# Unsolicited email laws
Understanding international email marketing laws is essential for compliant cold email operations. Different jurisdictions have different requirements, and non-compliance can result in significant penalties. This lesson covers the major email marketing laws including CAN-SPAM, GDPR, CASL, and how to comply with these regulations.
Key Takeaways
- Laws vary significantly by jurisdiction
* - Consent requirements differ for B2B vs. B2C * - Always provide clear opt-out mechanisms * - Consult legal counsel for specific situations
CAN-SPAM Act (United States)
Overview
Scope:
- Applies to all commercial emails sent to US recipients
- Covers both B2B and B2C communications
- Enforced by the Federal Trade Commission (FTC)
- Penalties up to $50,120 per violation
Definition of commercial email:
- Any email whose primary purpose is advertising or promoting a commercial product or service
- Includes content that advertises or promotes
- Transactional or relationship content is exempt
Key requirements
Accurate header information:
- No misleading "From" names
- Accurate domain names
- Valid reply-to addresses
- No deceptive routing information
Subject line accuracy:
- Must accurately reflect content
- Cannot be misleading or deceptive
- Should clearly indicate commercial nature
Opt-out mechanism:
- Clear and conspicuous opt-out
- Must be easy to use
- Honor opt-outs within 10 business days
- No fees for opt-out
Physical address:
- Include valid physical postal address
- Can be PO Box or registered address
- Must be displayed conspicuously
Identification:
- Clearly identify as advertisement
- Include sender's identity
- No misleading content
CAN-SPAM compliance checklist
Before sending:
- Verify header accuracy
- Check subject line clarity
- Ensure opt-out mechanism works
- Include physical address
- Identify as advertisement
Ongoing requirements:
- Monitor opt-out requests
- Process within 10 business days
- Maintain suppression lists
- Honor all opt-outs
GDPR (European Union)
Overview
Scope:
- Applies to processing personal data of EU residents
- Covers B2B and B2C communications
- Extraterritorial reach (applies globally to EU data)
- Penalties up to €20 million or 4% of global revenue
Key principles:
- Lawful basis for processing
- Purpose limitation
- Data minimization
- Transparency
- Accountability
Legal bases for processing
Consent:
- Freely given, specific, informed, unambiguous
- Required for B2C marketing
- Must be explicit and revocable
- Cannot be bundled with other terms
Legitimate interest:
- May apply for B2B cold email
- Requires legitimate interest assessment
- Must balance with individual rights
- Not applicable for B2C marketing
Contract performance:
- Existing business relationship
- Pre-contractual negotiations
- Specific product/service inquiry
GDPR compliance requirements
Transparency:
- Clear privacy policy
- Purpose disclosure
- Data retention periods
- Contact information
Data subject rights:
- Right to access
- Right to rectification
- Right to erasure
- Right to object
Records of processing:
- Maintain processing records
- Document legal basis
- Track consent where applicable
- Retain documentation
GDPR for B2B cold email
Legitimate interest assessment:
- Clear business purpose
- Relevant to recipient's role
- Not excessive or intrusive
- Respect opt-out requests
Best practices:
- Target decision-makers
- Provide clear opt-out
- Minimize data collected
- Document legitimate interest
CASL (Canada)
Overview
Scope:
- Applies to commercial electronic messages
- Covers email, SMS, and other electronic messages
- Applies to messages sent to or from Canada
- Penalties up to $10 million per violation
Definition of CEM:
- Encourages participation in commercial activity
- Offers to purchase goods/services
- Advertises or promotes goods/services
Consent requirements
Express consent:
- Explicit opt-in
- Clear and specific
- Can be withdrawn anytime
- Required for most cases
Implied consent:
- Existing business relationship
- Published email address
- Inquiry about product/service
- Limited duration (2 years)
CASL compliance requirements
Identification:
- Clear sender identification
- Contact information
- Mailing address
- Unsubscribe mechanism
Opt-out mechanism:
- Easy to use
- Accessible at all times
- Process within 10 days
- No fees or barriers
Content requirements:
- Clear that it's a CEM
- Sender identification
- Contact information
- Unsubscribe mechanism
Other jurisdictions
UK (post-Brexit)
UK GDPR:
- Similar to EU GDPR
- UK-specific adaptations
- Same principles and requirements
- Enforced by ICO
PECR Regulations:
- Privacy and Electronic Communications
- Additional email marketing rules
- Consent requirements
- Cookie regulations
Australia
Spam Act 2003:
- Similar to CAN-SPAM
- Consent requirements
- Opt-out mechanism
- Enforced by ACMA
Other regions
General principles:
- Consent is increasingly required
- Opt-out mechanisms are mandatory
- Transparency is essential
- Penalties are significant
Research local laws:
- Always check local requirements
- Consult local legal counsel
- Maintain compliance documentation
- Stay updated on changes
Compliance framework
Compliance checklist
Before sending:
- Identify applicable laws
- Determine legal basis
- Verify consent requirements
- Set up opt-out mechanism
- Include required disclosures
Ongoing compliance:
- Monitor opt-outs
- Maintain suppression lists
- Update privacy policies
- Document compliance
- Regular audits
Documentation
Maintain records:
- Consent records where applicable
- Legitimate interest assessments
- Processing activities
- Opt-out requests
- Compliance audits
Retention policies:
- Keep records as required
- Secure storage
- Access controls
- Regular review
Common compliance issues
Consent challenges
B2B vs. B2C:
- Different requirements apply
- B2C almost always requires consent
- B2B may use legitimate interest
- Jurisdiction matters
Implied consent:
- Limited scope and duration
- Business relationship required
- Must be clearly established
- Not universal
Opt-out management
Implementation:
- Must be easy and accessible
- No barriers or fees
- Process promptly
- Maintain suppression lists
Best practices:
- One-click unsubscribe
- Global opt-out option
- Honor immediately
- Confirm processing
Data minimization
Collect only needed data:
- Name, email, company
- Job role if relevant
- Avoid unnecessary information
- Justify each data point
Purpose limitation:
- Use only for stated purpose
- Don't repurpose without consent
- Retain only as needed
- Delete when no longer needed
Best practices
Risk mitigation
Legal review:
- Consult with legal counsel
- Review compliance regularly
- Stay updated on changes
- Document decisions
Conservative approach:
- When in doubt, get consent
- Provide clear opt-outs
- Be transparent
- Honor all requests
Operational compliance
Integrate compliance:
- Build into email systems
- Automate opt-out processing
- Maintain suppression lists
- Regular compliance checks
Training:
- Train team on requirements
- Update on law changes
- Document procedures
- Regular refreshers
Conclusion
Email marketing laws vary significantly by jurisdiction, and compliance is essential for sustainable cold email operations. Understanding CAN-SPAM, GDPR, CASL, and other regulations helps you build compliant processes that protect your business and respect recipient rights.
Your next step should be to review your current compliance practices and consult with legal counsel to ensure your cold email operations meet all applicable legal requirements.