CAN-SPAM, GDPR and CASL differ in the detail and agree on the substance. The four habits that satisfy almost all of them at once, what GDPR adds, and why double opt-in is worth the lost signups.
Cyril Nie
Author
Email laws differ by country — CAN-SPAM in the US, GDPR in Europe, CASL in Canada — but they all point the same direction. Follow these habits and you’ll be on the right side of nearly all of them.
Get permission first. Only email people who signed up. GDPR and CASL require clear consent before you send; a pre-ticked box doesn’t count. Keep a record of when and how each person opted in.
Make leaving easy. Every email needs a working unsubscribe link, and it has to work fast. A hard unsubscribe just becomes a spam complaint — which hurts you far more.
Say who you are. Use your real business name and include a physical mailing address in the footer.
Don’t lie in the subject line. The subject must match what’s inside. “RE:” on an email that isn’t a reply is a violation, not a growth hack.
Honor deletion requests. Under GDPR, people can ask to see or delete their data. Your platform should make this a button, not a project.
Consider double opt-in. A confirmation click after signup keeps bots and typos off your list. You lose a few signups; you gain a cleaner list and proof of consent.
The mindset shift that makes compliance easy: these laws just require what good email marketing already does — email people who want it, be honest, and let them leave. If you follow the rest of this book, the rules mostly take care of themselves.
Accurate sender identity, a valid physical address, a working one-click unsubscribe honored promptly, and no deceptive subject lines. GDPR and CASL add a consent requirement with proof of when and how it was given. Meeting the strictest rule everywhere is simpler than segmenting by jurisdiction.
In the EU, UK and Canada, yes, with a record of when and how it was given. CAN-SPAM in the US technically permits sending without prior consent, but doing so produces complaints that damage deliverability, so consent is the practical standard regardless of law.
CAN-SPAM allows ten business days. Process them immediately. Google and Yahoo require one-click unsubscribe to be honored within two days for bulk senders, and a person who unsubscribes twice usually reports the third email as spam.
Discover more insights on similar topics
The complete 2026 guide to email marketing: 16 chapters on list growth, segmentation, automation, deliverability, testing, attribution and AI. Built from 908 sources and 4,798 insights.
Email returns about $36 for every $1 spent — roughly 30 times the next best channel. Here is why it keeps winning, and the six parts every working program is built from.
Apple inflates open rates and Gmail’s scanners click your links. Here are the email metrics that survive scrutiny, the thresholds worth holding yourself to, and why your own last 90 days beat any industry average.