Email marketing laws: consent rules by country

What every email marketing law asks of you#

This guide is general information for small shops, not legal advice. Laws change and their details depend on your situation. Check the official sources linked below or ask a lawyer in the countries you sell to.

Anti-spam and privacy laws differ in detail, but they converge on three duties for anyone sending marketing email:

1. Permission. Either consent before you send (opt-in) or a right to stop you after you start (opt-out).
2. Identity. Say who you are, with a name and a way to reach you. Several laws require a postal address.
3. A way out. Every marketing email needs an unsubscribe that works, and you must act on it within a deadline.

The rules that apply usually depend on where the recipient is, not where your shop is based. A brand in Taiwan that emails customers in Canada needs to meet Canada’s rules for those customers.

CAN-SPAM vs GDPR: opt-out versus opt-in#

The two laws people compare most often take opposite starting points.

US, [CAN-SPAM](/glossary#can-spam). You may email people without prior consent, as long as each message has accurate headers, a subject line that is not deceptive, a clear statement that it is an advertisement, a valid postal address and a working opt-out. You must honor opt-outs within 10 business days, and the law makes no exception for business-to-business email. Each violating email can cost up to $53,088 ^S1.

EU, GDPR and the ePrivacy Directive. The ePrivacy Directive sets an opt-in regime for marketing email: you need the person’s consent unless they are an existing customer, every message must offer an opt-out, and you may not hide your identity ^S2. GDPR then governs the personal data itself. Valid consent is a clear, active choice, never a pre-ticked box, and you must be able to show that it was given ^S5. Data protection authorities can fine up to €20 million or 4% of worldwide annual turnover ^S3.

UK, PECR and UK GDPR. The UK keeps the same model. The ICO says you must not send marketing emails to individuals without specific consent, except under the “soft opt-in”: existing customers who bought or negotiated to buy a similar product from you, and who were offered an opt-out when you collected their details and in every message since ^S4.

In practice, if you collect clear consent and record it, you meet the stricter model and the US one at the same time.

Email marketing laws by region#

A few notes on the table. In Japan, the sender must keep a record proving that the recipient asked for or agreed to the email ^S9. In Taiwan, the National Communications Commission approved a draft commercial email bill in 2008 ^S11, but we found no enacted anti-spam statute in Taiwan’s national law database as of October 2026, so the Personal Data Protection Act is the law to follow: once a person objects to marketing, you must stop using their data for it ^S10. Thailand’s marketing guidance was published as a draft for consultation in July 2026 and may change ^S12.

We left out countries where we could not confirm the rules against an official source or a law firm’s primary analysis, including Mexico and other Latin American markets. If you sell there, check local guidance before you send.

Practical rules for a small online shop#

You do not need nine compliance programs. One set of habits covers the strictest rules above:

• Ask before you send. Use an unticked checkbox at checkout and on your sign-up form, with wording that names your shop and says what you will send.
• Keep buying and subscribing separate. A purchase alone is not consent in most opt-in countries. The UK and EU existing-customer route needs an opt-out offered at checkout and in every email ^S4.
• Never buy or borrow lists. Consent given to another company does not transfer to you unless the person agreed to it.
• Put your identity and address in every footer. CAN-SPAM requires a postal address ^S1; the email footer checker flags what is missing.
• Make unsubscribe one step and act fast. The shortest deadline above is five business days in Australia ^S15. Processing opt-outs immediately covers every region.
• Keep a [suppression list](/glossary#suppression-list). People who unsubscribe or complain should never be re-imported by accident.

Consent records and double opt-in#

Several of these laws put the burden of proof on you. The ICO says you must be able to demonstrate consent ^S5, and Japan’s law requires a record of each request or consent ^S9. A useful consent record stores:

• The email address and the date and time of consent
• Where it happened: checkout, pop-up, in-store form or event
• The exact wording the person agreed to
• Any later change: unsubscribe, complaint or renewed consent

Double opt-in adds a confirmation email that the new subscriber must click. Most of these laws do not name it, but it gives you the strongest record, catches typos and fake addresses, and keeps complaints down. Single opt-in grows a list faster with weaker proof. For a small shop selling into the EU, UK, Canada or Japan, double opt-in is the safer default.

Growing a list this way is slower but holds up. See how to grow an email list for an online store for sign-up ideas that keep consent clean.

How Tellnod handles consent, unsubscribe and your address#

Tellnod is an MCP connector that lets a shop write, preview and send marketing email from Claude or ChatGPT. The compliance basics are part of every send:

• Consent records. Tellnod keeps a consent record for every contact. When you import a list, consent status and unsubscribes are kept, and contacts without consent information are not marked as subscribed until you confirm they opted in.
• Unsubscribe and address. An unsubscribe link and your postal address are added to every campaign for you.
• Exclusions before you send. Unsubscribed contacts are left out of the count, and the confirmation card shows recipients and exclusions. Only you can press Confirm.

A typical start in the chat: “Import my customers from this CSV. Only mark people as subscribed if the file says they opted in.” Then: “Email subscribers in Canada and the UK about the new merino knitwear.” You review the preview and the card before anything goes out.

Tellnod handles the mechanics, but deciding whom you may email stays with you, so only import people who agreed to hear from you. Plans start free; see pricing, or add Tellnod from the connect page. For the technical side of reaching the inbox, read Gmail and Yahoo sender requirements.

FAQ#