You built your email list. You wrote your sequence. You hit send. But did you stop to ask whether what you just sent was actually legal?
Most small business owners have no idea there are federal laws governing commercial email. They know spam is bad. They know unsubscribe buttons exist. Beyond that? Vague awareness at best. That is a problem, because the penalties for getting this wrong are not small.
This guide breaks down the three laws you need to understand before your next send: the U.S. CAN-SPAM Act, GDPR for European audiences, and CASL for Canadian subscribers. No legal jargon. Just what you actually need to know to stay compliant and protect your business.
Why Email Law Matters for Small Business
The Federal Trade Commission (FTC) enforces CAN-SPAM. Each violation can carry a fine of up to $51,744. Not per campaign. Per individual email that violates the law. Send a non-compliant sequence to 5,000 subscribers, and the math gets uncomfortable fast.
For GDPR, the fines are even more serious: up to 4% of annual global revenue or 20 million euros, whichever is higher. Yes, that applies to U.S. businesses with European subscribers.
The good news: compliance is not complicated. Most of the rules are things you should be doing anyway if you want a list that actually converts. Legal email is good marketing.
CAN-SPAM: The U.S. Law You Are Already Subject To
The CAN-SPAM Act has been the law of the land since 2003. It applies to any commercial email sent to U.S. recipients, whether you are a solo operator or a growing company. Here are the seven requirements every commercial email must meet.
1. Do Not Use False or Misleading Header Information
Your “From,” “To,” and “Reply-To” fields must accurately identify who is sending the email. If you are sending on behalf of a brand, the brand name in the From field needs to match the actual entity sending it. Using a fictitious name to make the email appear to come from someone else violates the law.
2. Do Not Use Deceptive Subject Lines
Your subject line must reflect the actual content of the email. Writing “Your invoice is ready” when you are actually sending a promotional offer is a CAN-SPAM violation. Subject lines designed to trick people into opening emails also raise deliverability red flags, which hurts you twice.
3. Identify the Message as an Advertisement
If your email is a commercial message and the recipient has not explicitly opted in to receive it (i.e., you are cold emailing), you must clearly and conspicuously disclose that it is an advertisement. For most email marketing to a subscribed list, this is handled by context, but keep it in mind for any outbound prospecting campaigns.
4. Include Your Physical Mailing Address
Every commercial email must include a valid physical postal address. This can be your business address, a P.O. box, or a registered private mailbox. This is why every Mailchimp template has that footer block by default. It is not optional.
5. Tell Recipients How to Opt Out
You must include a clear and conspicuous explanation of how the recipient can opt out of receiving future emails from you. This means an unsubscribe link in every email, full stop.
6. Honor Opt-Out Requests Promptly
When someone unsubscribes, you must stop emailing them within 10 business days. You cannot charge a fee for unsubscribing, require them to give you additional information beyond an email address, or make them take more than one step to complete the process. A single click unsubscribe is the standard.
7. Monitor What Others Do on Your Behalf
If you hire a contractor, agency, or use any third-party service to send email on your behalf, you are still legally responsible for CAN-SPAM compliance. Hire someone through Fiverr to run your email campaigns? Make sure they follow these rules. Ignorance of what your vendor is doing is not a legal defense.
GDPR: What U.S. Businesses Need to Know
The General Data Protection Regulation is a European Union law, but it applies to any business that collects or processes personal data from EU residents, regardless of where your business is headquartered. If your email list includes subscribers from Germany, France, Spain, or any other EU country, GDPR applies to you.
The Big Difference: Consent
Under CAN-SPAM, you can email people who have not specifically opted in, as long as you give them a way out. Under GDPR, you generally cannot. To email EU residents, you need a lawful basis for processing their data. For most small business email marketing, that basis is consent.
GDPR consent must be:
- Freely given – the person was not coerced or given no real choice
- Specific – they consented to receive emails from you, not some vague category
- Informed – they understood what they were signing up for
- Unambiguous – a pre-checked box does not count; they must take a clear affirmative action
In practical terms, this means a double opt-in system (where someone confirms their subscription via a confirmation email) is the gold standard for GDPR compliance. It creates a clear record of consent.
What You Must Disclose at Sign-Up
When someone subscribes to your list, your sign-up form must tell them who is collecting their data (your business name), why (to send marketing emails), how long you will keep it, whether you share it with third parties (your email service provider, for example), and how they can request deletion of their data.
This does not require a law school degree. A short privacy note beneath your opt-in form handles most of this. Something like: “By subscribing, you agree to receive marketing emails from [Your Business]. You can unsubscribe at any time. We will never sell your data. View our Privacy Policy.”
The Right to Be Forgotten
Under GDPR, EU residents can request that you delete their data entirely, not just unsubscribe them from your list. Your email service provider (Mailchimp, Klaviyo, ActiveCampaign) will have tools to permanently delete subscriber records. You need to be able to fulfill these requests within 30 days.
If You Are U.S.-Only, GDPR May Not Apply Much
If your business is entirely local or U.S.-focused and you have no reason to believe you have EU subscribers, GDPR is less of an immediate concern. That said, being GDPR-compliant is good practice regardless, because the standards it requires are the same ones that build subscriber trust.
CASL: Canada’s Even Stricter Email Law
Canada’s Anti-Spam Legislation (CASL) came into force in 2014 and is widely considered one of the strictest anti-spam laws in the world. If you are emailing anyone in Canada, pay attention.
Under CASL, you cannot send a commercial electronic message to a Canadian recipient unless you have their express or implied consent. Express consent means they explicitly opted in. Implied consent covers existing business relationships (a customer who bought from you in the last two years) or a published business address (like a contact email on a public website).
Even with implied consent, the clock is ticking. You have two years from a purchase or business interaction to convert that implied consent into express consent before you can no longer email that person.
CASL also requires that every email include:
- Your name and contact information
- A working unsubscribe mechanism
- Unsubscribe requests honored within 10 business days
Fines under CASL go up to $1 million per violation for individuals and $10 million per violation for businesses. It has teeth.
Practical Compliance Checklist for Small Business Owners
You do not need to become an attorney to run a compliant email program. Here is what to implement today:
Your Sign-Up Form
- Use an unchecked opt-in checkbox (never pre-checked)
- Describe what subscribers are signing up for (“Weekly business tips from Hustler’s Library”)
- Link to your privacy policy
- Use double opt-in if you have EU or Canadian subscribers
Every Email You Send
- Accurate “From” name and email address
- Subject line that honestly reflects content
- Your physical mailing address in the footer
- A one-click unsubscribe link
- No deceptive re-engagement tricks (like fake “re: your order” subject lines)
Your List Management
- Honor unsubscribe requests within 10 business days (ideally immediately)
- Keep records of when and how consent was obtained
- Be able to fulfill data deletion requests
- Segment EU subscribers if you want to apply different consent standards
If email security is a concern, using a reputable SMTP relay service is just the start. Protecting your sender account with a VPN, especially when accessing it from public networks, is a smart step. NordVPN is worth having in your toolkit if you manage email campaigns on the go.
What Happens If You Ignore This
Most small businesses will never face an FTC enforcement action. The agency tends to go after repeat, large-scale violators. But that is not the only risk. Subscriber complaints to ISPs can destroy your sender reputation. One spam report from a major inbox provider can tank your deliverability for months. Your ability to stay out of the spam folder depends almost entirely on how you treat subscribers, which is exactly what these laws are designed to enforce.
Beyond enforcement, there is the trust angle. Subscribers who feel respected are more likely to stay subscribed and buy. Subscribers who feel tricked unsubscribe, complain, or mark you as spam. Legal compliance and good email marketing are the same thing.
One More Thing: Keep Your List Clean
Even a fully compliant list becomes a liability over time if you are sending to people who never open your emails. High bounce rates and low engagement hurt deliverability. Regularly removing inactive subscribers is not just good hygiene, it is part of protecting your sender reputation. Understanding your deliverability metrics gives you the visibility to know when your list needs attention.
And if you have not yet set up an automated sequence to convert new subscribers before they go cold, your email automation strategy is where to start.
The Bottom Line
CAN-SPAM, GDPR, and CASL are not obstacles to your email marketing. They are the floor. Meeting these standards costs you nothing except a few minutes of setup, and the upside is a list built on real consent that actually converts.
Know the rules. Build your list the right way. And when in doubt, ask yourself: would this make my subscriber feel respected or tricked? The answer is almost always enough to keep you compliant.
Ready to build a list the right way? Join Hustler’s Library free and get the frameworks, templates, and guides that serious small business owners use to build marketing engines that last.
Ready to Know Where You Stand?
The Business Journey dashboard maps your exact position across all 13 stages. Track your progress, unlock resources for each step, and build with a framework used by thousands of founders at Hustler's Library.
No credit card required · Takes 3 minutes · Personalized to your stage
