# Email marketing laws: consent rules by country > Most email marketing laws ask for three things: permission to email the person, a clear sender identity and a working unsubscribe. The US (CAN-SPAM) lets you email until someone opts out, while the EU, UK, Canada, Japan and Australia generally require consent before any marketing email. Canonical: https://tellnod.com/guides/email-marketing-consent-laws Last updated: 2026-10-22 Author: Tellnod team ## What every email marketing law asks of you > This guide is general information for small shops, not legal advice. Laws change and their details depend on your situation. Check the official sources linked below or ask a lawyer in the countries you sell to. Anti-spam and privacy laws differ in detail, but they converge on three duties for anyone sending marketing email: 1. **Permission.** Either consent before you send (opt-in) or a right to stop you after you start (opt-out). 2. **Identity.** Say who you are, with a name and a way to reach you. Several laws require a postal address. 3. **A way out.** Every marketing email needs an unsubscribe that works, and you must act on it within a deadline. The rules that apply usually depend on where the recipient is, not where your shop is based. A brand in Taiwan that emails customers in Canada needs to meet Canada’s rules for those customers. ## CAN-SPAM vs GDPR: opt-out versus opt-in The two laws people compare most often take opposite starting points. **US, [CAN-SPAM](https://tellnod.com/glossary#can-spam).** You may email people without prior consent, as long as each message has accurate headers, a subject line that is not deceptive, a clear statement that it is an advertisement, a valid postal address and a working opt-out. You must honor opt-outs within 10 business days, and the law makes no exception for business-to-business email. Each violating email can cost up to $53,088 [S1]. **EU, GDPR and the ePrivacy Directive.** The ePrivacy Directive sets an opt-in regime for marketing email: you need the person’s consent unless they are an existing customer, every message must offer an opt-out, and you may not hide your identity [S2]. GDPR then governs the personal data itself. Valid consent is a clear, active choice, never a pre-ticked box, and you must be able to show that it was given [S5]. Data protection authorities can fine up to €20 million or 4% of worldwide annual turnover [S3]. **UK, PECR and UK GDPR.** The UK keeps the same model. The ICO says you must not send marketing emails to individuals without specific consent, except under the “soft opt-in”: existing customers who bought or negotiated to buy a similar product from you, and who were offered an opt-out when you collected their details and in every message since [S4]. In practice, if you collect clear consent and record it, you meet the stricter model and the US one at the same time. ## Email marketing laws by region | Region | Main law | Consent model | What each email needs | Maximum penalty | | --- | --- | --- | --- | --- | | US | CAN-SPAM Act (FTC) [S1] | Opt-out | Accurate sender, honest subject, ad disclosure, postal address, opt-out honored in 10 business days | Up to $53,088 per email | | EU | ePrivacy Directive and GDPR [S2] | Opt-in; existing customers may be emailed about similar products | Sender identity, valid return address, opt-out in every message | Up to €20 million or 4% of worldwide turnover under GDPR [S3] | | UK | PECR and UK GDPR (ICO) [S4] | Opt-in; soft opt-in for existing customers | Sender identity, valid contact address for opting out | Not covered here | | Canada | CASL [S6] | Opt-in, express or implied (for example, a purchase in the last two years) [S7] | Sender identity, contact information, unsubscribe honored within 10 business days [S7] | Up to C$10 million per violation for an organization [S8] | | Japan | Act on Regulation of Transmission of Specified Electronic Mail [S9] | Opt-in, with a record of the request or consent | Sender name, an email address for opt-out notices | Ministerial orders to improve sending practices | | Taiwan | Personal Data Protection Act [S10] | Opt-out; no dedicated anti-spam statute enacted (see below) | A way to object, offered when you first use the data for marketing | Not covered here | | Thailand | Personal Data Protection Act (PDPA) [S12] | Separate marketing consent expected in the regulator’s draft guidance | An effective way to withdraw consent and object | Not covered here | | Indonesia | Personal Data Protection Law, Law 27 of 2022 [S13] | A lawful basis is required; consent is one of six, as in GDPR | Disclosure of purpose, retention and rights when asking for consent | Fines of up to 2% of turnover | | Australia | Spam Act 2003 [S14] | Opt-in, express or inferred | Sender identification, functional unsubscribe actioned within five business days [S15] | Not covered here | A few notes on the table. In Japan, the sender must keep a record proving that the recipient asked for or agreed to the email [S9]. In Taiwan, the National Communications Commission approved a draft commercial email bill in 2008 [S11], but we found no enacted anti-spam statute in Taiwan’s national law database as of October 2026, so the Personal Data Protection Act is the law to follow: once a person objects to marketing, you must stop using their data for it [S10]. Thailand’s marketing guidance was published as a draft for consultation in July 2026 and may change [S12]. We left out countries where we could not confirm the rules against an official source or a law firm’s primary analysis, including Mexico and other Latin American markets. If you sell there, check local guidance before you send. ## Practical rules for a small online shop You do not need nine compliance programs. One set of habits covers the strictest rules above: - **Ask before you send.** Use an unticked checkbox at checkout and on your sign-up form, with wording that names your shop and says what you will send. - **Keep buying and subscribing separate.** A purchase alone is not consent in most opt-in countries. The UK and EU existing-customer route needs an opt-out offered at checkout and in every email [S4]. - **Never buy or borrow lists.** Consent given to another company does not transfer to you unless the person agreed to it. - **Put your identity and address in every footer.** CAN-SPAM requires a postal address [S1]; the [email footer checker](https://tellnod.com/tools/email-footer-checker) flags what is missing. - **Make unsubscribe one step and act fast.** The shortest deadline above is five business days in Australia [S15]. Processing opt-outs immediately covers every region. - **Keep a [suppression list](https://tellnod.com/glossary#suppression-list).** People who unsubscribe or complain should never be re-imported by accident. ## Consent records and double opt-in Several of these laws put the burden of proof on you. The ICO says you must be able to demonstrate consent [S5], and Japan’s law requires a record of each request or consent [S9]. A useful [consent record](https://tellnod.com/glossary#consent-record) stores: - The email address and the date and time of consent - Where it happened: checkout, pop-up, in-store form or event - The exact wording the person agreed to - Any later change: unsubscribe, complaint or renewed consent [Double opt-in](https://tellnod.com/glossary#double-opt-in) adds a confirmation email that the new subscriber must click. Most of these laws do not name it, but it gives you the strongest record, catches typos and fake addresses, and keeps complaints down. [Single opt-in](https://tellnod.com/glossary#single-opt-in) grows a list faster with weaker proof. For a small shop selling into the EU, UK, Canada or Japan, double opt-in is the safer default. Growing a list this way is slower but holds up. See [how to grow an email list for an online store](https://tellnod.com/guides/grow-email-list-for-online-store) for sign-up ideas that keep consent clean. ## How Tellnod handles consent, unsubscribe and your address Tellnod is an [MCP connector](https://tellnod.com/glossary#mcp-connector) that lets a shop write, preview and send marketing email from Claude or ChatGPT. The compliance basics are part of every send: - **Consent records.** Tellnod keeps a consent record for every contact. When you import a list, consent status and unsubscribes are kept, and contacts without consent information are not marked as subscribed until you confirm they opted in. - **Unsubscribe and address.** An unsubscribe link and your postal address are added to every campaign for you. - **Exclusions before you send.** Unsubscribed contacts are left out of the count, and the [confirmation card](https://tellnod.com/glossary#approval-card) shows recipients and exclusions. Only you can press Confirm. A typical start in the chat: “Import my customers from this CSV. Only mark people as subscribed if the file says they opted in.” Then: “Email subscribers in Canada and the UK about the new merino knitwear.” You review the preview and the card before anything goes out. Tellnod handles the mechanics, but deciding whom you may email stays with you, so only import people who agreed to hear from you. Plans start free; see [pricing](https://tellnod.com/pricing), or add Tellnod from the [connect page](https://tellnod.com/connect). For the technical side of reaching the inbox, read [Gmail and Yahoo sender requirements](https://tellnod.com/guides/gmail-yahoo-sender-requirements). ## FAQ ### Is CAN-SPAM opt-in or opt-out? Opt-out. CAN-SPAM lets you email without prior consent, but each message needs a working opt-out, and you must honor requests within 10 business days [S1]. ### Can I email customers who bought from me without asking first? In the US, yes, with an opt-out in every email. In the UK and EU, only under the existing-customer exception: similar products, with an opt-out offered at checkout and in every message [S4]. In Canada and Australia, consent can be implied or inferred in limited cases, so check the rules before relying on it. ### Is double opt-in required by law? Most laws do not require it by name. They require consent you can prove, and a confirmed click is strong proof, which is why double opt-in is the safer default for opt-in countries. ### What should a consent record include? The email address, when consent was given, where (checkout, form or event), the exact wording shown, and any later unsubscribe or complaint. Regulators such as the ICO expect you to be able to show this [S5]. ### Does Taiwan have an anti-spam law for email? A draft commercial email bill was approved by the National Communications Commission in 2008 [S11], but we found no enacted statute as of October 2026. Marketing email falls under the Personal Data Protection Act, which requires you to stop marketing to anyone who objects [S10]. ## Sources - [S1] FTC: CAN-SPAM Act: A compliance guide for business: (checked 2026-10-22) - [S2] European Commission: Protecting privacy and fighting spam (fact sheet 24): (checked 2026-10-22) - [S3] European Commission: Enforcement and sanctions: (checked 2026-10-22) - [S4] ICO: Electronic mail marketing: (checked 2026-10-22) - [S5] ICO: What is valid consent?: (checked 2026-10-22) - [S6] Justice Laws Website: S.C. 2010, c. 23 (CASL), sections 1 to 8: (checked 2026-10-22) - [S7] Justice Laws Website: S.C. 2010, c. 23 (CASL), section 11: (checked 2026-10-22) - [S8] Justice Laws Website: S.C. 2010, c. 23 (CASL), section 20: (checked 2026-10-22) - [S9] Ministry of Internal Affairs and Communications: Act on Regulation of Transmission of Specified Electronic Mail (unofficial translation): (checked 2026-10-22) - [S10] Laws and Regulations Database of the Republic of China (Taiwan): Personal Data Protection Act: (checked 2026-10-22) - [S11] Lee and Li: 國家通訊傳播委員會審議通過「濫發商業電子郵件管理條例」草案: (checked 2026-10-22) - [S12] Tilleke & Gibbins: Thailand releases new draft PDPA guidance on lawful bases and marketing: (checked 2026-10-22) - [S13] Rouse: 2022 Indonesian Data Protection Law overview: (checked 2026-10-22) - [S14] Federal Register of Legislation: Spam Act 2003: (checked 2026-10-22) - [S15] Corrs Chambers Westgarth: ACMA Spam Act enforcement and the implications for business: (checked 2026-10-22)