Compliance

CAN-SPAM (United States)

Requirements:

• Accurate header info (From, To, Reply-To)
• Non-deceptive subject lines
• Physical mailing address in every email
• Clear opt-out mechanism
• Honor opt-out within 10 business days

Transactional emails: Can send without opt-in if related to a transaction and not promotional.

GDPR (European Union)

Requirements:

• Explicit opt-in consent (not pre-checked boxes)
• Consent must be freely given, specific, informed
• Easy to withdraw consent (as easy as giving it)
• Right to access data and deletion (“right to be forgotten”)
• Process unsubscribe immediately

Consent records: Document who, when, how, and what they consented to.

Transactional emails: Can send based on contract fulfillment or legitimate interest.

CASL (Canada)

Consent types:

• Express consent: Explicit opt-in (ideal)
• Implied consent: Existing business relationship (2 years) or inquiry (6 months)

Requirements:

• Clear sender identification that will be valid for 60 days after send
• Unsubscribe functional for 60 days after send
• Process unsubscribe no later than 10 business days
• Keep consent records 3 years after expiration

Other Regions

Unsubscribe Requirements Summary

Universal best practices: Prominent link, one-click when possible, no login required, free, confirm action.

List-Unsubscribe Header (Required for Bulk Senders)

Gmail, Yahoo, and Microsoft require List-Unsubscribe headers. Without them, bulk emails may be rejected or spam-filtered.

Required headers:

Your unsubscribe endpoint must:

• Accept POST requests — return 200 or 202 with a blank page
• Display standard unsubscribe page for GET requests
• Stop sending within 48 hours of the request

Managing preferences vs Unsubscribe from all

Most legistlations require a one-click unsubscribe. Managing preferences is a nice-to-have and can lead to lower unsubscribe rate but doesn’t replace Unsubscribe. If possible, offer both.

Consent Management

Record:

• Email address
• Date/time of consent
• Method (form, checkbox)
• What they consented to
• Source (which page/form)

Storage: Database with timestamps, audit trail of changes, link to user account.

Data Retention

Best practice: Have clear retention policy, honor deletion requests promptly, review and clean regularly.

Privacy Policy Must Include

• What data you collect
• How you use data
• Who you share data with
• User rights (access, deletion)
• How to contact about privacy

International Sending

Best practice: Follow the most restrictive requirements (usually GDPR) to ensure compliance across all regions.

Related

• Email Capture - Implement consent forms and double opt-in
• Marketing Emails - Consent and unsubscribe requirements
• List Management - Handle unsubscribes and deletion requests