Email marketing compliance for ecommerce: CAN-SPAM, GDPR and CASL rules

Email remains the highest ROI channel for ecommerce, generating an average of $36 for every $1 spent according to Litmus. But the same channel that drives revenue also carries compliance obligations across multiple overlapping legal frameworks depending on where your customers are located.

The three frameworks every ecommerce store with English-speaking customers needs to understand are: CAN-SPAM (United States), GDPR (European Union and EEA) and CASL (Canada). They take fundamentally different approaches to the same activity. Understanding the differences is not optional if you have customers in multiple markets.

CAN-SPAM: the US opt-out model

The CAN-SPAM Act, passed in 2003 and enforced by the FTC, governs commercial email to US recipients. It takes an opt-out approach: you can send commercial email to people who have not asked for it, as long as you give them a clear way to opt out and honor that request promptly.

CAN-SPAM requirements for every commercial email:

• Honest header information. From, To, Reply-To and routing information must accurately identify the sender. Domain spoofing violates CAN-SPAM.
• No deceptive subject lines. Subject lines cannot mislead recipients about the content or purpose of the message.
• Identify the message as an advertisement. Required, though the disclosure can be inconspicuous. Many senders put a small note in the footer.
• Physical postal address. Every commercial email must include a valid physical postal address for the sender. A PO box is acceptable. This is non-negotiable and commonly missed by small stores.
• Clear unsubscribe mechanism. Every commercial email must include a clear and conspicuous explanation of how recipients can opt out of future messages. The mechanism must be easy to execute.
• Honor opt-out requests within 10 business days. After an opt-out request, you must stop sending commercial emails to that address within 10 business days. You cannot require more than an email address and choice from the recipient to opt out.
• Monitor third-party senders. If you hire another company to send email on your behalf, you are still legally responsible for CAN-SPAM compliance.

CAN-SPAM penalties run to $51,744 per violation. Each non-compliant email sent to each recipient is a separate violation. A bulk send of 10,000 non-compliant emails could theoretically be 10,000 violations. In practice the FTC brings actions against systematic violators rather than pursuing individual emails, but the per-email structure means fines scale with list size.

Critically: CAN-SPAM does not require prior consent. A US store can legally email anyone, as long as each email meets the CAN-SPAM requirements and opt-outs are honored. This is fundamentally different from the GDPR and CASL approach. Stores subject to CCPA/CPRA obligations also need to consider how email data collection intersects with the right to opt out of sale and sharing.

GDPR: the EU opt-in model

GDPR does not directly regulate email marketing, but its requirements for lawful processing of personal data effectively mandate prior consent for marketing emails to EU residents. GDPR is reinforced by the ePrivacy Directive (currently implemented as national laws across EU member states), which specifically requires prior opt-in consent for direct marketing by electronic means.

Under GDPR, sending a marketing email to an EU resident requires a valid legal basis. For direct marketing, the only realistic legal basis is consent under Article 6(1)(a), or legitimate interests under Article 6(1)(f) in limited circumstances. Legitimate interests is not a reliable basis for unsolicited marketing to prospects who have no prior relationship with you.

Valid GDPR consent for email marketing must be:

• Freely given. Bundling email marketing consent with a purchase or service delivery is not freely given consent. The customer must be able to buy from you without agreeing to marketing.
• Specific. Consent for "marketing communications" is too broad. Customers should know they are consenting to email specifically, not just a general statement about marketing.
• Informed. Customers must understand who is sending the emails and for what purposes before giving consent.
• Unambiguous. Consent must be by a clear affirmative action. Pre-ticked boxes do not constitute valid GDPR consent. The customer must actively opt in.

GDPR also requires that withdrawing consent is as easy as giving it. An unsubscribe link in every email satisfies this technically, but complex unsubscribe flows or re-engagement prompts before unsubscribing are problematic.

The GDPR's soft opt-in exception, derived from the ePrivacy Directive, allows marketing to existing customers about similar products and services without fresh consent. The conditions: the customer purchased from you, you collected their email address during the purchase, you gave them a clear opportunity to opt out at collection and in subsequent messages and the new email is about a similar product or service to the one they bought. This exception is narrower than many operators believe.

CASL: Canada's strict consent framework

Canada's Anti-Spam Legislation, in force since 2014, is one of the strictest commercial email frameworks globally. CASL applies to commercial electronic messages sent to Canadian recipients. It requires prior express or implied consent, includes specific formalities and carries significant penalties.

CASL distinguishes between express and implied consent:

• Express consent. The recipient has explicitly opted in to receiving commercial messages. Must include the purpose, the name of the entity requesting consent and, if collected on behalf of another organization, that organization's identity. Express consent does not expire.
• Implied consent. Arises from an existing business relationship: a purchase, a service contract or a business inquiry within the past two years. Implied consent expires after two years from the last transaction. Membership in a club or loyalty program also creates implied consent for the duration of membership.

CASL also requires that every commercial message include: the sender's name, contact information (mailing address plus phone, email or web address) and an unsubscribe mechanism that works within 10 business days.

CASL penalties are severe: up to $1 million per violation for individuals and up to $10 million per violation for organizations. Unlike CAN-SPAM, there is a private right of action under CASL (though this provision has been suspended pending government review). The CRTC (Canadian Radio-television and Telecommunications Commission) actively enforces CASL. Notable fines include $150,000 against Rogers Communications and $200,000 against Kellogg Canada.

Transactional vs commercial emails

All three frameworks distinguish between transactional (relationship) emails and commercial (marketing) emails, but they draw the line differently.

Under CAN-SPAM, a "transactional or relationship message" facilitates an existing commercial transaction, provides warranty or recall information, or provides account or subscription update information. Transactional messages are exempt from most CAN-SPAM requirements (though the header accuracy requirement still applies). Adding marketing content to a transactional email converts it to a commercial message, meaning CAN-SPAM commercial requirements apply to the entire message.

Under GDPR, transactional emails for order confirmation, shipping updates and account management can proceed under contract performance as the legal basis, without marketing consent. The moment you add promotional content, you need a separate legal basis (typically consent) for the promotional element.

Under CASL, transactional messages are exempt if their primary purpose is completing or confirming a transaction. An order confirmation email with a promotional coupon is not purely transactional. CASL looks at the primary purpose: if the email is substantially about promoting products, consent is required.

Abandoned cart email compliance

Abandoned cart emails are one of the highest-converting email automations in ecommerce, typically generating 5-15% recovery rates. They are also a compliance risk area.

Under CAN-SPAM, an abandoned cart email is a commercial message. The person has not completed a purchase, so there is no existing transaction relationship to claim. CAN-SPAM compliance requirements apply in full. In practice this is manageable: include your address, an unsubscribe link and accurate headers.

Under GDPR, an abandoned cart email to an EU resident requires a valid legal basis. If the person added items to their cart without creating an account or providing their email for a stated marketing purpose, you likely do not have consent to send them a marketing email. If they entered their email explicitly to "save their cart" or as part of a checkout flow where you disclosed marketing emails, you may have a basis. This is why many EU-focused stores implement explicit consent at the cart email capture step.

Under CASL, the implied consent from a business inquiry covers someone who started but did not complete a checkout. The inquiry within the last two years creates implied consent. So a single abandoned cart email is generally permissible under CASL, but ongoing promotional sequences require express consent.

Post-purchase email sequence compliance

Post-purchase flows typically include: order confirmation (transactional), shipping update (transactional), delivery confirmation (transactional), review request (commercial/transactional gray area) and cross-sell/upsell emails (commercial).

Under CAN-SPAM, the transactional emails are exempt. The review request is a gray area: it primarily serves the business (getting reviews) while having some transactional quality (completing the customer's experience). Most practitioners treat it as commercial and include CAN-SPAM compliance elements. Cross-sell and upsell emails are commercial and require full CAN-SPAM compliance.

Under GDPR, the order confirmation, shipping update and delivery confirmation proceed under contract performance. The review request and cross-sell emails require a separate legal basis. The GDPR soft opt-in exception (similar products to existing customers) covers cross-sell emails in many cases, provided the opt-out opportunity was given at purchase.

Under CASL, the purchase creates two years of implied consent. The entire post-purchase sequence can proceed under implied consent during that window, as long as each email includes the required identification and unsubscribe information.

List hygiene and compliance

Beyond the per-email requirements, ongoing list hygiene is a compliance and deliverability concern:

• Honor unsubscribes promptly. Under CAN-SPAM you have 10 business days. Best practice is immediate processing. Re-adding unsubscribed contacts to your list is a CAN-SPAM violation.
• Suppress opt-outs across automations. An opt-out from your newsletter must suppress all commercial marketing emails, not just the newsletter. Continuing to send abandoned cart emails to someone who unsubscribed from your newsletter is non-compliant.
• Remove hard bounces. Continuing to send to hard bounces signals poor list hygiene to email providers and increases spam classification risk.
• Document consent. Under GDPR and CASL, you need to be able to prove that a subscriber gave valid consent. Store the timestamp, source and consent text at the time of signup. This becomes critical if you face a regulatory complaint or a privacy policy review by a supervisory authority.
• Purge dormant contacts appropriately. GDPR's storage limitation principle requires that you do not retain personal data longer than necessary. Your privacy policy should document retention periods for each data category. Long-dormant subscribers who have not engaged in years may need to be purged or re-consented.

Double opt-in best practices

Double opt-in, where a subscriber must confirm their email address by clicking a link in a confirmation email before being added to your list, is not required by any of the three frameworks. But it delivers significant compliance benefits:

• It creates a clear consent record with a timestamp and confirmation action.
• It eliminates fake email addresses entered by others without the owner's knowledge.
• It improves list quality by ensuring only genuine subscribers are added.
• It strengthens GDPR consent records since you have both the initial signup and the confirmation.

For EU audiences, double opt-in is strongly recommended. For US audiences, it reduces conversion rates compared to single opt-in but improves list engagement metrics. For Canadian audiences, it creates a stronger express consent record than single opt-in.

Email platform compliance features

Major email platforms for ecommerce have built compliance tools into their products:

• Klaviyo. Offers GDPR compliance mode, consent tracking, automatic unsubscribe processing and data subject request handling. Stores consent timestamps and source information per subscriber. Supports double opt-in natively.
• Mailchimp. Includes GDPR fields and consent notes on forms, automatic unsubscribe processing, data export and deletion for GDPR requests and CAN-SPAM compliant footer elements by default.
• Omnisend. Provides consent management features, GDPR data subject request tools, automatic suppression of unsubscribes and CASL-specific consent tracking for Canadian segments.

Having a compliant platform does not mean you are automatically compliant. You still need to configure the tools correctly, add the required physical address, use GDPR-compliant consent forms for EU signups and segment your list by geography to apply the appropriate compliance rules. Your Google Consent Mode v2 configuration should also reflect the consent state of your email subscribers when they visit your store.

Frequently asked questions

Does CAN-SPAM require opt-in consent before sending marketing emails?

No. CAN-SPAM takes an opt-out approach: you can send commercial email to US recipients without prior consent, as long as each email includes a physical address, honest headers, an unsubscribe mechanism and you honor opt-out requests within 10 business days.

What is the difference between CAN-SPAM and GDPR for email marketing?

CAN-SPAM allows unsolicited marketing emails with an opt-out mechanism. GDPR requires prior opt-in consent before sending marketing emails to EU residents. A store compliant with GDPR consent requirements will generally satisfy CAN-SPAM, but not the reverse.

Are abandoned cart emails legal under GDPR?

Only if you have a valid legal basis. If someone entered their email during checkout where you disclosed marketing use, you may have consent. Without explicit consent or a qualifying soft opt-in from a prior purchase, sending abandoned cart emails to EU residents violates GDPR.

Is double opt-in required for email marketing?

No law requires double opt-in, but it is strongly recommended for EU audiences. Double opt-in creates a clear consent record with a timestamp and confirmation action, strengthens GDPR compliance and eliminates fake signups.