Email marketing to a global audience means navigating a complex patchwork of regulations. Each country or region has its own rules about consent, content, and data protection. This comprehensive guide covers email marketing laws across major markets, helping you build compliant international email programs.
The Global Email Compliance Landscape
Before diving into specific countries, understand the broader landscape.
Key Regulatory Models
Opt-In Model (Consent Required Before Sending):
Opt-Out Model (Can Send Until Someone Unsubscribes):
- United States (CAN-SPAM)
- Some less regulated markets
Hybrid Models:
- Some countries mix elements of both approaches
Common Requirements Across Jurisdictions
Despite differences, most email laws require:
- Sender identification
- Accurate subject lines
- Working unsubscribe mechanism
- Physical contact information
- Honoring opt-out requests promptly
Applying the Strictest Standard
Best Practice: When emailing internationally, apply the strictest applicable standard—typically GDPR or CASL—to your entire program. This ensures compliance across all jurisdictions and simplifies operations.
European Union
The EU represents the strictest email marketing environment, governed by GDPR and the ePrivacy Directive.
GDPR (General Data Protection Regulation)
Scope: All processing of EU residents' personal data.
Key Requirements:
- Explicit, freely given consent for marketing
- Clear, specific consent language
- Easy consent withdrawal
- Data subject rights (access, deletion, portability)
- Documentation of consent
- Data Protection Officers for certain organizations
- Data breach notification within 72 hours
Penalties: Up to €20 million or 4% of global annual turnover.
For detailed guidance, see our GDPR email marketing guide.
ePrivacy Directive
Scope: Electronic communications, including email marketing.
Key Requirements:
- Prior consent for marketing emails (with limited exceptions)
- Soft opt-in for existing customers (similar products/services)
- Clear unsubscribe in every message
- No hidden sender identity
Note: An ePrivacy Regulation is pending that may strengthen these requirements.
Country-Specific Variations
While GDPR provides baseline, EU member states have some variations:
Germany:
- Very strict consent interpretation
- Active enforcement
- Competition law implications for violations
France:
- CNIL actively enforces email rules
- Significant fines for consent violations
- Strong consumer protection focus
Italy:
- Garante per la Protezione dei Dati Personali enforcement
- Notable penalties for telemarketing/email violations
- Pre-checked boxes specifically prohibited
United Kingdom (Post-Brexit)
After Brexit, the UK has its own framework mirroring but separate from EU rules.
UK GDPR
Scope: Processing of UK residents' personal data.
Requirements: Largely mirrors EU GDPR with UK-specific elements:
- Consent requirements similar to EU
- Data subject rights preserved
- ICO (Information Commissioner's Office) as regulator
- UK adequacy decisions for international transfers
PECR (Privacy and Electronic Communications Regulations)
Scope: Electronic marketing to UK recipients.
Key Requirements:
- Prior consent for marketing emails
- Soft opt-in for existing customers
- Clear sender identification
- Working unsubscribe
- No concealed identity
Penalties: Up to £500,000 for PECR violations (separate from UK GDPR fines).
Practical Approach
For UK subscribers:
- Obtain consent using GDPR-style processes
- Honor soft opt-in for existing customers
- Include all required email elements
- Process opt-outs promptly
Canada
Canada's CASL is among the world's strictest anti-spam laws.
CASL (Canada's Anti-Spam Legislation)
Scope: Commercial electronic messages sent to or from Canada.
Key Requirements:
- Express or implied consent required
- Implied consent expires (6-24 months depending on type)
- Sender identification in every message
- Contact information (address + phone/email/web)
- Unsubscribe mechanism valid 60 days
- 10 business days to process opt-outs
Penalties: Up to $10 million CAD per violation for organizations.
For detailed guidance, see our CASL compliance guide.
Practical Considerations
Express Consent (preferred):
- Clear, affirmative opt-in
- Specific description of messages
- Documentation retained
Implied Consent (limited):
- Existing business relationships (24 months)
- Inquiries (6 months)
- Publicly published addresses (with conditions)
- Must convert to express before expiration
United States
The US has a more permissive federal framework but increasingly strict state laws.
CAN-SPAM Act
Scope: Commercial email sent to US recipients.
Key Requirements:
- Accurate header information
- Non-deceptive subject lines
- Identification as advertisement
- Physical postal address
- Working unsubscribe (30 days functional)
- Honor opt-outs within 10 business days
Note: CAN-SPAM allows unsolicited commercial email—consent isn't required until someone opts out.
For detailed guidance, see our CAN-SPAM compliance guide.
State Privacy Laws
California (CCPA/CPRA):
- Disclosure requirements for data collection
- Right to opt out of data sales/sharing
- Right to delete personal information
- Reasonable security requirements
See our CCPA email marketing guide.
Other States:
- Virginia, Colorado, Connecticut, Utah have passed privacy laws
- More states considering legislation
- Patchwork of requirements emerging
Practical Approach
For US subscribers:
- Meet CAN-SPAM baseline requirements
- Add CCPA disclosures for California residents
- Consider consent-based approach for better performance
- Monitor emerging state laws
Australia
Australia's Spam Act provides strong protections for recipients.
Spam Act 2003
Scope: Commercial electronic messages with Australian connection.
Key Requirements:
- Consent required (express or inferred)
- Clear sender identification
- Accurate contact information
- Functional unsubscribe
- 5 business days to process opt-outs
Inferred Consent:
- Publication of address in business context
- Existing business or other relationships
- Message relates to the relationship
Penalties: Up to $2.22 million AUD per day for serious violations.
Practical Considerations
For Australian Subscribers:
- Obtain consent before sending marketing
- Clearly identify sender in every message
- Include business contact information
- Provide easy unsubscribe
- Honor opt-outs within 5 business days
Brazil
Brazil's LGPD is often called the "Brazilian GDPR."
LGPD (Lei Geral de Proteção de Dados)
Scope: Processing of data of individuals in Brazil.
Key Requirements:
- Consent or other legal basis required
- Purpose limitation
- Data minimization
- Transparency obligations
- Data subject rights (access, correction, deletion, portability)
- Data Protection Officer for certain organizations
Marketing Consent:
- Must be free, informed, and unambiguous
- Specific to the purpose
- Easy to withdraw
Penalties: Up to 2% of Brazilian revenue, capped at R$50 million per violation.
Practical Approach
For Brazilian subscribers:
- Apply GDPR-style consent processes
- Provide Portuguese-language privacy notices
- Honor data subject rights
- Document consent appropriately
Japan
Japan has sector-specific and general privacy rules affecting email.
Act on Regulation of Transmission of Specified Electronic Mail
Scope: Commercial email to Japanese recipients.
Key Requirements:
- Consent required before sending (opt-in)
- Sender identification
- Contact information
- Working unsubscribe mechanism
- Immediate processing of opt-outs
APPI (Act on Protection of Personal Information)
Scope: Personal data of Japanese individuals.
Key Requirements:
- Purpose specification and limitation
- Proper handling and security
- Third-party transfer restrictions
- Data subject rights
Practical Approach
For Japanese subscribers:
- Obtain consent before marketing emails
- Provide clear sender identification in Japanese
- Include required contact information
- Offer easy unsubscribe
- Honor opt-outs promptly
South Korea
South Korea has strict electronic communication rules.
Act on Promotion of Information and Communications Network Utilization
Scope: Commercial communications to Korean recipients.
Key Requirements:
- Prior consent required
- Clear consent language
- Easy consent withdrawal
- Sender identification
- Unsubscribe mechanism
PIPA (Personal Information Protection Act)
Scope: Personal data of Korean individuals.
Key Requirements:
- Consent for collection and use
- Purpose limitation
- Data subject rights
- Data breach notification
- Overseas transfer restrictions
Penalties: Significant fines and potential criminal liability.
Practical Approach
For South Korean subscribers:
- Obtain explicit consent before marketing
- Provide Korean-language consent forms
- Clear unsubscribe in every message
- Honor data subject requests promptly
India
India has evolving privacy regulations affecting email marketing.
Current Framework
Information Technology Act, 2000:
- General data protection provisions
- Reasonable security practices required
- Consent for sensitive personal data
Digital Personal Data Protection Act, 2023:
- Consent requirements
- Purpose limitation
- Data subject rights
- Cross-border transfer rules
- Enforcement provisions (implementation ongoing)
Practical Approach
For Indian subscribers:
- Obtain consent for marketing emails
- Provide clear privacy notices
- Honor opt-out requests
- Monitor regulatory developments
Singapore
Singapore has strict spam control and data protection laws.
Spam Control Act
Scope: Unsolicited commercial communications to Singapore recipients.
Key Requirements:
- No sending to addresses on Do Not Call Registry
- Clear sender identification
- Valid contact information
- Functional unsubscribe
- Prompt opt-out processing
PDPA (Personal Data Protection Act)
Scope: Personal data of individuals in Singapore.
Key Requirements:
- Consent for collection, use, and disclosure
- Purpose limitation
- Data accuracy and retention
- Data protection measures
- Access and correction rights
Penalties: Up to S$1 million per violation.
Practical Approach
For Singapore subscribers:
- Check addresses against Do Not Call Registry
- Obtain consent for marketing
- Provide clear sender identification
- Include required contact information
- Offer easy unsubscribe
Other Notable Jurisdictions
New Zealand
Unsolicited Electronic Messages Act 2007:
- Consent required
- Clear sender identification
- Functional unsubscribe
- Contact information required
Hong Kong
Unsolicited Electronic Messages Ordinance:
- Unsubscribe mechanism required
- Sender identification
- No dictionary attacks or harvesting
- Opt-out must be honored
United Arab Emirates
Federal Decree-Law on Data Protection:
- Consent for processing
- Purpose limitation
- Data subject rights
- Cross-border transfer restrictions
South Africa
POPIA (Protection of Personal Information Act):
- Consent or other lawful basis required
- Purpose limitation
- Data subject rights
- Notification of data breaches
Building a Global Compliance Strategy
Managing compliance across multiple jurisdictions requires systematic approach.
Strategy 1: Apply Strictest Standard Globally
Approach: Apply GDPR/CASL-level requirements to all subscribers.
Pros:
- Simpler to manage
- Always compliant everywhere
- Better engagement (consent-based lists perform better)
- Future-proof as more countries adopt strict rules
Cons:
- May reduce list size in permissive markets
- Additional consent collection effort
Recommended for: Most organizations, especially those with diverse international audiences.
Strategy 2: Segment by Jurisdiction
Approach: Apply different requirements to different subscriber segments based on location.
Implementation:
- Identify subscriber location at signup
- Apply appropriate consent requirements
- Maintain different messaging rules by segment
- Track compliance requirements per jurisdiction
Pros:
- Maximizes list size in permissive markets
- Tailored approach to each market
Cons:
- More complex to manage
- Risk of errors
- Requires robust segmentation
Best for: Organizations with sophisticated compliance resources and significant presence in permissive markets.
Strategy 3: Focus on Key Markets
Approach: Prioritize compliance for your largest/most important markets.
Implementation:
- Identify primary markets
- Implement full compliance for those markets
- Basic compliance elsewhere
- Add markets as you expand
Pros:
- Manageable scope
- Prioritizes resources
- Addresses biggest risks
Cons:
- May miss violations in secondary markets
- Risk as presence grows
Practical Implementation
Regardless of Strategy:
Know Your Subscribers: Collect location data at signup.
Document Consent Properly: Record what, when, and how.
Include Required Elements: All messages need sender ID, contact info, and unsubscribe.
Honor Opt-Outs Promptly: Apply the strictest timeline (immediate is best).
Verify Email Lists: Use BillionVerify to maintain quality lists globally.
Monitor Changes: Regulations evolve—stay current.
Global Compliance Checklist
Use this checklist when emailing internationally.
Before Sending
- [ ] Consent documented for each subscriber
- [ ] Consent method complies with strictest applicable law
- [ ] Location/jurisdiction known for each subscriber
- [ ] Lists verified with email verification
Message Content
- [ ] Clear sender identification
- [ ] Accurate subject line
- [ ] Valid physical address
- [ ] Working unsubscribe link
- [ ] Additional contact method (phone/email/web)
- [ ] Compliant with strictest content requirements
Post-Send
- [ ] Opt-outs processed within shortest required timeframe
- [ ] Suppression lists synced across all systems
- [ ] Data subject requests honored (if received)
- [ ] Complaints addressed appropriately
Documentation
- [ ] Consent records maintained
- [ ] Processing activities documented
- [ ] Privacy policy current and accessible
- [ ] Training records for staff
Conclusion
International email marketing requires navigating diverse regulatory requirements, from GDPR's strict consent mandates to CAN-SPAM's permissive opt-out model. While the complexity can seem daunting, the solution is often straightforward: apply the strictest applicable standards globally, and you'll be compliant everywhere.
Key Takeaways:
Know Your Audience: Understand where your subscribers are located and what laws apply.
Consent Is Universal: Most jurisdictions now require some form of consent—treat it as the standard.
Required Elements Are Similar: Sender ID, contact info, and unsubscribe appear in nearly all laws.
Opt-Out Is Sacred: Honor unsubscribe requests immediately, regardless of jurisdiction.
Documentation Matters: Be able to demonstrate compliance wherever you send.
Quality Lists Help: Email verification supports compliance by ensuring valid, deliverable addresses.
Stay Current: Regulations evolve. Monitor changes in your key markets.
Building compliance into your email program from the start is easier than retrofitting later. By implementing proper consent collection, maintaining required message elements, and honoring subscriber preferences, you can confidently email audiences worldwide.
For detailed guidance on specific regulations, see:
- GDPR email marketing guide
- CAN-SPAM compliance guide
- CASL compliance guide
- CCPA email marketing guide
- Complete email compliance guide
Ensure your global subscriber lists contain valid addresses with BillionVerify's email verification service.