Deliverability
Email Marketing Compliance: CAN-SPAM, GDPR, and CASL Made Simple
Email regulations sound intimidating, but the core ideas are common sense: get permission, be honest, and make it easy to leave. Three laws matter most for small businesses, CAN-SPAM (US), GDPR (EU), and CASL (Canada). Here is what each requires, in plain terms.
CAN-SPAM (United States)
CAN-SPAM governs commercial email in the US. It does not require prior opt-in, but it does require honesty and an easy exit. Use accurate “from” and subject lines, identify the message as an ad where relevant, include your physical mailing address, and honor unsubscribe requests promptly (within 10 business days).
GDPR (European Union)
GDPR is stricter and applies if you email anyone in the EU. It generally requires explicit, freely given consent before sending marketing email, no pre-ticked boxes, and gives people the right to access and delete their data. You must be able to prove when and how each subscriber consented.
CASL (Canada)
CASL is among the toughest anti-spam laws. It requires express or clearly implied consent before sending, full sender identification, and a working unsubscribe mechanism. Penalties are significant, so if you email Canadians, treat consent and record-keeping seriously.
A simple compliance checklist
- Only email people who gave permission, keep records of consent.
- Use truthful sender names, subject lines, and content.
- Include a visible, working unsubscribe link in every marketing email.
- Honor unsubscribes promptly and never re-add removed contacts.
- Include your business’s physical mailing address.
- Maintain a privacy policy explaining how you use subscriber data.
Compliance and deliverability go together
The same practices that keep you legal also keep you in the inbox: permission, honesty, and easy unsubscribes all reduce complaints and protect your sender reputation. Compliance is not a constraint on good email marketing, it is a description of it.
Key takeaways
- ✓CAN-SPAM requires honesty, a mailing address, and easy unsubscribe.
- ✓GDPR requires explicit, provable consent for EU recipients.
- ✓CASL requires consent and strict sender identification for Canadians.
- ✓Keep consent records and honor unsubscribes immediately.
- ✓Compliant practices also improve deliverability.
Valter Brandt
Chief Marketing Officer
Valter Brandt is the Chief Marketing Officer of ThisCom, working with clients across the United States and Europe. He has led marketing strategy through the major shifts in social advertising, mobile, content marketing, programmatic media, and marketing automation.
Frequently asked questions
Does CAN-SPAM require opt-in consent?+
No. Unlike GDPR and CASL, CAN-SPAM does not require prior opt-in, but it does require honest headers, a physical mailing address, clear identification of ads, and a working unsubscribe that you honor promptly. Opt-in is still best practice for deliverability.
Do I have to follow GDPR if I’m not in the EU?+
Yes, if you collect or email people located in the EU. GDPR applies based on the location of the individuals, not your business, and requires explicit, provable consent for marketing email.
What must every marketing email include to be compliant?+
A truthful sender and subject line, a visible and working unsubscribe link, and your business’s physical mailing address. Under GDPR and CASL you also need a record of the recipient’s consent.
How quickly must I honor an unsubscribe?+
Under CAN-SPAM you must process unsubscribes within 10 business days, but best practice, and what good platforms do automatically, is to honor them immediately.
Related articles
Email Marketing for Small Business: The Complete 2026 Guide
Email returns about $36 for every $1 spent. Here is how a small business builds a program that reaches the inbox and drives revenue, from list to automation to metrics.
Read →Email MarketingHow to Build an Email List From Scratch (Without Buying One)
A permission-based email list is your most valuable marketing asset. Here are the lead magnets, opt-in forms, and tactics that grow it ethically and fast.
Read →Email AutomationWelcome Email Sequences That Convert New Subscribers
The welcome sequence is the highest-engagement email you will ever send. Here is a proven structure to turn new subscribers into customers automatically.
Read →