Definition
Spam compliance refers to adherence to laws and regulations governing commercial email, primarily CAN-SPAM (US), CASL (Canada), and GDPR/ePrivacy (EU/UK). Compliance requirements cover consent, sender identification, subject line accuracy, physical address disclosure, unsubscribe processing, and data protection.
Non-compliance can result in substantial penalties — up to $43,792 per violation under CAN-SPAM and up to 4% of global turnover under GDPR.
Key Requirements by Regulation
| Requirement | CAN-SPAM (US) | CASL (Canada) | GDPR/ePrivacy (EU) |
|---|---|---|---|
| Consent type | Opt-out | Opt-in (implied expires 2 years) | Opt-in (explicit for marketing) |
| Sender identification | Required | Required | Required |
| Physical address | Required | Required | Required |
| Subject line accuracy | Required | Required | Required |
| Unsubscribe mechanism | Required within 10 days | Required within 10 business days | Required immediately |
| Consent records | Not required | Required | Required |
| Data protection | Not specified | Not specified | Comprehensive requirements |
Core Compliance Elements
- Consent: Obtain proper permission before sending commercial email
- Identification: Clearly identify yourself as the sender
- Subject lines: Do not use deceptive subject lines
- Physical address: Include a valid physical postal address
- Unsubscribe: Provide a clear, working unsubscribe mechanism
- Processing: Honour unsubscribe requests promptly
- Records: Maintain records of consent and unsubscribe requests
Best Practices
- Use confirmed opt-in (double opt-in) for the strongest consent record
- Include a physical address in every email footer
- Make unsubscribe a single-click process with no login required
- Process unsubscribes immediately rather than within legal timeframes
- Maintain clear records of when, where, and how consent was obtained
- Regularly audit your email programme for compliance gaps
- Stay informed about regulatory changes in jurisdictions where your subscribers live
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Anonymized Data
Anonymized data is email subscriber or interaction data that has been stripped of personally identifiable information so individuals cannot be re-identified.
Australia Spam Act 2003
The Australian Spam Act 2003 bans unsolicited commercial email, requiring consent, accurate sender information and a clear, working unsubscribe facility on every message.
Brazil LGPD Email Marketing
Brazil's LGPD regulates personal data use for marketing, requiring a legal basis such as consent or legitimate interest, plus transparency and clear opt-out in email campaigns.
CAN-SPAM Act
The CAN-SPAM Act is a US law that sets rules for commercial email. It requires accurate subject lines, a physical address, a clear opt-out mechanism, and prompt processing of unsubscribes. Violations can result in penalties up to $51,744 per email.
Canada CASL Guide
CASL (Canada's Anti-Spam Legislation) requires express or implied consent, clear identification, and a functioning unsubscribe mechanism before sending commercial electronic messages to Canada.
Frequently Asked Questions
Failing to have proper consent records is the most common compliance gap. Many marketers cannot demonstrate when, where, and how a subscriber consented. Without documented consent, any complaint or audit creates regulatory risk.
Yes. CAN-SPAM applies to all commercial email regardless of audience. CASL has specific provisions for business-to-business email. GDPR applies to personal data of individuals, including business email addresses that identify an individual. B2B email is not exempt from spam regulations.
Retain consent records for the duration of the subscriber relationship plus a reasonable period after they unsubscribe or are suppressed. Most experts recommend 3-6 years after the end of the relationship. Check specific requirements in your jurisdiction as some regulations have defined retention periods.