A single non-compliant email can cost you up to $53,088 under the CAN-SPAM Act alone, and that’s before GDPR, CASL, or your state’s privacy law get involved. Here’s what each one actually requires, and how to meet every legal requirement for email marketing without a law degree.
Key takeaways:
- The legal requirements for email marketing come from at least four sets of email marketing laws depending on your subscriber list: CAN-SPAM (US), GDPR (EU/UK), CASL (Canada), and a growing list of state privacy laws.
- CAN-SPAM’s maximum civil penalty is $53,088 per non-compliant email, set by the FTC’s inflation adjustment effective January 2025.
- The FTC’s largest CAN-SPAM settlement to date is $2.95 million, against a company that sent over 30 million commercial emails without a working opt-out.
- You have 10 business days to honor an unsubscribe request under CAN-SPAM, and your opt-out link has to stay functional for at least 30 days after each send.
- CAN-SPAM is an opt-out law; GDPR and CASL are opt-in laws. Sending the same campaign to a US list and a Canadian list can mean two different consent requirements.
- Legal compliance and deliverability aren’t the same thing. You can meet every legal requirement and still land in spam if your content mix, image ratio, or send frequency work against you.
What are the legal requirements for email marketing?
The legal requirements for email marketing are: an honest, non-misleading subject line, a valid physical mailing address, accurate sender information, and a working unsubscribe link you honor within 10 business days.
Depending on where your subscribers live, you may also need documented opt-in consent before you send anything, which is the case under GDPR and CASL. Most guides treat the US baseline and the international consent rules as two separate topics. In practice, they’re one checklist to run through before every send, and which parts apply to you depends entirely on your subscribers’ location.
Email marketing laws by region: which ones apply to your list
Which of these email marketing laws applies to you depends entirely on where your subscribers live, not where your business is registered.
| Law | Who it covers | Consent model | Penalty ceiling | Distinguishing requirement |
| CAN-SPAM | US recipients | Opt-out | $53,088 per email | No prior consent needed to send a first email |
| GDPR | EU/UK recipients | Opt-in | Up to 4% of global annual revenue or €20 million | Requires a documented lawful basis before sending |
| CASL | Canadian recipients | Opt-in | Up to $10 million CAD per violation | Consent must be express or implied under narrow conditions |
| State privacy laws | Varies by state (e.g., California, Colorado, Virginia) | Varies | Varies by state | Grants recipients the right to know what data you hold and to request deletion |
CAN-SPAM Act (email marketing law in the United States)
The CAN-SPAM Act doesn’t require permission before you send a first commercial email to a US address. What it requires instead is honesty and an easy way out: accurate header information, a non-deceptive subject line, a valid physical postal address, and a clear unsubscribe mechanism you have to honor within 10 business days. It applies to B2B email just as much as B2C. The FTC has said plainly that the law makes no exception for business-to-business messages.
GDPR (EU and UK subscribers)
If your list includes anyone in the EU or UK, GDPR shifts the entire model from opt-out to opt-in. You need a lawful basis, usually explicit consent, before you send anything, and you have to be able to show when and how that consent was collected.
There are two narrower exceptions worth knowing. B2B email to a named contact at a company can sometimes rely on “legitimate interest” instead of consent. And in the UK specifically, PECR‘s “soft opt-in” lets you email existing customers about similar products without fresh consent, as long as you gave them a clear opt-out when you first collected their details.
GDPR also gives subscribers the right to request a copy of their data or ask you to delete it, which means your email platform needs a way to actually locate and remove someone’s records, not just unsubscribe them from future sends.
CASL (Canada’s anti-spam law)
Canada’s Anti-Spam Legislation is one of the stricter regimes in the world. It requires express or implied consent before you send, identification information in every message, and an unsubscribe mechanism that works immediately, not within a grace period. Penalties can reach $10 million CAD per violation, which makes CASL worth taking seriously even if Canadian subscribers are a small slice of your list.
State privacy laws (CCPA/CPRA and newer state laws)
State-level privacy laws don’t regulate email sending directly the way CAN-SPAM does, but they regulate the data behind your list. As of 2026, around 20 US states, including California (CCPA/CPRA), Colorado, Connecticut, and Virginia, have their own comprehensive privacy laws, with Indiana, Kentucky, and Rhode Island the newest additions, effective January 2026. These laws give recipients the right to know what personal data you’ve collected, opt out of its sale, and request deletion. If a subscriber invokes that right, you need a process for finding and removing their information across your entire email platform, not just your active list.
The 7 email marketing requirements every campaign must meet
Regardless of which laws apply to your list, these seven requirements cover the ground CAN-SPAM, GDPR, and CASL all care about in some form. Meet all seven and you’ve handled the overwhelming majority of what gets a business in trouble, whether the fine comes from the FTC, an EU regulator, or Canada’s CRTC.
1. Accurate header and sender information
The “From,” “To,” and routing information in your email has to accurately identify the person or business that sent it. Using a domain name or email address you don’t have the right to use, even to make a promotional email look more personal, is itself a CAN-SPAM violation.
2. Honest, non-deceptive subject lines
Your subject line has to reflect the actual content of the message. A subject line like “Re: your account” on a promotional email you’re sending cold is the kind of deception the FTC treats as a violation on its own, independent of anything else in the email.
3. A physical postal address
Every commercial email needs a valid physical postal address. This can be your current street address, a post office box registered with the USPS, or a private mailbox registered with a commercial mail-receiving agency. A missing address is one of the most common reasons the FTC cites in enforcement actions.
If you’re using SiteGround Email Marketing, you’ll need to add your business address to your template yourself.
4. A clear, working one-click unsubscribe link
Recipients need an obvious, functioning way to opt out, and that mechanism has to keep working for at least 30 days after you send (60 for CASL).
SiteGround Email Marketing includes a working unsubscribe link in every email automatically, so this one’s handled without any setup on your end.
5. Processing opt-outs within 10 business days
Once someone unsubscribes, you have 10 business days to stop emailing them under both CAN-SPAM and CASL. Under CAN-SPAM specifically, you also can’t sell or transfer their address to anyone else once they’ve opted out. GDPR doesn’t set a fixed deadline, but requires you to honor the withdrawal “without undue delay,” so treat 10 business days as the outside limit, not the standard, if any EU or UK subscribers are on your list.
SiteGround Email Marketing processes opt-outs immediately, so there’s no delay to track manually.
6. Consent and record-keeping (GDPR/CASL specifics)
For any subscriber under GDPR or CASL, you need to be able to show when and how they consented, not just that they’re currently on your list. That means storing timestamps, the specific opt-in method used, and the exact language they agreed to, since “we’ve always had them on the list” isn’t a defense under either law.
7. Distinguishing ads from other messages, where required
Some jurisdictions require commercial messages to be clearly identifiable as advertising, separate from transactional or relationship emails like receipts and password resets. Mixing promotional content into a transactional email can pull that message under commercial-email rules it wouldn’t otherwise be subject to. Getting your double opt-in process right from the start makes this distinction easier to maintain, since you’re not retrofitting consent records after the fact.
TL;DR: What this means for you
| Requirement | Automation | Your responsibility |
| Unsubscribe mechanism | Automated by some ESPs (email service providers), including SiteGround Email Marketing | Verify it works and stays live 30 days (60 for CASL) if your platform doesn’t confirm this, or test regularly regardless |
| Opt-out processing | Automatic and immediate with SiteGround Email Marketing | Confirm your platform processes opt-outs within 10 business days, or build a manual process if not |
| Physical postal address | None | Add your business address to your template yourself, regardless of platform |
| Consent management (GDPR) | A named feature on some platforms, confirmed for SiteGround Email Marketing via its own documentation | Confirm whether your platform logs timestamp, opt-in method, and consent language, since GDPR requires being able to prove this |
| Consent logging (CASL) | Not confirmed as automated on any specific platform in this research | Keep your own log of timestamp, method, and language for Canadian subscribers |
| Sender info, subject lines, physical address | Not automatable, this is content you write | Accurate and honest on every send, regardless of platform |
| Documented consent (EU, UK, Canada) | Not automatable, this is a record you keep | Proof of when and how each subscriber opted in |
What happens if you break these email marketing laws (real penalty figures)
The FTC’s maximum CAN-SPAM penalty is $53,088 per non-compliant email, not per campaign. Send one broken unsubscribe link to 10,000 addresses, and that’s 10,000 separate violations, not one mistake.
In practice, the FTC rarely goes for the theoretical maximum. Two real cases show what actually happens:
- $2.95 million: a company sent over 30 million commercial emails without honoring opt-outs or including a physical address.
- $650,000: a company disguised marketing emails as account notifications, again over a missing working opt-out.
Neither case involved proof of bad intent. A broken link and an outdated template were enough.
This is also why cleaning your list regularly matters beyond deliverability: bad data is what turns one small mistake into thousands of separate violations.
Opt-in vs. opt-out: which laws require which consent model
Not every law treats permission the same way. Some let you email first and ask forgiveness later; others require a yes before you send anything at all.
| Law | Consent model | What it means in practice |
| CAN-SPAM (US) | Opt-out | You can send a first commercial email without permission, as long as you honor opt-outs promptly and meet every other requirement. |
| GDPR (EU/UK) | Opt-in | You need documented consent before you send anything. |
| CASL (Canada) | Opt-in | Same as GDPR: consent has to come first, and you need to be able to prove it. |
If your list spans multiple regions, apply the stricter opt-in standard to everyone rather than segmenting by region. It’s simpler to manage than running separate consent processes per country, and since GDPR and CASL are both stricter than CAN-SPAM, meeting their bar automatically covers you under CAN-SPAM too.
Understanding why people unsubscribe also helps you spot when a consent problem, not a content problem, is driving your opt-out rate.
Four sending rules that keep subscribers engaged (and out of spam)
None of these sending rules are legal requirements, but ignore them and you can be fully compliant on paper and still watch your open rates drop and your emails land in spam anyway.
The 80/20 rule: balancing value and promotion
The 80/20 rule says roughly 80% of your email content should be genuinely useful to the reader, education, updates, or resources, with only about 20% direct promotion. This is a content-mix guideline, not a spam-filter rule: lists that get promotional email after promotional email tend to disengage and unsubscribe at a higher rate, which is what damages your sender reputation over time, not the ratio itself.
The 60/40 rule: why your text-to-image ratio affects deliverability
The 60/40 rule refers to keeping your email body at roughly 60% text and no more than 40% images. This one is a genuine deliverability lever: spam filters flag image-heavy emails with little text more aggressively, since that pattern historically correlates with spam. An email that’s almost entirely one large image is a common trigger for inbox providers to route a message to the promotions tab or spam folder.
Safe send frequency: how often is too often
There’s no single legal limit on how often you can email someone, but sending too frequently is the fastest way to trigger complaint rates that hurt your deliverability across your entire list, not just with one annoyed subscriber. A reasonable starting cadence for most small business lists is one to two emails per week, adjusted based on your unsubscribe and complaint rates rather than a fixed schedule. If you’re running cold email outreach alongside your list, the frequency math works differently since you’re not yet working with a warmed, consenting audience.
Gmail and Yahoo’s bulk sender rules
If you send 5,000 or more emails a day to Gmail or Yahoo addresses, there’s a fourth rule that isn’t a law but hits faster than one: authenticate your domain (SPF, DKIM, DMARC), add one-click unsubscribe headers to every marketing email, and keep your spam complaint rate under 0.3%, ideally under 0.1%. CAN-SPAM might fine you eventually. Gmail will just stop delivering your email next week.
A pre-send legal compliance checklist for legal email marketing
Before you hit send on any campaign, confirm:
- Your sender name and reply-to address are accurate and belong to your business.
- Your subject line matches the actual content of the email.
- A valid physical postal address appears somewhere in the email.
- Your unsubscribe link is visible, one-click, and tested.
- You have a process to honor opt-outs within 10 business days.
- Any EU, UK, or Canadian subscribers have documented, timestamped consent.
- Your list has been cleaned recently, since sending to invalid or complained-about addresses raises both legal and deliverability risk. Your email unsubscribe rate is a useful early signal that something on this list is off before it becomes an enforcement problem.
Stay compliant without hiring a lawyer
You don’t need a law degree to get this right. You need a platform that treats compliance as the default, not a plugin you have to remember to install.
Four laws, one small business, and about zero interest in reading legal text. That’s the actual math most people are working with. The good news: none of it requires memorizing statutes. It requires picking a process where the boring, easy-to-forget parts happen automatically instead of living on a sticky note.
Ready to send your next campaign without wondering if you missed something? Try SiteGround Email Marketing and get your first compliant send out the door in minutes.
[58]
Frequently asked questions about legal requirements for email marketing
The 80/20 rule in email marketing means about 80% of your email content should provide value to the reader, like tips, updates, or resources, and no more than 20% should be direct promotion. It’s a content-mix guideline aimed at keeping subscribers engaged, not a legal requirement.
The 60/40 rule for emails recommends keeping your email body at roughly 60% text and 40% or less images. Image-heavy emails with little text are more likely to get flagged by spam filters, so this ratio helps protect deliverability.
Yes, it is illegal for commercial emails sent to US recipients. CAN-SPAM requires a clear, working unsubscribe mechanism in every commercial email, and failing to include one is one of the most common reasons the FTC pursues enforcement action.
The 30/30/50 rule is a cold email outreach guideline suggesting roughly 30% of your effort go toward list building and targeting, 30% toward subject lines and personalization, and 50% toward the email body and offer itself. It’s a resource-allocation framework, not a legal standard.
The main federal law is CAN-SPAM, which requires accurate sender information, an honest subject line, a physical postal address, and a working unsubscribe option honored within 10 business days. On top of that, depending on where your subscribers live, state privacy laws like California’s CCPA/CPRA may also apply, giving recipients the right to know what data you’ve collected and request its deletion. CAN-SPAM applies nationwide regardless of state; state privacy laws are additional, not a replacement.