, legal basis, proof stored (yes or no). Pick the largest "no proof" group and write a remediation plan with a deadline.

#11Quick quiz

1. What is the CAN-SPAM opt-out deadline? Answer: 10 business days, but mailbox providers require 48 hours to 2 days for bulk senders.

2. Can UK companies email corporate subscribers without consent? Answer: Yes, under PECR, with identification and an opt-out. UK GDPR still applies.

3. Name the four soft opt-in conditions. Answer: Details from a sale or negotiation, own similar products, opt-out at collection, opt-out in every message.

4. What should you do before quoting a PECR fine? Answer: Read the current cap on the ICO site. Do not quote a number from memory. The Act also added a charity soft opt-in from 5 February 2026.

#12What should you check before the next lesson?

• Legal basis recorded per contact.
• Footer includes identity, postal address and unsubscribe.
• Unsubscribes sync across all tools within an hour.
• Unknown-basis contacts are suppressed.

Previous: List building and lead magnets · Next: SPF, DKIM, DMARC and BIMI setup

Or return to the Email Marketing for Marketers track.

Related: Cold outbound email done compliantly · Gmail, Yahoo and Outlook sender requirements · GA4 Consent Mode v2

#13Common questions

Does CAN-SPAM require consent? No. CAN-SPAM is an opt-out law. It requires honest headers and subject lines, identification as an ad, a postal address and a working opt-out honoured within 10 business days.

Can I email UK business contacts without consent? Under PECR, marketing email to corporate subscribers (such as a company address) does not need consent, but you must identify yourself and offer an opt-out, and UK GDPR still applies to personal data like named work addresses.

What is the soft opt-in? An exception in EU and UK rules that lets you email existing customers about your own similar products if you got their details during a sale and offered an opt-out at collection and in every email.

How fast must I process unsubscribes? CAN-SPAM allows 10 business days, but Gmail and Yahoo require bulk senders to honour unsubscribes within 48 hours or 2 days. Treat 48 hours as your real limit.