All posts
Compliance2026/11/04

Email privacy policy guide: core disclosures for signup forms and lists

What to disclose when collecting and verifying email addresses under GDPR, CCPA and CASL, and how to link privacy notices at the point of capture.

Note: This guide is an educational summary reviewed on 2026-11-04 and does not constitute legal advice. Have qualified counsel review your privacy notices for the jurisdictions where you operate.

Whenever you collect an email address on a signup form, checkout page or lead magnet, data protection and anti-spam laws require clear disclosures about who is collecting the address, why, and how the subscriber can exercise their rights.

Core elements to disclose at collection and in your policy

Under frameworks such as GDPR (Articles 13 and 14), California's CCPA (notice at collection) and Canada's CASL, a transparent email privacy notice covers:

  • Controller identity and contact details: the legal name of your organization, physical address and a working contact point for privacy requests.
  • Purposes of processing: whether the address is used only for transactional account messages, a specific newsletter, or broader marketing communications.
  • Service providers and subprocessors: the categories of third-party processors that handle the address (such as your email service provider, CRM and email verification provider).
  • Retention and deletion: how long subscriber records and verification logs are kept and how a user can request deletion.
  • Withdrawal of consent and opt-out: a clear statement that marketing consent can be withdrawn at any time via the unsubscribe link in every message.

Placing notices on signup forms

Do not hide material terms behind a generic footer link. Place a short, plain-language summary directly next to the email input field linking to your full privacy policy, use an unchecked opt-in box where consent is required, and verify the submitted address so confirmation and opt-out notices reach a real mailbox.

Sources

All posts