Email Marketing Laws: CAN-SPAM, GDPR, CASL, and COPPA

Email marketing laws in the United States start with the CAN-SPAM Act, which sets baseline rules for every commercial message and carries penalties of up to $53,088 per violating email.¹ If any of your recipients live in the European Union, Canada, or a state with a comprehensive privacy law, or if any are children under 13, additional regimes apply on top of CAN-SPAM. Each has its own consent model, its own enforcement structure, and its own penalty scale. Getting the wrong one wrong can wipe out the revenue from the campaign that triggered it.

CAN-SPAM: The U.S. Baseline

CAN-SPAM applies to any electronic message whose primary purpose is promoting a commercial product or service. It does not require recipients to opt in before you send. It sets transparency and opt-out standards that every sender must follow.

Every commercial email must include accurate header information. The “From,” “To,” “Reply-To,” and routing data have to identify the person or business that initiated the message, and the subject line must reflect what is actually in the email.¹ A subject line designed to trick someone into opening the message violates the law. The email must disclose that it is an advertisement and include a valid physical postal address, whether that is a street address, a registered P.O. box, or a commercial mailbox.

Every marketing email needs a clear opt-out mechanism. Once someone asks to stop, you have ten business days to process the request. You cannot charge a fee, require personal information beyond an email address, or add extra steps. The opt-out link must stay functional for at least 30 days after you send the message, and after someone unsubscribes you are prohibited from selling or transferring their email address to another sender.¹

Transactional messages sit outside these rules. Order confirmations, shipping updates, account statements, and warranty notices are exempt from the advertising disclosure and opt-out requirements, though they still cannot use false or misleading routing information.¹ Stuffing promotional content into what looks like a shipping notification can reclassify the entire message as commercial and pull the full CAN-SPAM obligations back in.

Enforcement, Penalties, and Who Is on the Hook

Each individual email that violates CAN-SPAM can trigger a civil penalty of up to $53,088.¹ The figure is adjusted for inflation annually and tends to climb each year.² A single campaign sent to a large list can generate staggering exposure if a routine defect like a missing postal address runs through every message.

Enforcement rests with the Federal Trade Commission, state attorneys general, and internet service providers. The FTC treats CAN-SPAM violations as unfair or deceptive practices. State attorneys general can bring civil actions on behalf of their residents, and internet access providers harmed by spam can sue directly. Individual recipients cannot sue. There is no private right of action under CAN-SPAM; a consumer’s recourse is to report the sender to the FTC or a state attorney general.³

Hiring a third party to send your emails does not move the liability off your books. The FTC has made clear that both the company whose product appears in the message and the company that physically sends it can be held legally responsible.¹ If an affiliate blasts out noncompliant messages promoting your product, you share the exposure.

Marketing to the EU: GDPR and the ePrivacy Directive

The EU flips the American model. Where CAN-SPAM lets you email anyone and requires you to honor opt-outs, EU law requires affirmative consent before you send. The ePrivacy Directive mandates prior consent for unsolicited commercial communications, and the General Data Protection Regulation defines what valid consent looks like and sets the penalties.

Under GDPR Article 7, consent must be freely given, specific, and informed. The person has to take a clear affirmative action such as ticking an unchecked box or clicking an opt-in button. Pre-ticked boxes, silence, and inactivity do not count. If consent sits inside a broader document like terms of service, the consent request must be clearly distinguishable and written in plain language.⁴ The burden is on the sender to prove valid consent exists for every person on the list.

Withdrawing consent must be as easy as giving it. If someone subscribed with a single click, you cannot bury unsubscribe behind a multi-step preference center.⁴ You also have to tell people up front that they can withdraw at any time, and you need to keep detailed records of how and when each person opted in.

These rules reach across borders. Any organization that offers goods or services to people in the EU must comply, regardless of where the sender is located, and regardless of whether the product is paid or free. A U.S. company marketing to EU residents is fully inside GDPR’s scope.

Penalties for consent and data-subject-rights violations can reach €20 million or four percent of a company’s total worldwide annual turnover from the preceding year, whichever is higher.⁵ The revenue-based ceiling is what makes GDPR enforcement dangerous for large companies: a business with €50 billion in global revenue faces a theoretical maximum of €2 billion.

EU residents can also demand outright deletion of their data, not just an unsubscribe. Under Article 17, a controller must erase personal data “without undue delay” when the person withdraws the consent the processing was based on, or when the data is no longer necessary for the purpose it was collected. If you have shared or published the data, you must take reasonable steps to notify other organizations processing it about the deletion request. An erasure request does not have to cite any specific article of the GDPR to be valid.⁶

Marketing to Canada: CASL

Canada’s Anti-Spam Legislation is closer to the EU model than to CAN-SPAM. You need consent before sending a commercial electronic message to a Canadian recipient, and the law distinguishes express consent from implied consent.

Express consent means the person explicitly agreed to receive your messages, and it stays valid until they withdraw it. Implied consent is narrower. It arises from an existing business relationship such as a purchase, lease, or written contract, and it lasts two years from the date of that transaction. If the relationship started with an inquiry or application rather than a completed purchase, implied consent lasts only six months.⁷ After those windows close, you need express consent to keep mailing that person.

Penalties are steep: up to $1 million per violation for individuals and up to $10 million per violation for corporations. If a regulator asks you to demonstrate that you had valid consent for a particular recipient on a particular date, you need to produce that proof.

If Any Recipients May Be Under 13: COPPA

The Children’s Online Privacy Protection Act adds a separate layer when a website or online service collects personal information from children under 13. Email addresses fall squarely inside COPPA’s scope. Before you can collect a child’s email for any purpose beyond a one-time response to a direct request, you must obtain verifiable parental consent.⁸

The FTC accepts several verification methods, including a signed consent form, a credit card or payment system that notifies the account holder, a toll-free number staffed by trained personnel, or a video conference. For data used only internally and not shared with third parties, an “email plus” method lets an operator email the parent for consent and confirm by email, letter, or phone. COPPA violations carry civil penalties of up to $53,088 per violation. If your list could include anyone under 13, this is not a rule you can clean up after the fact.

State Privacy Laws Regulate Your List, Not Your Email

At least 19 states have enacted comprehensive consumer privacy laws, and that number keeps growing. These laws do not police email content the way CAN-SPAM does. They regulate what you do with the personal data you collect through email sign-ups, website interactions, and purchase histories. The email address itself is protected personal information, and how you collect, store, share, and sell it triggers obligations that go well beyond an unsubscribe link.

California

California’s framework is the most established. Covered businesses must tell consumers at or before the point of collection what categories of data they are gathering and how they will use it.⁹ Consumers can request access to the specific pieces of personal information a business holds about them, and they can demand deletion by both the primary business and any third parties it was shared with.

Businesses must display a “Do Not Sell or Share My Personal Information” link on their homepage. California also requires businesses to honor automated browser signals like Global Privacy Control as a legally valid opt-out, meaning a consumer does not need to click a link if their browser is already broadcasting the signal.¹⁰ Sensitive personal information, which includes the contents of email and text messages, triggers an additional “Limit the Use of My Sensitive Personal Information” link.⁹

The California Privacy Rights Act removed the 30-day cure period that once gave businesses a window to fix violations before facing penalties. As of 2025, fines reach up to $2,663 per unintentional violation and $7,988 per intentional violation or per violation involving the data of minors.¹¹ A business that retaliates against consumers who exercise their privacy rights, such as by charging them more or degrading service quality, faces additional exposure.

The Rest of the Map

Other state privacy laws generally share a common set of consumer rights: access, deletion, correction, and the ability to opt out of targeted advertising and data sales. Some require businesses to honor universal opt-out signals. Applicability thresholds vary, but most laws kick in based on the number of consumers whose data you process or the share of revenue you derive from selling personal data. Small businesses are sometimes exempt from general requirements but lose that exemption if they sell sensitive data such as precise geolocation or information about children.

A national email program that collects data from consumers across the country realistically has to comply with the most protective state requirements across the board, unless the company builds state-by-state segmentation into its data practices.

Mailbox Provider Rules for Bulk Senders

Starting in 2024, major mailbox providers began requiring bulk senders, generally those sending more than 5,000 messages a day, to implement email authentication as a condition of deliverability. These are not statutes, but they function as de facto rules because noncompliant email simply does not reach inboxes.

Three authentication standards apply:

SPF (Sender Policy Framework) authorizes which servers and IP addresses can send email on behalf of your domain.
DKIM (DomainKeys Identified Mail) attaches a digital signature to each email so the receiving server can verify the message was not altered in transit.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together and tells receiving servers what to do with messages that fail authentication.

Bulk senders also have to include a one-click unsubscribe mechanism in email headers under RFC 8058. The unsubscribe must complete automatically without requiring the recipient to visit a preference center, and the sender must process the request within two days. Transactional messages like password resets and shipping confirmations are exempt from the one-click unsubscribe requirement but still need authentication. These provider-level requirements overlap with CAN-SPAM’s opt-out rules and are stricter in practice: CAN-SPAM gives you ten business days to honor an unsubscribe, while major providers expect it done within 48 hours.

1
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
2
Federal Trade Commission. FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025
3
Office of the Law Revision Counsel. 15 U.S. Code 7706 – Enforcement Generally
4
GDPR-text.com. Article 7 GDPR – Conditions for Consent
5
GDPR-info.eu. Art. 83 GDPR – General Conditions for Imposing Administrative Fines
6
GDPR-info.eu. Art. 17 GDPR – Right to Erasure
7
Canadian Radio-television and Telecommunications Commission. CASL Guidance on Implied Consent
8
Office of the Law Revision Counsel. 15 U.S. Code 6502 – Regulation of Unfair and Deceptive Acts and Practices in Connection With Collection and Use of Personal Information From and About Children on the Internet
9
State of California Department of Justice. California Consumer Privacy Act (CCPA)
10
Global Privacy Control. Global Privacy Control
11
California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for Administrative Fines