Email permission, by jurisdiction

Most writing about email permission describes one country's rules as though they were the rules. If your subscribers come from a website, they are not in one country, and the regimes differ in kind rather than in detail: one does not require consent at all, one requires you to prove you have it, and the others sit between.

What follows is what the four main regulators actually say. It is not legal advice, and where the money matters you should take some locally.

European Economic Area and the United Kingdom

Consent first. The ePrivacy Directive requires member states to prohibit unsolicited commercial email unless the subscriber has given prior consent.

There is one narrow exception, usually called soft opt-in. If you obtained the address from a customer in the context of a sale, you may use it to market your own similar products and services, provided the customer is given a clear, free and easy opportunity to object both when the address is collected and in every message you send. It applies only to the same company that collected the address, so it cannot be passed to a third party, and the Court of Justice has read the existence of a customer relationship broadly rather than narrowly.

United States

The opposite starting point. The FTC states plainly that CAN-SPAM does not require consent before sending commercial email: there is no opt-in requirement. What it requires instead is honesty and a working exit.

• Header information, including the from address, reply-to and routing, must be accurate and identify who sent the message.
• The subject line must reflect what the message actually contains.
• The message must be identifiable as an advertisement, clearly and conspicuously, though the word ad is not required in the subject.
• It must include a valid physical postal address.
• It must offer a clear way to opt out, which keeps working for at least 30 days after sending, with requests honoured within 10 business days, free of charge, and asking for no more than an email address.
• Opt-out lists may not be sold or transferred, and hiring somebody to send on your behalf does not transfer your liability.

Canada

The strictest of the four in practice, and the one that catches people out, because the burden of proof sits with the sender.

Express consent is an explicit positive indication and does not expire, though it can be withdrawn at any time. Crucially, a message asking for express consent is itself a commercial electronic message, so you cannot email somebody to ask whether you may email them.

Implied consent exists only in narrow listed categories: an existing business relationship such as a purchase within the previous two years or an enquiry within the previous six months, certain non-business relationships, and conspicuous publication of an address where the publication carries no refusal and the message relates to that person's business role. The regulator's own advice is that where you are unsure, ask for express consent instead of assuming.

Australia

Consent is required and may be express or inferred from conduct and business relationships, with the sender bearing the burden of proving it. The mere fact that an address has been published does not let you infer consent.

Messages must accurately identify the sending business and its contact details, including when somebody sends on its behalf. The unsubscribe facility must be clearly presented, cost nothing beyond normal sending charges, keep working for at least 30 days, and be honoured within 5 working days. You may not require a login or extra personal information to unsubscribe.

What never makes it lawful

• A purchased list. No regime treats somebody else's consent as yours, and in the two that require you to prove consent you cannot.
• Addresses scraped from websites. Publication is not permission in Canada or Australia, and both say so explicitly.
• A pre-ticked box. Not an explicit positive indication anywhere that requires one.
• Consent bundled into terms and conditions, where nobody indicated anything about email specifically.
• An address given for one purpose used for another, such as a delivery address later used for marketing a different line of business.

Two further things worth knowing. Transactional messages, meaning the receipt, the dispatch note and the answer to a question somebody asked, are treated differently from marketing in every one of these regimes, but the moment you add promotional content to one it becomes marketing. And the mailbox providers apply their own rules on top of the law, which are often stricter in practice and are enforced faster.