Email marketing returns an average of $42 for every $1 spent. But that ROI comes with a condition: the rules are different depending on where your subscribers live, and the penalties for getting it wrong are significant.
A non-compliant campaign sent to EU residents can trigger a fine of up to €20 million. Emails sent to Canadian inboxes without documented consent expose you to CAD $10 million in penalties. In Australia, repeated violations can cost a corporation AUD $1.1 million per day.
Your email list does not respect borders. Your subscribers are in the US, EU, UK, Canada, Australia, Brazil, India, and Singapore simultaneously, and each jurisdiction has its own consent requirements, unsubscribe deadlines, and enforcement bodies. This guide covers all of them.
Understanding the International Email Marketing Laws Landscape
The most important principle in global email compliance is this: the law is determined by the recipient's location, not the sender's. A Texas-based business emailing someone in Berlin must comply with GDPR. A UK brand emailing someone in Toronto must comply with CASL.
Across every jurisdiction, three compliance pillars appear in some form: Consent, Identification, and Unsubscribe. The differences between countries come down to how strictly each pillar is defined.Some industries also have additional requirements for handling sensitive information. In the US, healthcare organizations that handle protected health information may need to consider HIPAA alongside general email marketing regulations. Depending on their responsibilities, comparing HIPAA compliance software can help them explore tools for managing specific healthcare compliance needs.
Opt-In vs. Opt-Out: The Core Legal Divide
The United States operates on an opt-out model: you can email someone without prior consent, as long as you follow the rules and honor opt-out requests. Almost every other major market requires opt-in: you need documented permission before the first email is sent.
Opt-in countries include the EU, UK, Canada, Australia, Brazil, India, and Singapore. If you design your program to the opt-in standard, you are compliant everywhere.
What Counts as a Commercial Email?
Transactional emails (order confirmations, password resets, shipping alerts) are generally exempt from marketing consent requirements. That exemption disappears the moment promotional content is added. An order confirmation that includes a discount code may be treated as a commercial message under CASL and GDPR.
United States: The CAN-SPAM Act
CAN-SPAM (2003) does not require prior consent but imposes seven strict rules on every commercial email:
- Accurate sender name and header information
- Non-deceptive subject lines
- Clear identification as an advertisement
- Physical mailing address in the footer
- A clear opt-out mechanism
- Unsubscribe requests honored within 10 business days
- Accountability for third-party senders acting on your behalf
2025 update: AI-personalized or AI-generated campaigns now require disclosure of that AI use.
Penalty: up to $53,088 per email, with no cap on total liability. California businesses meeting certain size thresholds also face CCPA obligations that overlap with subscriber data handling.
CAN-SPAM Checklist
- Sender name and address are accurate
- Subject line reflects the email content
- Footer includes a physical mailing address
- One-click unsubscribe is present and functional
- Unsubscribes processed within 10 business days
- AI personalization disclosed where used
European Union: GDPR
GDPR (2018) is the world's strictest email marketing framework. Prior consent is mandatory, and for that consent to be valid it must be freely given, specific, informed, and unambiguous. Pre-ticked boxes do not count. Silence does not count.
You must store proof of consent for every subscriber: timestamp, IP address, source URL, and the exact consent wording they agreed to.
Subscribers hold rights to access their data, correct it, have it erased, and receive it in a portable format. Your email program must be able to honor all of these.
Fines: up to €20 million or 4% of global annual turnover, whichever is higher.
Germany is the only EU member state where courts consistently require double opt-in. It is strongly recommended across the entire EU as the clearest demonstration of valid consent.
When choosing an email marketing platform, it's also worth checking how providers handle subscriber data and support GDPR compliance. This comparison of Brevo vs. Mailchimp can provide additional context on their features and data management practices.
What GDPR Means for Non-EU Businesses
If you have EU subscribers, GDPR governs how you handle their data, regardless of where your business is based. There is no geographic exemption for non-EU companies. The safest approach is to apply GDPR-level standards to your entire list.
United Kingdom: PECR and UK GDPR
Post-Brexit, the UK operates its own parallel framework enforced by the ICO. PECR governs direct email marketing and requires opt-in consent. UK GDPR governs how the data collected during that opt-in is handled.
A soft opt-in exception exists but is narrow: it applies only when contact details were obtained during a sale of a similar product or service, and the recipient was offered an opt-out at collection and in every subsequent email.
For B2B emails to corporate addresses, PECR permits an opt-out model, but UK GDPR still governs the underlying personal data.
2025 update: The Data Use and Access Act (June 2025) raises the ICO's maximum fine to £17.5 million or 4% of global annual turnover.
Canada: CASL
CASL (2014) is widely considered the world's strictest email law. It requires prior consent from Canadian recipients regardless of where the sender is based, and it includes a private right of action, meaning individuals can personally sue senders for damages without involving a regulator.
Express consent does not expire but requires a documented affirmative action to subscribe, with the consent request clearly stating who is sending, what they will send, and how to unsubscribe.
Implied consent applies to existing customer relationships (expires after 2 years) and recent inquiries (expires after 6 months). Exchanging business cards does not qualify as implied consent.
Every CASL-compliant email must include sender identification, a mailing address, and a working unsubscribe link. Unsubscribes must be processed within 10 business days.
Penalties: up to CAD $10 million per violation for businesses, CAD $1 million for individuals.
Australia: Spam Act 2003
Australia's Spam Act applies whenever there is an "Australian link," meaning the sender, server, or recipient is based in Australia. It requires consent, clear sender identification, and a functioning unsubscribe mechanism.
The key differentiator is the unsubscribe deadline: 5 working days, faster than the 10-day window in the US and Canada. The unsubscribe mechanism must also remain functional for at least 30 days after the email is sent.
Enforced by the ACMA. Fines for repeated corporate violations reach AUD $1.1 million per day.
Brazil, India, and Singapore
Brazil (LGPD, 2020) closely mirrors GDPR. It requires explicit consent or documented legitimate interest for marketing, and since 2024 mandates formal breach notification timelines. Fines reach 2% of Brazil-based revenue, capped at R$50 million per violation.
India (DPDP Act, 2023) requires explicit opt-in consent before any marketing email is sent. Organizations must provide clear notice of how data will be used and obtain verifiable consent. Penalties reach INR 250 crore (approximately $30 million USD). With 500 million email users, India is not an optional compliance market.
Singapore (PDPA + Spam Control Act) requires consent before collecting personal data for marketing, with clear sender identification and an unsubscribe option in every email. Singapore serves as the regional compliance reference point for APAC campaigns.
Email Spam Laws Worldwide: Side-by-Side Comparison
All figures current as of 2026. Laws change. Consult a qualified attorney for jurisdiction-specific advice.
Global Email Marketing Compliance: 7 Universal Rules
Rather than managing a separate policy for each country, build your program to satisfy GDPR and CASL simultaneously. Those are the two strictest frameworks, and compliance with both covers every other market in this article.
Rule 1: Get consent first. Documented opt-in, no pre-ticked boxes, no bundled consent with terms of service.
Rule 2: Document everything. Timestamp, IP address, source URL, and consent wording for every subscriber. The burden of proof is on you.
Rule 3: Identify yourself clearly. Real sender name, business name, and physical address in every email footer.
Rule 4: Make unsubscribing effortless. One click, no login, no fees, processed immediately.
Rule 5: Clean your list regularly. Remove bounced, inactive, and unsubscribed addresses. Sending to stale contacts damages your sender reputation and increases regulatory exposure. VitaMail's Email Validator removes invalid and risky addresses before they cause problems.
Rule 6: Authenticate your domain. SPF, DKIM, and DMARC are now mandatory requirements for bulk senders following Gmail and Yahoo's 2024 enforcement rules. VitaMail's Domain Health Checker audits your configuration and shows exactly what needs fixing.
Rule 7: Never buy or rent lists. Purchased lists violate GDPR and CASL directly and generate spam complaints under every other framework.
Email Authentication in 2025
Authentication is where legal compliance and deliverability intersect. SPF authorizes which servers can send on your behalf. DKIM signs each outgoing email cryptographically. DMARC tells receiving servers what to do with messages that fail those checks. BIMI can allow your brand logo to appear in supported inboxes when the necessary authentication and logo requirements are met.
For businesses setting up BIMI, it's also important to check that their logo meets the required specifications. A BIMI logo validator can help identify formatting or configuration issues before implementation.
A legally compliant email that fails authentication may never reach the inbox. Both matter equally
Email Marketing Regulations 2025: Key Changes
US: New FTC requirement to disclose AI use in personalized or automated campaigns.
UK: Data Use and Access Act (June 2025) raises ICO maximum fine to £17.5 million or 4% of global annual turnover.
Brazil: LGPD breach notification timelines formally enforced since 2024 and fully active in 2025.
EU: European Accessibility Act (June 2025) adds accessibility requirements to digital communications including email: screen-reader compatibility, meaningful alt text, and minimum color contrast standards.
Global inbox providers: Gmail and Yahoo bulk sender authentication requirements are fully enforced. This is no longer a recommendation.
AI-Generated Emails and Compliance
Under GDPR Article 22, individuals have the right not to be subject to decisions made solely by automated processing when those decisions significantly affect them. For email marketers, this applies to AI-driven segmentation and audience scoring. Maintain human oversight over AI-generated campaigns, document how AI is being used, and include disclosure language where AI personalization is material to the content.
The 7 Most Common Anti-Spam Violations That Get Businesses Fined
- Sending to purchased or scraped lists. Illegal under GDPR and CASL. High-risk under every other framework.
- Missing or broken unsubscribe links. Banned universally, no exceptions.
- No physical address in the footer. Required by CAN-SPAM, CASL, and the Australian Spam Act.
- Making opt-out difficult. Login requirements, fees, or multi-step barriers are explicitly prohibited.
- Misleading subject lines or sender names. Violates every framework covered in this article.
- No documented consent records. The most common enforcement vulnerability under GDPR and CASL. You must be able to prove consent was given.
- Continuing to email after unsubscribe. Processing delays beyond legal deadlines constitute violations in every jurisdiction.
Global Email Compliance Checklist
Consent
- Every subscriber opted in explicitly, no pre-ticked boxes
- Consent was separate from any terms of service agreement
- Timestamp, source URL, IP address, and consent wording stored for every subscriber
- Canadian implied consent records include the qualifying transaction date
- German subscribers collected via double opt-in
Email Footer
- Real sender name, business name, and physical address included
- Clear one-click unsubscribe link present in every email
List Management
- Hard bounces removed immediately
- Unsubscribes processed within the fastest applicable deadline
- No purchased, rented, or scraped lists in use
Domain Authentication
- SPF, DKIM, and DMARC configured and valid
- Third-party ESPs authorized in your SPF record
Documentation
- AI use disclosed where applicable (US 2025 requirement)
- Privacy policy describes how subscriber data is used and stored
- Regulatory updates reviewed quarterly
Stay Ahead of Email Marketing Laws by Country
Every major email marketing law in the world is trying to achieve the same three things: make sure recipients agreed to hear from you, make sure they know who is contacting them, and make sure they can stop at any time.
Build your program to GDPR and CASL standards. Document your consent practices, keep your list clean, authenticate your domain, and stay current on regulatory changes. That combination covers your legal obligations in every market in this guide simultaneously.
Laws will keep evolving. Revisit this page quarterly and follow updates from the FTC, ICO, CRTC, and ACMA directly.
Email compliance starts with a clean, verified list. Try VitaMail free: validate your contacts, check your domain health, and send with confidence in any country.
