Email marketing law has a reputation for being complicated, and in some respects it is. Rules differ between countries, between individual and business recipients, and between new contacts and existing customers.
The core principles, however, are fairly consistent. Send marketing only to people who have an appropriate reason to receive it, be clear about who is sending and why, keep evidence of how each address was obtained, and make leaving the list easy.
This article explains those principles in plain language, with particular attention to the European Union and Spain, where the GDPR and national electronic communications rules apply together. It also outlines the main differences in the UK, the United States and Canada.
This article is general information, not legal advice. For decisions about a specific situation, consult a qualified professional or the relevant data protection authority.
Key takeaways
- In the EU, email marketing is governed by two layers of law: the GDPR for personal data and national electronic communications rules, such as Spain's LSSI, for the act of sending marketing messages.
- As a general rule, marketing emails to individuals in the EU require prior consent. Valid consent is freely given, specific, informed and expressed through a clear affirmative action.
- Pre-ticked boxes, consent hidden inside terms and conditions and silence do not count as consent.
- An exception commonly exists for existing customers receiving information about similar products or services, provided they were offered an easy way to refuse from the start and in every message.
- Senders should be able to prove how and when each subscriber agreed to receive emails. If consent cannot be proved, it should be treated as missing.
- Every marketing email must offer a simple, free way to unsubscribe, and unsubscribes must be respected promptly and permanently.
- Bought or scraped lists are a poor legal and practical foundation for email marketing.
- Rules differ outside the EU. The US CAN-SPAM Act, for example, is based mainly on opt-out rather than prior consent.
Two layers of law, explained simply
In the European Union, email marketing sits at the meeting point of two sets of rules.
Data protection law. The General Data Protection Regulation (GDPR) applies whenever personal data is processed, and an email address that identifies a person is personal data. The GDPR governs how addresses are collected, what people must be told, how long data is kept, which rights subscribers have and how service providers must be managed.
Electronic marketing law. The EU ePrivacy Directive sets specific rules for unsolicited electronic marketing, and each member state implements them in its own legislation. In Spain, this is the Ley de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI). Articles 21 and 22 of the LSSI set the rules on sending commercial communications by email and on the right to stop receiving them.
Both layers apply at the same time. In Spain, the data protection authority (AEPD) treats the LSSI as the specific rule for commercial email: the general GDPR concept of "legitimate interest" is not, by itself, enough to justify sending marketing emails outside the cases the LSSI allows.
The European Commission has proposed changes to the GDPR and ePrivacy rules as part of its "Digital Omnibus" simplification package. At the time of writing, the data protection part of those proposals is still being negotiated, so it is worth monitoring the outcome.
What valid consent looks like
Under the GDPR, consent must be:
- Freely given. People must have a genuine choice. Making a purchase, a download or access to a service conditional on accepting marketing emails, when the emails are not necessary for that service, undermines this.
- Specific. Consent to receive a newsletter is not consent to everything. If the organisation wants to send marketing by email and by SMS, or share addresses with partners, each purpose needs its own choice.
- Informed. People must know who will send the messages, what kind of content they will receive and how to withdraw.
- Unambiguous. It must be expressed through a clear affirmative action, such as ticking an empty box or submitting a form whose purpose is plainly to subscribe.
Some common practices fail these tests:
- pre-ticked boxes;
- consent included in general terms and conditions or privacy policies;
- a single checkbox covering several unrelated purposes;
- assuming consent from silence, inactivity or a visit to the website;
- collecting a business card or an address at an event and adding it to the newsletter without asking.
Consent must also be as easy to withdraw as it was to give. If subscribing took one click, unsubscribing should not require logging in, filling in a form or sending a letter.
What to tell people at signup
When collecting an email address, the GDPR requires clear information about how it will be used. On a signup form, a short line next to the button with a link to the full privacy policy is usually the practical solution. It should cover at least:
- who is responsible for the data;
- what the address will be used for, such as a monthly newsletter with offers and news;
- the legal basis, which for newsletters is normally consent;
- whether service providers or other recipients will have access to the data;
- how long the data will be kept;
- how to exercise rights such as access, deletion and withdrawal of consent, and the right to complain to the data protection authority.
The wording should be understandable to a non-lawyer. Long, vague text does not make consent more valid; it usually makes it less so.
Is double opt-in mandatory?
Double opt-in, where the subscriber confirms their address by clicking a link in a confirmation email, is not generally required by the GDPR or the LSSI.
It is, however, a strong practical safeguard. It prevents people from subscribing someone else's address, reduces typing errors and spam traps, and provides solid evidence that the owner of the address actually agreed. For most small organisations, its benefits outweigh the small loss of subscribers who never confirm.
The exception for existing customers
Most European rules include an exception that allows organisations to email their own customers without separate prior consent, under strict conditions. In Spain, it appears in article 21.2 of the LSSI; in the UK it is known as the "soft opt-in".
In Spain, the exception generally requires that:
- there is a prior contractual relationship with the recipient, such as a purchase or a contracted service;
- the contact details were obtained lawfully in the course of that relationship;
- the emails concern the sender's own products or services similar to those the customer originally acquired;
- the customer was offered a simple, free way to refuse marketing when their details were collected;
- every message offers the same simple way to opt out.
The exception is narrower than it may appear. A customer who bought a cookery course can reasonably receive information about other courses; promoting unrelated products, sending partners' offers or contacting people who only requested a quote is much harder to justify. When in doubt, asking for consent is the safer approach.
Business addresses and B2B email
It is a common belief that email marketing to companies is exempt from consent rules. That is not a safe assumption.
In Spain, the LSSI rules on commercial communications apply to recipients in general, and the AEPD has applied them to messages sent to professional addresses. An address such as maria.lopez@company.com also identifies a person, so the GDPR applies to it.
Other countries treat business recipients differently. The UK, for example, applies looser electronic marketing rules to corporate subscribers, while still requiring an opt-out and compliance with data protection law. Check the rules of each country where recipients are located.
Bought lists, rented lists and public addresses
Buying or renting an email list is rarely compatible with European rules. The people on the list did not consent to receive messages from the buyer, and consent given to a third party generally does not transfer.
The same applies to addresses collected from websites, directories or social networks. An address being publicly visible does not mean its owner has agreed to receive marketing.
Apart from the legal risk, these lists perform poorly. Recipients who never asked for the messages tend to ignore them, mark them as spam or never receive them because the addresses are outdated, all of which damages sender reputation.
Keeping evidence of consent
The GDPR requires organisations relying on consent to be able to demonstrate it. If a subscriber or the data protection authority asks how an address came to be on the list, "they must have signed up at some point" is not an adequate answer.
That leads to the single most useful rule in this whole subject: if you cannot prove consent, treat it as missing. An address without a record of where, when and how it was obtained should not receive marketing until that consent has been confirmed.
A useful consent record includes:
| Information | Example |
|---|---|
| Email address | subscriber@example.com |
| Date and time | 9 November, 10:42 |
| Source | Newsletter form in the blog footer |
| What was accepted | Monthly newsletter with news and offers |
| Wording shown | The checkbox text and privacy notice version |
| Confirmation | Double opt-in confirmed on the same day |
Most email platforms store part of this automatically. Check that the information survives imports, exports and migrations between platforms.
Unsubscribes: simple, free and permanent
The right to stop receiving marketing is the easiest legal obligation to understand, and one of the most frequently mishandled.
In Spain, the LSSI requires every commercial email to include a simple, free procedure for refusing further messages, and allows recipients to withdraw consent at any time. In practice, this means:
- A visible unsubscribe link in every marketing email. It should not be hidden in tiny text or disguised.
- No obstacles. Unsubscribing should not require logging in, explaining the reason or completing several steps. An optional question about why the person is leaving is fine; a mandatory one is not.
- Prompt processing. European rules do not set a fixed number of days, but requests should be applied without undue delay. Major mailbox providers expect bulk senders to process one-click unsubscribes within two days, and many platforms do it instantly.
- Permanence. An unsubscribed address must not return to marketing lists through a new import, a different list or a change of platform.
- Respect for all channels. If a person unsubscribes by replying to an email or writing to customer service, the request counts just as much as one made through the link.
A preference centre that offers fewer emails or specific topics can retain some subscribers who would otherwise leave, but it must always include the option to unsubscribe from all marketing.
Keeping an unsubscribed address in a suppression list is normally appropriate. Its purpose is to ensure the person is never emailed again, not to continue marketing to them.
Email service providers and other processors
The email platform processes subscriber data on behalf of the sender. Under the GDPR, this requires a written data processing agreement setting out what the provider may do with the data. Most reputable platforms include one in their terms.
Check also where the data is stored and processed. If it leaves the European Economic Area, appropriate safeguards for international transfers must be in place. The legal responsibility for the data remains with the organisation sending the emails, whichever platform it uses.
Identify the sender and the commercial purpose
Recipients should be able to tell immediately who is writing and that the message is commercial. In Spain, the LSSI requires commercial communications to be clearly identifiable as such and to identify the person or company on whose behalf they are sent.
In practice: use a recognisable sender name and an address on the organisation's own domain, write subject lines that reflect the content, include the company's identification details in the footer and avoid disguising promotions as personal or transactional messages.
Outside the European Union
Organisations emailing people in other countries need to consider the rules where the recipients are, not only where the sender is based.
| Jurisdiction | Main rules | Model in brief |
|---|---|---|
| United Kingdom | PECR and UK GDPR | Consent for individuals, with a soft opt-in for existing customers and, since 2026, for certain charitable purposes; looser rules for corporate subscribers |
| United States | CAN-SPAM Act | Mainly opt-out: honest headers and subject lines, a postal address, and an opt-out that must be honoured within 10 business days |
| Canada | CASL | Express or implied consent, sender identification and an unsubscribe mechanism |
| Latin America | National laws | Each country has its own data protection and commercial communication rules; check the specific market |
CAN-SPAM's opt-out model does not make it permissive: penalties are calculated per non-compliant email and can add up quickly. And a list built to US rules is not automatically usable for recipients in Europe.
US Federal Trade Commission: CAN-SPAM compliance guidance
Information Commissioner's Office: guidance on direct marketing using electronic mail
CRTC: guidance on consent under Canada's Anti-Spam Legislation
A practical compliance checklist
For a small team sending to subscribers in Spain or elsewhere in the EU, the essentials fit on one page:
- Signup forms use an unticked checkbox or an unmistakable subscribe action, separate from other terms.
- Each purpose that needs consent has its own choice.
- A short privacy notice next to the form explains who, what, why and how to withdraw, with a link to the full policy.
- Double opt-in is enabled, or there is another reliable way to verify addresses.
- Consent records show the source, date and wording for each subscriber.
- Existing customers contacted without separate consent meet every condition of the exception, including the opt-out offered at collection.
- No bought, rented or scraped lists are used.
- Every marketing email identifies the sender and includes a working unsubscribe link.
- Unsubscribes are processed promptly and kept in a permanent suppression list.
- The email platform has a data processing agreement and appropriate safeguards for any international transfer.
- The rules of each country where significant groups of subscribers live have been checked.
Frequently asked questions
Can I email people who gave me their business card?
Not automatically. Handing over a business card is not consent to receive a newsletter. The safest approach is to send a single, personal follow-up related to the conversation and, if appropriate, invite the person to subscribe.
What happens to subscribers collected before the current rules?
Old consent is valid only if it meets current standards and can be demonstrated. If the origin of part of a list is unclear, a re-permission campaign asking those contacts to confirm their subscription is usually safer than continuing to email them. Re-permission requests must themselves be sent lawfully, so they are not a solution for lists that were never obtained properly.
Is a transactional email subject to the same rules?
Receipts, password resets, shipping notifications and similar service messages do not usually require marketing consent. Adding significant promotional content to them can, however, turn them into commercial communications subject to marketing rules.
How long can subscriber data be kept?
As long as necessary for the purpose. For a newsletter, that is normally while the subscription is active. After an unsubscribe, keep only what is needed to respect it, such as the address in a suppression list. Long-inactive subscribers can be asked whether they want to continue, and removed if they do not respond.
What are the penalties?
They vary by country and by law. In Spain, infringements of the LSSI and the GDPR can lead to warnings or fines, and the AEPD regularly sanctions companies for unsolicited commercial email. Beyond fines, complaints and spam reports also damage deliverability and reputation.
Is consent needed to send a newsletter to members of an association?
It depends on the content and the relationship. Information strictly related to membership, such as meetings or fees, is not usually marketing. Promotions of products, services or third-party offers generally are, and should follow the rules described above.
Compliance as a sign of respect
Email marketing law can look like a list of obstacles, but most of its requirements describe good practice: email people who want to hear from you, tell them clearly what they are signing up for, keep honest records and let them leave whenever they wish.
If only one idea stays with you, make it this one: if you cannot prove consent, treat it as missing. Organisations that work this way rarely need to worry about the finer legal details, and they usually see better results as well. Lists built on genuine interest generate more engagement, fewer complaints and stronger deliverability than lists built on assumptions.
The rules will continue to evolve, in Europe and elsewhere. The principles behind them are unlikely to change.
Sources
- EUR-Lex: General Data Protection Regulation (EU) 2016/679
- BOE: Ley 34/2002 de servicios de la sociedad de la información y de comercio electrónico
- US Federal Trade Commission: CAN-SPAM compliance guidance
- Information Commissioner's Office: direct marketing using electronic mail
- CRTC: guidance on consent under CASL