You are about to send your first proper newsletter and a worry surfaces: are you actually allowed to email these people? Some signed up on your website, some are customers from years ago, a few are businesses you met at a trade fair, and one or two live abroad. You have heard of GDPR, someone mentioned a new Indian data law, and you would rather not find out the rules the hard way.
This guide sets out email marketing consent and unsubscribe duties in general terms, covering India, Europe including the UK, and the United States, and the habits that keep a small business on the right side of them. It is not legal advice. Laws change, details depend on your circumstances, and if you are unsure about a particular situation, ask a lawyer who handles data protection where you and your customers are.
Why the broad rules are worth knowing
Even without legal detail, a working understanding of consent protects you in three ways. It keeps you away from the obvious mistakes, such as importing every contact you have ever had. It protects your sending reputation, because people who never agreed to your emails are the ones who report them as spam. And email platforms enforce their own permission rules, which can be stricter than the law and can close your account if broken.
The good news is that the habits needed to respect the law in one place largely satisfy it in the others. Ask clearly, record the answer, make leaving easy, and stop when asked.
What email marketing consent means in practice
Across most modern privacy laws, valid consent shares the same features. The person:
- Takes a clear action to agree, such as ticking an empty box or submitting a signup form. Silence, a pre-ticked box or simply buying something is not the same.
- Knows what they are agreeing to: who you are, what kind of emails, and roughly how often.
- Has a real choice: agreeing to marketing is not made a condition of buying or of getting an answer to their enquiry.
- Can withdraw easily, as easily as they agreed.
In practice, that means a separate, unticked box on checkout and enquiry forms, a signup form that says what people will receive, and an unsubscribe link in every marketing email. Our post on consent boxes on website forms shows what that looks like on a WordPress site.
India: the DPDP Act in broad terms
The Digital Personal Data Protection Act lays down general rules for handling personal data, including email addresses, rather than a specific rulebook for marketing email. In broad terms it expects:
- Personal data to be processed for a lawful purpose, with consent that is free, specific, informed and given by a clear affirmative action, or under certain other grounds the Act allows.
- A notice telling people what data you collect and why.
- The ability to withdraw consent, with withdrawal as easy as giving it.
- Reasonable security for the data you hold, including data held by your email platform on your behalf.
The business that decides why and how the data is used remains responsible, even when a platform stores it. Our explainer on India’s data protection law for websites covers the Act more generally, and your website’s privacy policy should say what you do with subscriber addresses.
EU and UK: GDPR and the e-privacy rules
If you send to people in the EU or the UK, two sets of rules matter. Data protection law (the GDPR, and the UK’s version of it) governs how you handle personal data. Separate electronic marketing rules govern sending marketing email itself.
In broad terms:
- Marketing email to individuals generally needs their prior consent.
- The UK and some EU countries allow a narrow exception, often called a “soft opt-in”, for existing customers: you may email them about your own similar products if you collected their address during a sale, gave them a chance to opt out then, and offer an opt-out in every email. Whether and how it applies depends on the country.
- Rules for emailing business addresses can differ from rules for individuals, and differ between countries.
- People have rights to see, correct and delete their data, and you should be able to act on those requests.
Being based in India does not by itself take you outside these rules if you are deliberately marketing to people there.
US: CAN-SPAM
The US federal law on commercial email, CAN-SPAM, takes a different approach. It does not generally require consent before the first email, but it sets firm rules for every commercial message. In broad terms:
- Header information, such as the From name and address, must not mislead.
- The subject line must not deceive people about the content.
- The message must be identifiable as an advertisement where that applies.
- It must include a valid physical postal address for the sender.
- It must offer a clear way to opt out, and opt-outs must be honoured promptly, within the period the law sets.
- You remain responsible even if someone else sends on your behalf.
Even where the law allows emailing without prior consent, doing so harms deliverability. Mailbox providers and platforms act on complaints regardless of what the law permits.
The broad duties side by side
| India (DPDP Act) | EU and UK | US (CAN-SPAM) | |
|---|---|---|---|
| Before the first email | Consent or another lawful ground; consent is the safe basis for marketing | Consent generally needed for individuals, with a narrow existing-customer exception in some places | Prior consent not generally required |
| In every email | A way to withdraw consent easily | A simple way to opt out | Opt-out mechanism, postal address, honest headers and subject |
| Records | Be able to show consent was given | Be able to show consent was given | Keep track of opt-outs |
This simplifies a lot. Treat it as a map of where to look, not a set of answers.
Unsubscribe link rules that hold up everywhere
Whatever country your subscribers are in, an unsubscribe link that meets these points will rarely cause trouble:
- It appears in every marketing email, is clearly labelled and easy to find.
- It works in one or two steps, without logging in, entering a password or giving a reason. Asking why is fine as an optional question afterwards.
- It takes effect promptly. Do not keep sending for weeks.
- It covers all marketing email from you, unless you clearly offer a choice of topics on a preferences page.
- Requests that arrive another way, such as a reply saying “please stop”, are honoured too.
- Your platform includes one-click unsubscribe headers, which large mailbox providers now expect from bulk senders.
An unsubscribe is a choice to respect, not a problem to argue with. Never re-add someone who left, even if they later appear in an import.
Keeping records of consent
If anyone ever asks how a person got onto your list, you want to be able to answer. For each subscriber, aim to keep:
- When they joined, as a date and time.
- Where they joined: which form, page, checkout or counter signup.
- What they were shown: the wording next to the box or form at that time.
- Confirmation, if you use double opt-in.
- Any changes: topic choices, unsubscribes and when they happened.
Most platforms store the first two and the last automatically for their own forms. Keep a copy of the wording you used, with dates, whenever you change your forms. For paper or in-person signups, keep the sheets, or note the date and place when entering them.
These records are part of running email properly, and they matter just as much for WhatsApp and SMS, which need their own consent. How the channels fit together is described in our small business digital marketing guide. Within email, the related question of which messages need consent at all is covered in our comparison of order emails and newsletters, and the full set-up order is in the email marketing guide for small businesses.
Frequently asked questions
Does a customer who bought from me count as having consented to marketing?
Not automatically. A purchase is not, by itself, agreement to marketing email under most consent-based rules. Some places allow emailing existing customers about similar products if they had a chance to opt out at the time, but the conditions vary. The safe course is to ask with a separate tick box at checkout.
Can I email business addresses without consent?
The rules for business addresses differ by country and are often less strict than for individuals, but personal data law can still apply when the address belongs to a named person. Emailing businesses that never asked also brings spam complaints. If you rely on this, check the rules for each country you target.
How quickly should I act on an unsubscribe?
As soon as you practically can. Good platforms remove the person automatically and immediately. Laws that set a deadline treat it as a maximum, not a target, and large mailbox providers expect prompt handling too. Requests that arrive by reply or in person should be entered by hand without delay.
Do I need fresh consent if I move to a different email platform?
Generally not, as long as the consent was valid and covers the same kind of emails from the same business. Bring the consent records with you when you export, including dates, sources and unsubscribes. If the records are missing or the list’s origin is unclear, a re-permission email is the safer route.
If you want signup forms, checkout boxes and consent records set up properly on your site and your email platform, our email marketing services cover that groundwork. We set things up carefully; for legal questions, please speak to a lawyer.
Next in this series: Gmail Bulk Sender Requirements in Plain English
