FREE PREVIEW · MODULE 1 · LESSON 1 · 20 MIN
Consent and the law: GDPR, PECR and CAN-SPAM basics
The rules that decide who you may email and how, explained for marketers rather than lawyers.
Email law differs by country, and it generally follows where your subscribers are, not just where your business is based. This lesson is a practical overview, not legal advice, so check the current rules with your regulator or a lawyer for your situation. In the EU, marketing email is governed by the ePrivacy rules together with the GDPR; in the UK, by PECR and the UK GDPR. For individuals, the default is that you need prior consent, and it must be freely given, specific, informed and unambiguous, given through a clear action such as ticking an empty box.
Several practical rules follow from that standard. Pre-ticked boxes do not count. Consent to marketing cannot be bundled into accepting your terms of service. The form must say what people will receive and who is sending it, and withdrawing consent must be as easy as giving it. You also need records: what the person agreed to, when, how and the exact wording they saw. UK and EU rules also allow a narrow exception, known in the UK as the soft opt-in, for customers who gave you their address during a sale (in the UK, also during negotiations for a sale), provided you offered an opt-out then and in every message, and only for your own similar products.
In the United States, the CAN-SPAM Act takes a different approach. It does not require prior consent for commercial email, but it sets rules for every message. Header information and the From name must not be misleading, subject lines must not be deceptive, you must include a valid physical postal address, and you must offer a clear way to opt out that keeps working for at least 30 days after sending. Opt-out requests must be honoured within 10 business days. Canada’s CASL, by contrast, is consent-based: it generally requires express or implied consent and has its own identification and unsubscribe rules.
The practical answer for most businesses is to meet the strictest standard everywhere: collect explicit opt-in consent, explain what subscribers will get, keep consent records, include your postal address and an easy unsubscribe in every marketing email, and process unsubscribes immediately. Never buy or rent lists, and do not add people you met at events or found on websites without their agreement. Beyond the legal risk, unconsented addresses produce spam complaints, bounces and spam trap hits that damage deliverability for your whole list, a cost that lands on every future campaign.
Example: a Bristol beer subscription separates customers from subscribers
Harbourside Hops, a craft beer subscription in Bristol, had 9,200 contacts in its email platform: 5,100 newsletter signups and 4,100 customers imported from the shop, whose checkout had never offered a marketing opt-out. Advised that those customers did not qualify for the soft opt-in, the team suppressed them from campaigns, added an unticked marketing box with clear wording at checkout, and put a card with a QR code linking to the signup page in every delivery box. Within two months, 1,350 of the imported customers had subscribed themselves. Campaigns now reached fewer people, but the spam complaint rate fell from 0.25 percent to 0.06 percent and monthly email revenue rose 12 percent, because the list was made of buyers who wanted the emails.
Illustrative example: the business, people and figures are fictional.Key takeaways
- Rules follow where your subscribers are; take legal advice for your specific situation
- EU and UK law generally require clear, recorded opt-in consent; US law requires honest messages and a working opt-out
- Meeting the strictest standard everywhere is simpler and protects deliverability
Exercise
List every signup form, checkout box and import source feeding your list. For each, write down the consent wording the subscriber saw, whether any box was pre-ticked, where consent records are stored, and whether every email includes your postal address and an unsubscribe link. Fix the weakest source first.
Continue with 11 more lessons, module quizzes and 3 downloads.
Build a permission-based list, write emails people want to click, improve inbox placement and measure what actually earns revenue. One payment of $89, lifetime access, 14-day refund policy.
See the full course