Email Marketing Compliance: CAN-SPAM, GDPR, and CASL Made Simple

Three regimes govern most of the marketing email a small business sends, and they disagree with each other in a specific way: the United States lets you email people who never asked, Canada and the EU do not. Because you cannot reliably tell where a subscriber is when they hit submit, the practical answer is to build for the strictest of the three. The penalties, which are usually quoted vaguely, are worth quoting exactly.

CAN-SPAM: no consent required, and the penalties are per message

CAN-SPAM does not require opt-in. It requires honesty and an exit. Headers and subject lines must not be deceptive, commercial messages must be identifiable as advertisements, you must include a valid physical postal address, and you must provide an opt-out mechanism that works for at least 30 days after sending and which you honour within 10 business days.

What makes it serious is the unit of violation. Each individual non-compliant message is a separate violation. The maximum civil penalty is inflation-adjusted annually under the Federal Civil Penalties Inflation Adjustment Act and stood at $53,088 per message following the adjustment effective 17 January 2025. A single careless send to a modest list is arithmetically a company-ending number, which is why the FTC’s actual enforcement targets deception rather than paperwork slips. Do not test the theory.

The classification rule at 16 CFR 316.3 also matters here. A message mixing commercial and transactional content is deemed commercial if the subject line would lead a reasonable recipient to expect an advertisement, or if the transactional content does not appear in whole or substantial part at the beginning of the body. That is how a receipt becomes a marketing email that needed an unsubscribe link it did not have.

GDPR and ePrivacy: two instruments, not one

People say "GDPR" when they mean two separate laws. GDPR Article 6 requires a lawful basis for processing personal data, of which consent is one of six. Article 7 sets the conditions for that consent: the controller must be able to demonstrate that the person consented, the request must be clearly distinguishable from other matters and in plain language, withdrawal must be as easy as giving it, and the person must be told about the right to withdraw before consenting.

The actual permission-to-send rule for marketing email, however, comes from Article 13 of the ePrivacy Directive (2002/58/EC), which requires prior consent for unsolicited commercial email. Article 13(2) contains the soft opt-in: if you obtained the address in the context of a sale of a product or service, you may market your own similar products or services to that person, provided they were given an easy, free opportunity to object both at the point of collection and in every subsequent message. The Court of Justice has confirmed that where the soft opt-in conditions are met, a separate GDPR consent is not additionally required, but the exception is read strictly.

The exposure is under Article 83(5), the higher of the two GDPR fining tiers, which covers infringements of the basic principles for processing including the conditions for consent in Articles 5, 6, and 7. That tier runs to €20 million or 4% of worldwide annual turnover, whichever is higher.

CASL: the strictest of the three

Canada’s Anti-Spam Legislation requires express or clearly defined implied consent before sending a commercial electronic message, full identification of the sender, and a working unsubscribe mechanism. Implied consent is time-limited: an existing business relationship such as a purchase generally supports implied consent for a bounded period, after which you need express consent or you stop. The burden of proving consent is on the sender, which in practice means keeping the timestamp, source, and wording of every opt-in.

Administrative monetary penalties under CASL reach CAD $1 million per violation for an individual and CAD $10 million per violation for a business. Section 20 of the Act sets out what the CRTC weighs in setting an amount, including the nature and scope of the violation, prior history, financial benefit obtained, ability to pay, and cooperation with the investigation.

Compliance and deliverability are the same discipline

Every requirement above reduces the probability that a recipient hits "report spam," which is the metric mailbox providers actually filter on. Google and Yahoo’s 2024 bulk sender rules converge on the same behaviours from a different direction: prove who you are, make leaving trivial, and keep complaints under 0.3%. Building for the strictest regime is not a legal cost centre, it is the configuration that also keeps you in the inbox.

Written by

Valter Brandt

Chief Marketing Officer

Valter Brandt is the Chief Marketing Officer of ThisCom, working with clients across the United States and internationally. He has led marketing strategy through the major shifts in social advertising, mobile, content marketing, programmatic media, and marketing automation.

All articles by Valter Brandt →