# Email Compliance: GDPR, PECR, CAN-SPAM and CASL (2026)

> Email marketing law for B2B in 2026: consent, soft opt-in, B2B exemptions, opt-out deadlines and penalties under GDPR, PECR, CAN-SPAM and CASL.

Source: https://mentionx.ai/learn/email/email-compliance-gdpr-can-spam  
Author: Dipuck Jones, founder of MentionX  
Updated: 5 November 2026  
Level: Practitioner

**Email marketing law depends on where the recipient is, not where you are. In the EU, the ePrivacy rules (implemented nationally) require prior consent for marketing email to individuals, with a soft opt-in for existing customers, and GDPR governs the personal data. The UK's PECR is similar but lets you email corporate subscribers without consent. The Data (Use and Access) Act 2025 added a charity soft opt-in. Confirm the current PECR fine cap on the ICO site before you quote a number. The US CAN-SPAM Act is opt-out based, with a maximum civil penalty of \$53,088 per email. Canada's CASL requires express or implied consent. On top of law, Gmail and Yahoo require bulk senders to honour unsubscribes within 48 hours or 2 days, which is now the practical deadline everywhere.**

> **Key takeaways**
>
> - Decide the legal basis per country and per stream, and record it per subscriber.
> - Every marketing email needs sender identification, a postal address in the US and a working opt-out.
> - The soft opt-in covers existing customers for similar products only, with an opt-out offered at collection.
> - Mailbox-provider rules (48 hours for unsubscribes) are stricter than CAN-SPAM's 10 business days.

*Checked 5 November 2026 (CET) against the FTC's CAN-SPAM compliance guide, the Federal Register civil penalty notice of 15 September 2026, the ICO's PECR guidance and Data (Use and Access) Act updates, the GDPR text and the Government of Canada's CASL pages cited in Sources. This is not legal advice. National rules vary; confirm with counsel. Ledgerline is a fictional company used for illustration.*

## Which law applies?

| Recipient in | Main rules | Default for B2B marketing email |
|---|---|---|
| EU (for example Germany, France) | National ePrivacy laws plus GDPR | Consent, unless soft opt-in applies; some countries treat business addresses more leniently, many do not |
| Germany specifically | UWG §7 plus GDPR | Prior express consent; double opt-in as proof is the practical standard |
| UK | PECR plus UK GDPR, amended by the Data (Use and Access) Act 2025 | Corporate subscribers: no consent needed, opt-out required. Sole traders and partnerships: treated as individuals |
| US | CAN-SPAM | No consent needed; strict honesty and opt-out rules |
| Canada | CASL | Express or implied consent, identification, unsubscribe |

*Our view:* if you send to a global list, design to the strictest regime that covers a meaningful share of recipients and record the legal basis per contact. It is cheaper than running four separate programs.

## What does GDPR add?

GDPR applies to the personal data in your list, including named work addresses like `anna.schmidt@company.example`.

- **Lawful basis.** Consent (Art. 6(1)(a)) or legitimate interests (Art. 6(1)(f)) are typical. Where ePrivacy law requires consent for the email itself, legitimate interests cannot replace it.
- **Transparency.** Your privacy notice must say what you do with the data and where it came from, including enrichment tools.
- **Right to object.** People can object to direct marketing at any time, and you must stop.
- **Records.** Keep proof of consent: what was shown, when, and how.
- **Processors.** Your ESP is a processor. Sign its data processing agreement and check where data is stored and transferred.

## How does the soft opt-in work?

You may send marketing email without fresh consent when all of these are true (EU and UK framing):

1. You got the person's details during a sale or negotiations for a sale of your product or service.
2. You market your own similar products or services.
3. You offered a simple way to refuse at collection.
4. You offer an opt-out in every message.

A free trial signup is commonly treated as "negotiations for a sale" in UK guidance, but check national interpretation in the EU. A webinar registration for a partner's event is not a soft opt-in for you.

**UK update:** the ICO's summary of the Data (Use and Access) Act 2025 describes a charity soft opt-in for electronic mail that furthers charitable purposes. It applies to details collected on or after 5 February 2026, with an opt-out at collection and in every message. Published summaries also say PECR maximum fines were raised toward UK GDPR levels from that date. Confirm the current cap on the ICO site before you quote a number.

## What does CAN-SPAM require?

| Requirement | What to do |
|---|---|
| No false or misleading header information | From, To and Reply-To must identify your business |
| No deceptive subject lines | Subject must reflect the content |
| Identify the message as an ad | Clear and conspicuous, unless the recipient consented |
| Tell recipients where you are | Valid physical postal address |
| Tell recipients how to opt out | Clear opt-out that works for at least 30 days after sending |
| Honour opt-outs promptly | Within 10 business days; do not sell or transfer the address |
| Monitor others acting for you | You are liable for agencies and vendors who send for you |

The FTC's maximum civil penalty is \$53,088 per violating email. The September 2026 Federal Register notice made no 2026 inflation adjustment.

## What about CASL?

CASL covers commercial electronic messages sent to or from Canadian computers. You need:

- **Consent.** Express (they agreed) or implied (for example, an existing business relationship within limited time windows, or a published business address with no "no spam" statement and a message relevant to their role).
- **Identification.** Who is sending and on whose behalf, with contact details.
- **Unsubscribe.** Functional and processed within 10 business days.

Implied consent expires, so track the date it started.

## What do mailbox providers add?

Even where law is relaxed, Gmail and Yahoo require bulk senders to provide one-click unsubscribe (RFC 8058) plus a visible link, and to honour unsubscribes within 48 hours (Gmail) or 2 days (Yahoo). Microsoft requires an easy-to-find unsubscribe for high-volume senders. Lesson 5 covers the technical side.

## How do you build a compliance checklist?

1. **Map recipients by country.** Most ESPs can segment by IP-derived country or form field.
2. **Assign a legal basis per contact:** consent, soft opt-in, corporate subscriber (UK), legitimate interest (cold, where allowed), CASL implied or express.
3. **Store proof:** source, timestamp, consent wording, form URL.
4. **Standardise the footer:** company name, postal address, why they are receiving it, unsubscribe and preference links.
5. **Set unsubscribe processing** to immediate in the ESP and sync opt-outs to the CRM and sales tools within an hour.
6. **Maintain a global suppression list** shared by ESP, CRM sequences and outbound tools.
7. **Review vendors:** DPAs with ESPs and enrichment tools, and contractual rules for agencies.
8. **Re-check twice a year:** laws and guidance change.

> **Pro move:** run a monthly "unsubscribe fire drill". Unsubscribe a test address from a marketing email, then check that it is suppressed in the ESP, the CRM, every SDR sequencing tool and any outbound platform within an hour. Most compliance failures are sync failures.

## Worked example: Ledgerline

*Ledgerline is a fictional accounts-payable software company. Figures are illustrative, not benchmarks.*

Ledgerline has 42,000 contacts (illustrative): 50% US, 30% EU (mostly Germany and the Netherlands), 15% UK and 5% Canada. Nobody knows the legal basis for 9,000 of them, imported from a trade show three years ago.

### Walkthrough

1. **Segment by country** using the CRM country field, falling back to the company domain's country.
2. **Assign bases.** Trial signups get soft opt-in where national guidance allows; newsletter signups get consent; UK company addresses get corporate subscriber status; US contacts get CAN-SPAM opt-out.
3. **Quarantine the unknowns.** The 9,000 trade-show contacts are excluded from marketing. EU and UK records among them are deleted after a review with counsel. US records receive one re-permission email with a clear opt-in button; non-responders are suppressed.
4. **Fix the footer** with Ledgerline's postal address, a reason line ("You signed up for the AP newsletter") and a preference centre.
5. **Fix sync.** The ESP pushes unsubscribes to the CRM in real time, and the CRM pushes them to the SDR tool every 15 minutes.

## Common mistakes

- Treating CAN-SPAM as the global standard.
- Using legitimate interests to justify EU marketing email where consent is required.
- Assuming a trade-show badge scan is consent for marketing.
- Unsubscribes that reach the ESP but not the CRM or SDR tools.
- Missing postal address in a US-bound footer.

## Try it yourself

Export contacts with country and source. Build a table: country, count, legal basis, proof stored (yes or no). Pick the largest "no proof" group and write a remediation plan with a deadline.

## Quick quiz

**1. What is the CAN-SPAM opt-out deadline?**
*Answer:* 10 business days, but mailbox providers require 48 hours to 2 days for bulk senders.

**2. Can UK companies email corporate subscribers without consent?**
*Answer:* Yes, under PECR, with identification and an opt-out. UK GDPR still applies.

**3. Name the four soft opt-in conditions.**
*Answer:* Details from a sale or negotiation, own similar products, opt-out at collection, opt-out in every message.

**4. What should you do before quoting a PECR fine?**
*Answer:* Read the current cap on the ICO site. Do not quote a number from memory. The Act also added a charity soft opt-in from 5 February 2026.

## What should you check before the next lesson?

- Legal basis recorded per contact.
- Footer includes identity, postal address and unsubscribe.
- Unsubscribes sync across all tools within an hour.
- Unknown-basis contacts are suppressed.

Previous: [List building and lead magnets](https://mentionx.ai/learn/email/email-list-building-lead-magnets) · Next: [SPF, DKIM, DMARC and BIMI setup](https://mentionx.ai/learn/email/email-authentication-spf-dkim-dmarc-bimi)

Or return to the [Email Marketing for Marketers track](https://mentionx.ai/learn/email/email-marketing-for-marketers).

Related: [Cold outbound email done compliantly](https://mentionx.ai/learn/email/email-cold-outbound-compliant) · [Gmail, Yahoo and Outlook sender requirements](https://mentionx.ai/learn/email/email-sender-requirements-gmail-yahoo-outlook) · [GA4 Consent Mode v2](https://mentionx.ai/learn/ga4/ga4-consent-mode-v2-basic-advanced)

## Common questions

**Does CAN-SPAM require consent?** No. CAN-SPAM is an opt-out law. It requires honest headers and subject lines, identification as an ad, a postal address and a working opt-out honoured within 10 business days.

**Can I email UK business contacts without consent?** Under PECR, marketing email to corporate subscribers (such as a company address) does not need consent, but you must identify yourself and offer an opt-out, and UK GDPR still applies to personal data like named work addresses.

**What is the soft opt-in?** An exception in EU and UK rules that lets you email existing customers about your own similar products if you got their details during a sale and offered an opt-out at collection and in every email.

**How fast must I process unsubscribes?** CAN-SPAM allows 10 business days, but Gmail and Yahoo require bulk senders to honour unsubscribes within 48 hours or 2 days. Treat 48 hours as your real limit.

## Sources

- FTC, [CAN-SPAM Act: a compliance guide for business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)
- eCFR, [16 CFR 1.98 Adjustment of civil monetary penalty amounts](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-A/part-1/subpart-L/section-1.98)
- ICO, [Guide to PECR: electronic and telephone marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/)
- ICO, [Data (Use and Access) Act 2025 guidance](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/)
- EUR-Lex, [GDPR (Regulation 2016/679)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- Government of Canada, [Canada's anti-spam legislation](https://ised-isde.canada.ca/site/canada-anti-spam-legislation/en)
- Gmail Help, [Email sender guidelines](https://support.google.com/mail/answer/81126)
- All accessed 5 Nov 2026.

## Frequently asked questions

### Does CAN-SPAM require consent?

No. CAN-SPAM is an opt-out law. It requires honest headers and subject lines, identification as an ad, a postal address and a working opt-out honoured within 10 business days.

### Can I email UK business contacts without consent?

Under PECR, marketing email to corporate subscribers (such as a company address) does not need consent, but you must identify yourself and offer an opt-out, and UK GDPR still applies to personal data like named work addresses.

### What is the soft opt-in?

An exception in EU and UK rules that lets you email existing customers about your own similar products if you got their details during a sale and offered an opt-out at collection and in every email.

### How fast must I process unsubscribes?

CAN-SPAM allows 10 business days, but Gmail and Yahoo require bulk senders to honour unsubscribes within 48 hours or 2 days. Treat 48 hours as your real limit.

---

Written and reviewed by Dipuck Jones for MentionX Learn. The HTML version of this page: https://mentionx.ai/learn/email/email-compliance-gdpr-can-spam