Email Marketing Opt-In Rules in the EU, UK and USA

Summary

The EU and the UK require prior consent for marketing emails to individuals, with a narrow exception for existing customers. The USA has no prior-consent requirement. Its federal law relies on opt-out, so each commercial email must carry accurate details and a working way to stop future messages. A sender with a mixed list needs to meet each regime that applies to its recipients.

This guide covers the EU rule in Article 13 of the ePrivacy Directive, the UK rule in regulation 22 of PECR, the US CAN-SPAM Act and how to handle a list that spans all three. It covers email only. It does not cover calls, texts, or US state laws.

Key Takeaways

•  EU law allows marketing email only to subscribers or users who have given prior consent, except for a narrow existing customer exception (ePrivacy Directive, Article 13).

•  For B2B email, the EU opt-in rule applies to subscribers who are natural persons. For other subscribers, Member States must ensure their legitimate interests are sufficiently protected, so national law decides.

•  The FTC’s CAN-SPAM guide has no consent requirement and makes no exception for B2B email. It requires a postal address, an opt-out and honouring opt-outs within 10 business days.

The EU Rule Starts With Prior Consent

Article 13(1) of the ePrivacy Directive says electronic mail for direct marketing may be allowed only for subscribers or users who have given prior consent. The same paragraph covers automated calling systems and fax.

Article 13(3) deals with other unsolicited marketing communications. Member States must ensure they are not sent without the subscriber’s or user’s consent, or to those who do not wish to receive them. National legislation chooses between the two options, and both must be free of charge.

The Directive sets the rule, and each Member State applies it in its own law. Check the national provision for each country you market to.

The Existing Customer Exception Is Narrow

Article 13(2) allows a natural or legal person that obtains a customer’s electronic contact details in the context of the sale of a product or service to use them for direct marketing of its own similar products or services. Three conditions are in the text:

•  the details were obtained from the customer in the context of a sale;

•  the marketing is for the sender’s own similar products or services; and

•  customers clearly and distinctly get the chance to object, free of charge and in an easy manner, when the details are collected and on each message if they did not refuse at the start.

Marketing another company’s products, or unrelated products, falls outside the exception.

B2B Email Depends on National Law

Article 13(5) says paragraphs 1 and 3 apply to subscribers who are natural persons. For subscribers other than natural persons, Member States must ensure, within Community law and national legislation, that their legitimate interests about unsolicited communications are sufficiently protected.

That wording leaves the method to each country. A rule that works for B2B email in one Member State may not hold in another. Check the national law before relying on it.

Consent Needs to Be Provable and Easy to Withdraw

Where consent is the legal basis under the GDPR, Article 7 sets conditions that matter for mailing lists:

•  the controller must be able to demonstrate that the person consented (Article 7(1));

•  a request for consent inside a wider written declaration must be clearly distinguishable from the other matters, in clear and plain language (Article 7(2)); and

•  the person can withdraw consent at any time, and withdrawing must be as easy as giving it (Article 7(3)).

Keep a record of when and how each person signed up, and what they were told. Our guide to CRM data retention covers setting retention periods for CRM records.

Some Practices Are Prohibited in Every Case

Article 13(4) prohibits, in any event, sending marketing email that:

•  disguises or conceals the identity of the sender on whose behalf the communication is made;

•  contravenes Article 6 of Directive 2000/31/EC;

•  has no valid address to which the recipient may send a request that such communications cease; or

•  encourages recipients to visit websites that contravene that article.

The original version of this post listed company registration details that every business email must show. Article 13(4) does not contain that list, so it is not repeated here. Check the national rules on business email disclosures separately.

The UK Rule Sits in Regulation 22 of PECR

Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 applies to unsolicited electronic mail sent to individual subscribers. A person must not send or instigate direct marketing email unless the recipient has previously notified the sender that they consent for the time being to such communications.

The exception in regulation 22(3) mirrors the EU one. The sender must have obtained the contact details during the sale or negotiations for the sale of a product or service to that recipient, the marketing must be for the sender’s similar products and services only, and the recipient must have been given a simple means of refusing, free of charge except for the cost of transmitting the refusal. That must be offered when the details are collected and, if the recipient did not refuse, then in each later message.

Since 5 February 2026, regulation 22(3A) adds an exception for charities. The marketing must have the sole purpose of furthering the charity’s charitable purposes, and the charity must have obtained the details when the recipient expressed interest in those purposes or offered or provided support. The same simple means of refusal is required.

The legislation.gov.uk page shows no known outstanding effects on this regulation at the time of writing.

The US Rule Relies on Opt-Out

The FTC’s CAN-SPAM compliance guide says the Act covers all commercial messages, meaning emails whose primary purpose is to advertise or promote a commercial product or service. It states that the law makes no exception for business-to-business email.

The guide lists eight requirements. None of them is prior consent. They cover accurate header information, non-deceptive subject lines, identifying the message as an advertisement, a valid physical postal address, a clear explanation of how to opt out, and honouring opt-outs promptly. The other two cover subscribers and members, who can still opt out of marketing email, and the sender’s responsibility for what others do on its behalf.

On timing, the guide says an opt-out mechanism must work for at least 30 days after the message is sent, and that opt-out requests must be honoured within 10 business days. The sender cannot charge a fee, require more than an email address, or sell or transfer the address once the person has opted out, except to a company hired to help comply with the Act.

The FTC treats a message whose primary purpose is transactional or relationship content as exempt from most provisions, though it still may not contain false or misleading routing information. Our guide to US email marketing rules under CAN-SPAM covers the requirements in more detail.

A Mixed List Needs a Rule for Each Region

A list that includes recipients in the EU, the UK and the USA is subject to more than one regime. Four steps help:

•  Tag each contact by location: record where the recipient is so that the right rule can be applied.

•  Record consent: keep evidence of when, how and what was agreed, as Article 7(1) expects where the GDPR applies.

•  Make opting out simple: use one unsubscribe route that is free, easy to use and processed promptly. Each regime above has its own opt-out or refusal requirement, and one route is easier to keep consistent.

•  Review the list: run a GDPR audit of how contacts were collected before a large campaign.

GDPRLocal recommends double opt-in, which means the subscriber confirms the subscription by email. None of the provisions above requires it. It strengthens the record of consent.

Conclusion

The main difference is the starting point. The EU and UK start with consent and allow a narrow exception for existing customers. US federal law starts with opt-out, with duties that apply to all commercial email.

We are updating this guide because the original listed the US opt-out deadline as 10 days (the FTC says 10 business days), included company details without a source, and left out the existing customer exception and the UK rule. Review your sign-up process and your unsubscribe route against these points, and speak to our GDPR consultants if you want them checked.

Frequently Asked Questions

Do I Need Consent to Send Marketing Email in the EU?

In general, yes. Article 13(1) of the ePrivacy Directive allows marketing email only to subscribers or users who have given prior consent. Article 13(2) provides an exception for sending similar products or services to a sender’s own customers, and Member States set the details in national law.

Does B2B Email Need Consent?

It depends on the country. Article 13(5) applies the consent rule to natural-person subscribers and requires Member States to protect other subscribers’ legitimate interests. In the UK, regulation 22 applies to individual subscribers. In the USA, the FTC states that CAN-SPAM makes no exception for B2B email.

Does CAN-SPAM Require Opt-In?

No. The FTC’s guide lists eight requirements, none of which is prior consent. Every commercial email must still meet them, including a postal address and an opt-out that is honoured within 10 business days.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.