Definition
Email forwarding consent concerns the legal and regulatory implications when recipients forward marketing emails to others. Forward-to-a-friend (FTAF) mechanisms — either automated tools within the email or manual forwarding by recipients — create complex consent scenarios that many email marketers overlook. When a subscriber forwards a marketing email, the forwarded recipient receives commercial content without having provided direct consent to the sender. This raises questions about data controller responsibilities, consent validity, and liability under CAN-SPAM, GDPR, and other regulations.
The regulatory treatment of forwarded email varies by jurisdiction. Under CAN-SPAM, the original sender is liable for the content of forwarded emails if they provided the forwarding mechanism, but liability for purely organic forwarding (where the recipient uses their own email client) is less clear. GDPR treats the forwarded recipient's data as being processed by both the sender and the forwarder, creating shared responsibility scenarios. The sender becomes a data controller for the forwarded recipient's data once they receive it, even though they did not collect it directly. This creates obligations to provide privacy notices, offer opt-out mechanisms, and establish a lawful basis for processing. Many organisations address this by ensuring that FTAF mechanisms include a disclosure to the forwarder about the data processing implications and by applying a confirmation step where the forwarded recipient can consent to further communications.
Best Practices
-
Design forward-to-a-friend mechanisms with a two-step consent process. The forwarding action should trigger an email to the friend with a clear disclosure about who is sending it, why they received it, and a simple opt-out mechanism. Do not add forwarded recipients to the marketing list automatically. Require affirmative action from the forwarded recipient before any future marketing emails are sent.
-
Include privacy disclosures within the forwarded email explaining how the recipient's email address was obtained. State the original sender's identity, the purpose of data processing, and the recipient's rights under applicable data protection law. Provide a clear and functioning unsubscribe mechanism that does not require the recipient to identify the original forwarder.
-
Document the forwarding mechanism in your privacy policy and data processing register. Describe how forwarded email addresses are collected, the lawful basis for processing (typically legitimate interest or consent), retention periods, and the rights available to forwarded recipients. Ensure your Data Protection Impact Assessment covers the forwarding functionality.
-
Limit automated forwarding to a single recipient per action to reduce data processing scope. Require the forwarder to confirm they have the recipient's permission to share their email address. Include a checkbox or confirmation statement such as "I confirm that I have permission to share this person's email address." Retain records of this confirmation.
-
Apply the same CAN-SPAM compliance standards to forwarded emails as to original sends. The forwarded email must include a valid physical postal address, functioning opt-out mechanism, and accurate subject line. Treat the forwarded email as a commercial message sent by the original organisation, regardless of who initiated the forward.
Related Glossary Terms
Email B2B Consent
The legal requirements for B2B email marketing consent, covering GDPR legitimate interest, CASL implied consent, CAN-SPAM exemptions, and jurisdiction-specific best practices.
Email CASL
Canada's Anti-Spam Legislation requirements for commercial electronic messages, including consent types, record-keeping, and penalties up to $10 million per violation.
Email CCPA
California Consumer Privacy Act requirements for email marketing, including consumer rights to access, delete, and opt out of data collection and sale.
Email Compliance Automation
Email compliance automation uses automated processes to manage unsubscribe processing, consent record-keeping, data retention enforcement, and regulatory monitoring within required legal timeframes.
Email Consent Age
Age of consent for email marketing across GDPR (16), COPPA (13), CASL, and PIPEDA jurisdictions, with age verification and compliance practices.
Email Consent Record
Email consent record-keeping captures proof of opt-in including timestamp, IP address, method, and exact wording shown. GDPR requires controllers to demonstrate consent upon request.
Frequently Asked Questions
Under CAN-SPAM, liability depends on whether you provided the forwarding mechanism. Automated forward tools integrated into your email make you liable for the forwarded message's compliance. For organic forwards using the recipient's own email client, liability is less clear but best practice is to ensure forwarded content itself is compliant.
Not without their consent. Adding forwarded recipients without permission violates GDPR's consent requirements and CAN-SPAM's prohibition on unsolicited commercial email. Forwarded recipients should receive a single confirmation email and must take affirmative action before being added to any marketing list.
The forwarded email should disclose who sent the original email, how the forwarded recipient's address was obtained, the purpose of processing, and a link to the full privacy policy. It must also include a functioning unsubscribe mechanism and contact information for data subject rights requests.
Yes. Once a forwarded recipient's email address is received by the original sender, GDPR applies to any processing of that address. The sender becomes a data controller for that data and must establish a lawful basis for processing, provide privacy information, and respect data subject rights.
Process opt-out requests from forwarded recipients exactly as you would for direct subscribers. The unsubscribe mechanism must work immediately and the preference must be honoured indefinitely. Retain suppression records for forwarded recipients who opt out, and ensure no future emails are sent to those addresses.