Compliance and privacy

• State the four obligations most email laws share
• Know which regime applies to which recipients
• Set up opt-out and records that satisfy them

A lawful basis to send (consent in many places, an opt-out regime in others), honest sender details and subjects, a way to identify and contact you, an easy opt-out you honour quickly, and records.

GDPR for people in the EU and UK, CAN-SPAM in the United States, CASL in Canada, and CCPA for California residents’ personal information. When you send across borders, follow the strictest rule that applies to each recipient.

Record consent with wording and time. Put every opt-out and complaint on a suppression list at once. Limit what you collect and set a retention period. Review rules on a schedule because they change.

This guide gives general information only. Ask a qualified lawyer about your own situation. Last reviewed 26 October 2026.

• ☐ List the countries your recipients are in
• ☐ Match each to a rule and read it
• ☐ Add a working unsubscribe to every marketing email
• ☐ Keep a suppression list separate from campaign lists
• ☐ Set a retention period for inactive contacts
• ☐ Schedule a six-monthly review of the rules

• Compliance overview
• GDPR basics
• CAN-SPAM guide
• CASL guide
• CCPA