GDPR, CAN-SPAM and CASL are the three laws that decide how most email lists can be built and mailed. GDPR covers people in the EU and requires a lawful basis, usually consent. CAN-SPAM covers US recipients and lets you send without prior consent as long as you identify yourself and honour opt-outs. CASL covers Canadian recipients and requires consent before you send. If your list reaches all three places, you need to meet all three at once.
Most people with a list will never face a fine, and that confidence is exactly how mistakes happen. These are active laws with real enforcement. GDPR fines have reached into the hundreds of millions of euros for large companies. Under CAN-SPAM, each separate email that breaks the rules can carry a civil penalty, and the FTC adjusts the maximum for inflation every year. The CRTC enforces CASL against Canadian and international businesses. This guide explains each one, where they overlap, and gives you a checklist to work through. It's general information, not legal advice, so check anything specific to your business with a lawyer.
Key takeaways
- GDPR and CASL both require consent before you send marketing email, while CAN-SPAM doesn't, so building on clear opt-in covers all three.
- Every marketing email needs accurate sender details, an honest subject line, a physical mailing address and a working unsubscribe link.
- CAN-SPAM and CASL both give you no more than 10 business days to act on an unsubscribe, and CASL wants the link to keep working for 60 days.
- Under CASL, implied consent expires: two years after a purchase, and six months after an inquiry or application.
- Compliance and deliverability are different things, but the habits that keep you legal also tend to keep you out of spam.
What does GDPR require for email marketing?
The General Data Protection Regulation (GDPR) is a European Union law that took effect in May 2018. It governs how personal data, including email addresses, is collected, stored and used. It applies to anyone who targets or processes the personal data of people in the EU or European Economic Area, wherever the business is based.
Lawful basis. You need a legal reason to send marketing emails. For most people that's consent or legitimate interest. Consent is the cleaner option: the subscriber actively opts in, understands what they're signing up for, and can withdraw at any time. Legitimate interest is narrower and needs a balancing test against the subscriber's rights.
Consent must be freely given, specific, informed and unambiguous. Pre-checked boxes don't count. A vague "I agree to receive communications" may not count either. The subscriber has to take an action, and your records should show when, how and what they agreed to.
Right to access and erasure. Subscribers can ask for a copy of the data you hold on them, and they can ask you to delete it. Your email platform and any connected tools need to support both, and GDPR expects a response within one month.
Data minimization. Collect only what you use. If you send a weekly newsletter, you probably don't need a phone number. Fields you never use add risk without adding anything.
Processors. Your email platform processes subscriber data on your behalf, which makes it a data processor under GDPR. You need a data processing agreement (DPA) with it. Most major platforms, including Mailchimp, Kit and HubSpot, offer a standard DPA. Make sure yours is accepted and on file.
What does CAN-SPAM require for commercial email?
CAN-SPAM is a US federal law from 2003, enforced by the Federal Trade Commission. It applies to commercial email sent to US recipients. Unlike GDPR, it doesn't require consent before sending. It sets rules for how commercial emails are presented and how opt-outs are handled.
Accurate sender identification. Your From name, From address and reply-to must honestly identify who's sending.
No deceptive subject lines. The subject line can't misrepresent what's inside. "Your account has been suspended" on a promotional email breaks the rule, however well it opens.
Physical address. Every commercial email needs a valid postal address. That can be a street address, a registered post office box, or a registered private mailbox.
A clear way to opt out. Every email needs a visible way to unsubscribe that keeps working for at least 30 days after you send. You have 10 business days to act on a request, and you can't charge a fee or ask for more than an email address.
Suppression. Once someone opts out, stop sending them marketing. Keeping them on a suppression list so they're not re-added by accident is fine.
CAN-SPAM is the least strict of the three. It allows cold email as long as the required pieces are there. That doesn't make it a safe harbour for aggressive list habits, because your platform's terms and the mailbox providers fill in the gaps the law leaves open.
What does CASL require for Canadian recipients?
Canada's Anti-Spam Legislation (CASL) took effect in July 2014 and is one of the strictest email laws in the world. It applies to commercial electronic messages sent to or from computers and devices in Canada, so in practice it covers any marketing email that could reach a Canadian reader.
Consent comes first. This is the biggest difference from CAN-SPAM. You generally can't send a marketing email to a Canadian recipient without consent. Express consent is a documented opt-in. Implied consent applies in specific situations, such as an existing business relationship, or an address someone published or gave you in a business context.
Implied consent expires. Under section 10 of the Act, an existing business relationship from a purchase gives you implied consent for two years after it, and an inquiry or application gives you six months. You can't rely on old implied consent forever.
Keep consent records. You need to be able to show you had consent when you sent. Record the date, the method and the wording, whether it came from a form, an in-person signup, or a conversation followed by written confirmation.
Unsubscribe rules. The unsubscribe link has to stay valid for at least 60 days after the message is sent, and you have to act on a request without delay, and in any case within 10 business days.
No pre-checked boxes. Like GDPR, CASL doesn't accept a setup where doing nothing counts as consent.
CASL also includes a private right of action that would let individuals sue, but the government suspended it before it came into force, and it hasn't been brought in since. The CRTC's own enforcement is real, so it's not a law to treat lightly.
Where do the three laws overlap?
If you send to people in the US, the EU and Canada, as many newsletters do, the good news is that the strictest rules stack cleanly.
Consent: GDPR and CASL require it. CAN-SPAM doesn't. Build your list on clear opt-in and you meet all three.
Unsubscribe: All three require a working unsubscribe. CAN-SPAM and CASL both cap you at 10 business days to act on it, and GDPR expects it promptly. Processing opt-outs straight away, as most platforms do automatically, covers all three.
Sender identification: A real From address, an honest subject line and a valid postal address cover all three.
Record-keeping: GDPR and CASL both expect you to be able to show consent. CAN-SPAM doesn't ask for the same records, but keeping the date, source and form wording for every signup is the safest habit everywhere.
The simple version: build on express consent, document everything, and honour opt-outs promptly.
A compliance checklist you can work through
Consent and list building
- Signup forms use an unchecked box or another clear action, never a pre-checked box
- The consent wording says what people will get, roughly how often, and from whom
- You store the date, source and form wording for each signup
- For Canadian subscribers, you know whether consent is express or implied, and you track when implied consent runs out
- You don't add people from bought lists or event attendee lists without a proper opt-in
Sender identification and message format
- From name and From address are accurate and consistent
- Subject lines describe the content honestly
- Every email includes a valid physical mailing address
Unsubscribe and suppression
- Every email has a clearly visible unsubscribe link, plus one-click unsubscribe in the header if you send in bulk to Gmail or Yahoo
- Unsubscribe links keep working for at least 60 days after the send
- Opt-outs are processed within 10 business days, ideally straight away
- Suppression lists are kept in your platform and synced with any connected tools
Data handling
- A DPA is in place with your email platform
- You collect only the fields you use
- You have a simple process for access and deletion requests
Ongoing
- Consent records are reviewed once a year, and aged implied consent under CASL is flagged
- Win-back campaigns exclude people whose CASL consent has lapsed
A steady sending routine helps here. The 90-day newsletter operating system builds these checks into your publishing rhythm instead of treating them as a one-off clean-up.
How does compliance affect deliverability?
Compliance and deliverability aren't the same thing, but they help each other. Spam filters don't read your privacy policy. Gmail and Outlook decide where mail goes based on things like authentication, spam complaints and how people engage. A perfectly legal email to a disengaged list can still land in spam.
The habits overlap, though. Clear consent brings more engaged readers. Fast unsubscribes stop complaints building up. Honest sender details build your domain's reputation over time. Gmail also requires bulk senders to support one-click unsubscribe and keep spam complaints low, which lines up with what the law asks for anyway.
The biggest gap is cold email. CAN-SPAM allows it, but most email platforms ban sending to addresses gathered without permission, and breaking a platform's rules gets an account suspended much faster than the law ever would. If your emails are already struggling to reach the inbox, our deliverability repair work covers the consent and unsubscribe setup alongside your authentication records.
Honest subject lines are part of this too. For a practical take on writing ones people open without misleading them, see subject lines that get opened.
Frequently Asked Questions
Does GDPR apply to my US-based newsletter if I have EU subscribers?
It can. GDPR depends on where your subscribers are and whether you're offering something to people in the EU, not where your business is registered. If you knowingly collect signups from EU residents or aim at EU audiences, GDPR applies to how you handle their data. That includes consent, a data processing agreement with your email provider, and handling deletion requests.
Does CAN-SPAM require permission before sending?
No. CAN-SPAM is an opt-out law, so it doesn't require consent before a commercial message. It does require honest sender details, a subject line that isn't misleading, a physical address and a working unsubscribe. Consent before sending is required under GDPR and CASL, not CAN-SPAM.
What counts as a "commercial electronic message" under CASL?
Any electronic message, including email and text, that encourages someone to take part in a commercial activity. That covers promotional emails, transactional emails with an upsell in them, and messages with a commercial call to action even if most of the message is informational. Pure receipts, password resets and account notices generally fall outside the consent rules as long as they don't include promotion.
If someone gives me a business card, can I add them to my newsletter under CASL?
CASL allows implied consent when someone gives you their address in a business context, but only for messages relevant to their role or business, and only if they didn't say they don't want messages. A general newsletter may not qualify. A clear opt-in is always the safer route, and a quick follow-up asking if they'd like to join costs you nothing.
How long do I need to keep consent records?
There isn't a single answer across all three laws. GDPR expects you to be able to show valid consent for as long as you rely on it. CASL implied consent from a purchase lasts two years, and from an inquiry six months. I'd keep consent records for as long as someone is subscribed and for a while after, and check the exact period with a lawyer for your situation.
Can I use the same list for subscribers from different countries?
Yes, but tag subscribers by country and type of consent so you can apply the right rules to each group. Someone added under implied Canadian consent after an inquiry needs different handling from someone who completed a double opt-in form. Your platform's custom fields or tags can handle this.