Compliance

Transactional vs. marketing

Most email laws distinguish messages a person needs — receipts, password resets, account notices — from commercial messages promoting a product. Transactional mail generally doesn’t need marketing consent or an unsubscribe link, but it must stay transactional: adding promotions turns it into marketing.

This is a practical summary, not legal advice. Check the rules for the countries you send to.

CAN-SPAM (United States)

CAN-SPAM allows sending marketing without prior consent, but every message must follow these rules.

• Don’t use false or misleading header information or subject lines.
• Identify the message as an advertisement where required, and include a valid physical postal address.
• Include a clear way to opt out, and honour opt-outs within 10 business days.

GDPR and ePrivacy (EU and UK)

Marketing email to individuals generally requires prior, freely given consent — a pre-ticked box doesn’t count. A narrow "soft opt-in" can apply to existing customers for similar products, provided they could opt out when you collected their address and in every message.

GDPR also covers the data itself: tell people what you collect and why, keep records of consent, and delete personal data on request. Open and click tracking processes personal data and should be disclosed in your privacy policy.

CASL (Canada)

Canada's anti-spam law requires express or implied consent before sending commercial email, identification of the sender, and a working unsubscribe mechanism in every message. It is one of the strictest laws, with significant penalties.

Unsubscribes and suppression

Whatever the law, make leaving easy: a visible unsubscribe link and a List-Unsubscribe header for one-click unsubscribing, which Gmail and Yahoo now require for bulk marketing mail.

An unsubscribe must stick everywhere. MailCraft keeps one suppression list across transactional and marketing sends, so an unsubscribed or complaining address is never emailed again by accident.

Check it yourself