Email Marketing Rules for Small Businesses

Who you may email: consent

The three laws take different approaches, and the one that applies depends on where your recipients are, not only where you are.

• United States: opt-out. The FTC's CAN-SPAM compliance guide does not require consent before a commercial email, but sets rules for every message and requires you to stop when someone opts out. It makes no exception for business-to-business email.
• United Kingdom: opt-in, with a "soft opt-in". The ICO's guidance on electronic mail marketing says you must not send marketing emails or texts to individuals without specific consent. The exception is your own previous customers: if someone bought, or negotiated to buy, a similar product or service from you, you may email them, but only if you gave them a clear chance to opt out when you collected their details and in every message. It does not apply to prospects or new contacts. You can email companies, LLPs and other corporate bodies without consent, but sole traders and some partnerships are treated as individuals. The ICO notes this guidance is under review after the Data (Use and Access) Act, so check for updates.
• Canada: consent, express or implied. The CRTC's CASL FAQ says consent can be express or implied. Implied consent comes from an existing business relationship, for example a purchase within the two years before the message, or an enquiry or application within the six months before it. Canada's guidance on getting consent to send email defines express consent as someone agreeing, verbally or in writing, to receive your messages.

In the EU, similar consent rules apply under each country's implementation of the ePrivacy Directive. Our privacy and cookie consent guide covers the data protection side: telling people what you collect and why.

If you sell in more than one of these countries, the simplest safe approach is to ask for clear opt-in consent from everyone and keep proof of it.

What every marketing email must contain

CAN-SPAM requires, among other things:

• accurate header information: the From, To, Reply-To and routing must identify you;
• a subject line that does not mislead about the content;
• a clear disclosure that the message is an advertisement (the FTC says the law gives you "a lot of leeway" in how you do this);
• your valid physical postal address, which can be a street address, a registered PO box or a commercial mail receiving agency address;
• a clear explanation of how to opt out of future marketing email.

The ICO says you must not disguise or conceal your identity and must give a valid contact address so people can opt out. Under CASL, each message must identify your business and anyone you are sending on behalf of, give a current mailing address plus a phone number, email or web address, and include an unsubscribe mechanism.

Responsibility does not pass to your supplier. The FTC says that even if you hire another company to handle your email marketing, you "can't contract away your legal responsibility to comply with the law".

Unsubscribes and one-click

Each law sets a deadline for acting on an opt-out:

• CAN-SPAM: honour it within 10 business days; the mechanism must work for at least 30 days after you send; you cannot charge a fee, ask for personal information beyond an email address, or require more than a reply email or a visit to a single web page.
• CASL: process it without delay and within 10 business days, at no cost; the unsubscribe link must stay valid for at least 60 days after sending.
• PECR: give a simple way to opt out in every message.

The mailbox providers go further. Under Google's email sender guidelines, senders of more than 5,000 messages a day to Gmail must support one-click unsubscribe in marketing messages and show a clearly visible unsubscribe link in the body. Yahoo's sender best practices require bulk senders to support one-click unsubscribe and honour unsubscribes within 2 days.

One-click is defined in RFC 8058 (January 2017). The message carries a List-Unsubscribe header with an HTTPS link and a List-Unsubscribe-Post: List-Unsubscribe=One-Click header, both covered by a valid DKIM signature. The mail service can then unsubscribe the reader with a single action, without a confirmation page. Reputable email platforms add these headers for you; check that DKIM is set up for your own domain, as explained in our SPF, DKIM and DMARC guide.

Keeping records of consent

Canada's guidance says that if you rely on consent you should be ready to prove it, and the same practical logic applies elsewhere: if a complaint arrives, "they signed up" is only as good as your records. For each contact, keep:

• when and where they signed up (the form or page, or the sale for a soft opt-in);
• what they were told they would receive;
• the wording of the consent or opt-out option shown at the time;
• any change since: unsubscribes, complaints, bounces.

Most email platforms store sign-up date, source and IP address; export them along with your list if you ever move platform.

List hygiene

• Never buy or rent lists. Under PECR the soft opt-in does not cover new contacts, and bought addresses produce complaints and spam reports.
• Suppress, do not delete, unsubscribes, so they are not re-imported from an old spreadsheet.
• Remove hard bounces and addresses that have not opened in a long time; they damage deliverability.
• Watch your spam complaint rate. Google and Yahoo both ask senders to keep it below 0.3%.
• Send what people signed up for, at the frequency you promised.

A sign-up form that does it right

1. Say exactly what people will get and how often.
2. Use an unticked checkbox or a separate sign-up form; do not hide marketing consent inside your terms.
3. Collect only the email address and what you really need.
4. Link to your privacy policy beside the form.
5. Send a welcome email that confirms the sign-up and shows how to unsubscribe. A confirmation step (double opt-in) adds proof that the address belongs to the person.
6. Track sign-ups as a success event, as our landing page checklist explains.

Frequently asked questions

Do I need consent to send marketing emails?

It depends on where your recipients are. The US CAN-SPAM Act works on opt-out, but UK PECR requires specific consent for individuals, apart from the soft opt-in for existing customers, and Canada's CASL requires express or implied consent. Asking everyone for clear opt-in consent is the safest approach.

Can I email people who bought from me before?

In the UK, the soft opt-in lets you email previous customers about similar products or services if you gave them a clear chance to opt out when you collected their details and in every message. In Canada, a purchase within the last two years gives implied consent.

How quickly must I process an unsubscribe?

Within 10 business days under both CAN-SPAM and CASL. Yahoo asks bulk senders to honour unsubscribes within 2 days, so in practice make it immediate.

Do I need to put my address in every email?

Under CAN-SPAM yes: a valid physical postal address, which can be a registered PO box or a commercial mail receiving agency. CASL also requires a current mailing address plus a phone number, email or web address.

Can I buy an email list?

It is a bad idea. Under PECR the soft opt-in does not cover new contacts, CASL requires consent you can prove, and bought lists lead to spam complaints that hurt deliverability.

Need a sign-up form and email set-up that follow the rules and reach the inbox? We build forms, integrations with email platforms and email authentication as part of our website development and website maintenance work. See all our services, or email info@creahive.com.