CAN-SPAM, CASL, PECR and Other Marketing Email Laws: A Plain-Language Overview for Senders

The main marketing email laws differ on one big question: do you need permission before you send, or only a way for people to stop you afterwards? This guide gives senders a plain-language map of the US CAN-SPAM Act, Canada CASL, UK PECR with UK GDPR, EU ePrivacy and GDPR, Australia Spam Act, and a high-level note on India, then turns them into one practical policy that you can apply to every list.

Opt-in or opt-out: the model behind each law

Every regime tries to protect people from unwanted commercial messages, but they take two different routes. An opt-out model lets you send commercial email without prior permission, provided you follow content rules and stop when someone asks. An opt-in model says that you need permission before the first marketing message, and the sender has to be able to show it.

Region and law	Model in short	Who it mainly protects
United States: CAN-SPAM Act	Opt-out: no prior consent needed, but strict content rules and a duty to honor opt-outs	Any recipient of commercial email, including business addresses
Canada: CASL	Opt-in: express or implied consent needed, with defined exceptions	Recipients in Canada, with rules that also reach messages sent from Canada
United Kingdom: PECR with UK GDPR	Opt-in for individuals, with a limited soft opt-in for existing customers; more relaxed for corporate subscribers	Individuals first; businesses to a lesser extent
EU: ePrivacy Directive with GDPR	Opt-in for individuals, with a similar limited soft opt-in, implemented through national law	Individuals; national rules on business addresses vary
Australia: Spam Act 2003	Opt-in: consent (express or inferred), plus identification and unsubscribe duties	Recipients of commercial electronic messages in Australia
India	No single email-spam statute to cite here; data protection and telecom rules apply to different channels	Check current rules for your channel

Because the opt-in laws are stricter, the safe approach for a mixed list is to behave as if opt-in applies everywhere. That choice also matches what mailbox providers expect; our bulk sender requirements guide explains the technical side of that expectation, and the consent habit helps your complaint rate as well.

United States: the CAN-SPAM Act

CAN-SPAM covers commercial email, meaning messages whose primary purpose is to advertise or promote a product or service. It does not ban sending without consent, but it sets rules that the FTC explains in a business compliance guide. The points most senders need are these.

• No false or misleading header information. The From name, reply address and routing details must identify the real sender.
• No deceptive subject lines. The subject has to reflect the content of the message.
• Tell people it is an ad where the message is advertising, in a way that is clear and noticeable.
• Include a valid physical postal address for your business in the message.
• Give a clear way to opt out, and keep it working for at least thirty days after you send. Honor requests within ten business days. You may not charge a fee or ask for more than an email address or a simple reply or web page visit.
• You remain responsible when another company sends on your behalf, so agreements with agencies and platforms should say who does what.

Two details trip people up. First, the law applies to business-to-business email as well, so a company address does not exempt you. Second, transactional or relationship messages, such as an order confirmation, get lighter treatment, but a message that mixes promotion with service content can be judged by its overall purpose. Keeping the two streams apart avoids that problem.

Canada: CASL

Canada Anti-Spam Legislation is built on consent. A commercial electronic message generally needs the recipient consent, and the sender is the one who has to prove it exists. CASL also covers more than email, since it reaches text messages and some social messages, and it can apply to messages sent to or from computers in Canada.

• Express consent is an active agreement for a stated purpose. A request for consent should say who is asking, what you will send and how to withdraw, and it should not be hidden in general terms or pre-ticked.
• Implied consent applies only in situations the law lists, for example certain existing business relationships or a recipient who publicly published a business address without a no-spam notice and with a relevant message. Many of these expire after a set period, so track the dates.
• Identification means naming the sender and anyone on whose behalf you send, with contact details such as a mailing address and another contact method.
• Unsubscribe must be clear, free to use and effective within ten business days. The mechanism should remain valid for sixty days after the message.

The practical lesson from CASL is about evidence. A list you cannot explain, such as an old import with no source field, is a risk. Keep the consent record described later in this guide and prefer express consent over implied consent whenever you can get it.

United Kingdom: PECR with UK GDPR

In the UK, two layers work together. The Privacy and Electronic Communications Regulations (PECR) set the rules for electronic marketing, and UK GDPR governs the personal data you use to do it, including lawful basis, transparency and individual rights. The regulator is the ICO, which publishes direct marketing guidance.

• Individual subscribers such as consumers, sole traders and some partnerships: you generally need consent to send marketing email.
• Soft opt-in is a limited exception for existing customers. It broadly requires that you collected the address during a sale or negotiation, that you market only your own similar products or services, and that you offered an opt-out when you collected the address and offer one in every message.
• Corporate subscribers such as limited companies are treated more flexibly under PECR, although you must still identify yourself and provide a valid contact address and opt-out. UK GDPR can still apply to named individuals at those companies.
• Identification: never disguise or conceal who is sending, and give a valid address where recipients can send an opt-out request.

UK data protection and privacy rules have been updated in recent years, so check the ICO pages for the current position before you rely on this summary.

European Union: ePrivacy and GDPR

EU rules also work in two parts. The ePrivacy Directive sets the framework for unsolicited electronic marketing, including the consent requirement and a limited exception for existing customers, and each member state implements it in national law. GDPR then applies to the personal data involved, with its requirements for a lawful basis, clear information, records and respect for individual rights.

Because member states implement the Directive themselves, details such as the treatment of business addresses can differ from country to country. For senders the working rule is similar to the UK: consent for marketing to individuals, a narrow soft opt-in for existing customers, identification, and an easy opt-out in every message. We explain consent evidence, withdrawal and records in depth in our GDPR and email guide, so we do not repeat that detail here.

Australia: the Spam Act 2003

The Spam Act applies to commercial electronic messages, including email and SMS, and the regulator is ACMA. It rests on three ideas that are easy to remember.

• Consent: you need the recipient consent, which can be express or inferred from the circumstances in limited ways, such as an existing relationship or conspicuous publication of a work address together with a relevant message.
• Identify: the message must clearly identify the sender and include accurate contact details that stay valid for a reasonable time after sending.
• Unsubscribe: every message needs a functional unsubscribe facility, and the request must be honored within five working days.

As with Canada, there is no broad exemption for business recipients, so a B2B list still needs a consent basis.

India: keep it high level and check current rules

We keep this section deliberately short, because Indian requirements are layered by channel and have been developing. For email, the Digital Personal Data Protection Act, 2023 and its rules shape how personal data may be collected and used, with consent and notice as central ideas. For SMS and voice marketing, telecom regulation by TRAI applies, including registration of senders and message templates through operator DLT systems, and preference rules for commercial messages.

How the rules compare on the points that decide your footer

Point	US CAN-SPAM	Canada CASL	UK PECR and UK GDPR	EU ePrivacy and GDPR	Australia Spam Act
Permission before first send	Not required	Required (express or implied)	Required for individuals; soft opt-in for customers	Required for individuals; soft opt-in in most states	Required (express or inferred)
Sender identification	Accurate headers and sender identity	Name and contact details, including mailing address	Do not conceal identity; valid contact address	Do not conceal identity; national detail varies	Clear identity and accurate contact details
Postal address in message	Required	Required as part of contact details	Valid address for opt-out requests	Varies by national law	Accurate contact details
Unsubscribe timing	Within 10 business days	Within 10 business days	Without undue delay	Without undue delay	Within 5 working days
Business addresses	Covered	Covered	More flexible for corporate subscribers	Varies by member state	Covered

Read the table as a floor, not a target. Honoring an unsubscribe on the day it arrives is easy for software and removes the question of which deadline applies. If you operate with one-click opt-out headers, our one-click unsubscribe guide covers the header side.

B2B versus B2C: where the difference is real

Many senders hope that B2B email is a gray zone. The honest summary is that the differences are real in a few places and small in others. In the US, CAN-SPAM treats business and consumer recipients alike. In Canada and Australia, the law is also written around commercial messages in general, with consent exceptions that you must meet case by case. The UK and parts of the EU are the main places where corporate addresses are handled more lightly, and even there identification and opt-out duties remain, and data protection law can apply to the individual behind a work address.

• Tag each contact as personal or business at the time of collection.
• Do not treat a named person at a company as automatically outside privacy law.
• Remember that sole traders and some partnerships are individuals for UK purposes.
• Keep relevance in mind: a message about something unrelated to the role of the recipient is harder to defend in any regime.

Records, suppression and a simple consent record

Opt-in laws put the burden of proof on the sender, and even in opt-out regimes you need to show that you processed a removal. Records are what turn a good-faith program into a defensible one. A consent record should be created when the person subscribes and updated whenever the status changes. Here is an invented example of the fields we suggest keeping.

{
  "contact": "reader@example.org",
  "consent_type": "express",
  "consent_date": "2026-03-04T10:21:07Z",
  "source": "newsletter signup form on /blog",
  "wording_shown": "Send me product news and offers by email",
  "country": "CA",
  "contact_kind": "personal",
  "confirmed_by_link": true,
  "status": "subscribed",
  "unsubscribed_at": null
}

Pair this with a permanent suppression list so that unsubscribed people stay removed, even if the same address turns up in a later import. Our suppression list guide covers how bounces, complaints and unsubscribes should flow into one list, and our sign-up form and double opt-in guide explains how to capture clean consent in the first place.

A compliant footer, as a pattern

The exact text depends on your business and your lawyer advice, but the pieces are the same everywhere: who you are, where you are, why the person received the message, and how to stop it. This invented example shows the pattern.

You are receiving this email because you subscribed on our website on 4 March 2026.
Example Studio Ltd, 25 Sample Street, Sampletown, AB1 2CD, Exampleland
Unsubscribe: https://mail.example.org/unsubscribe/abc123
Manage preferences: https://mail.example.org/preferences/abc123

Worked example: one list, four countries

Take an invented online training company with 12,000 contacts. By country, the list holds 6,000 in the US, 2,500 in Canada, 2,000 in the UK and 1,500 in Australia. About 300 contacts came from a trade-show badge scan, 800 from an old purchase list of unknown origin, and the rest from website sign-ups. The team wants to send a promotional campaign.

Under a US-only view, the whole list looks mailable if the footer is right. Under the combined view, the picture changes. The 800 contacts of unknown origin have no consent record, which is a problem in Canada, the UK and Australia and a deliverability risk everywhere. The 300 badge scans may carry a limited basis, depending on what attendees were told. So the team makes these decisions.

Segment	Contacts	Decision
Website sign-ups with recorded consent	10,900	Send; verify that the consent record has source, date and wording
Trade-show scans	300	Send one confirmation message asking for consent; mail promotions only after a yes
Old purchased list of unknown origin	800	Do not send; delete or archive after legal review
Of the 10,900: UK business addresses	tagged within the count	Still send identification and opt-out; keep personal-data rules in mind

The result: 10,900 contacts are mailed in the first campaign, 300 receive a consent request, and 800 are removed from sending. The footer carries the company name, postal address, a reason for receiving the email, and a working unsubscribe. An unsubscribe arriving on the first day is added to the suppression list within minutes, so every deadline is met many times over. Nothing here required a different email for each country, only one stricter policy applied consistently.

A compliance checklist for senders

1. Recipient countries are known and counted, and the strictest applicable standard is adopted as the baseline.
2. Every marketing contact has a consent record with date, source, wording and identifier.
3. No purchased, rented or scraped lists are mailed without a clear, documented lawful basis.
4. From name, subject line and headers are truthful and not misleading.
5. Every marketing message includes your business name, a postal address and contact details.
6. Every marketing message has an easy unsubscribe link and a list-unsubscribe header.
7. Unsubscribes take effect automatically and immediately, and suppression entries are kept permanently.
8. Marketing and transactional messages are separated and promotions are not hidden in service mail.
9. Business and personal addresses are tagged, and country-specific rules are applied to each.
10. Agreements with agencies, partners and platforms say who handles consent, unsubscribes and records.
11. A named person owns the policy and reviews it at least quarterly and whenever you enter a new country.
12. Anything unclear goes to a qualified lawyer before you send.

A note on MigoSMTP: our platform helps you send and manage email, but compliance is the responsibility of the sender. Check your MigoSMTP account or API documentation for exact details on unsubscribe handling, suppression and acceptable use before you plan your program.

Further reading and sources

These are public primary sources and regulator pages. Use them to confirm the current law, because this guide is a summary and not legal advice.

• FTC: CAN-SPAM Act, a compliance guide for business
• CRTC: Canada anti-spam legislation information
• Justice Laws Website: Canada anti-spam legislation text
• ICO: Direct marketing and privacy and electronic communications
• EUR-Lex: Directive 2002/58/EC (ePrivacy Directive)
• EUR-Lex: Regulation (EU) 2016/679 (GDPR)
• ACMA: Avoid sending spam (Spam Act 2003 guidance)
• TRAI: Telecom Regulatory Authority of India (commercial communications rules)
• MeitY: Ministry of Electronics and Information Technology (data protection law and rules)