Email Marketing Laws: Australia, UK, EU, Canada and US

Email marketing law isn’t one law. It’s at least five major regimes that disagree on the basics: whether you need permission before you send, how fast you have to process an unsubscribe, and whether a shipping confirmation with a product carousel counts as marketing. For an ecommerce brand that ships internationally, the question isn’t which law applies. It’s which ones, and how to run one Klaviyo account that satisfies all of them.

We’re based in Adelaide and work with brands selling across Australia, the US, the UK and beyond, so this guide starts where most don’t: Australia’s Spam Act, which is stricter than CAN-SPAM in ways that catch US-trained marketers out. Then it covers the UK, EU, Canada and the US, compares them in one table, and finishes with a practical setup that complies everywhere.

Regulator guidance checked September 2026. This is general information, not legal advice.

---

Email marketing laws at a glance

Most countries outside the US require consent before you send marketing email. Australia (Spam Act 2003), Canada (CASL), the UK (PECR) and the EU (GDPR and ePrivacy) are opt-in regimes with limited existing-customer exceptions. The US CAN-SPAM Act is opt-out. Every regime requires sender identification and a working unsubscribe.

	Australia	UK	EU	Canada	United States
Main law	Spam Act 2003 and Spam Regulations 2021	PECR plus UK GDPR (amended by the Data (Use and Access) Act 2025)	GDPR plus national ePrivacy laws	CASL	CAN-SPAM Act 2003
Regulator	ACMA	ICO	National data protection authorities (coordinated by the EDPB)	CRTC (with Competition Bureau and OPC)	FTC
Consent model	Opt-in: express or inferred	Opt-in for individuals	Opt-in	Opt-in: express or implied	Opt-out
Existing-customer exception	Inferred consent, narrow; ACMA says a purchase alone isn’t enough	Soft opt-in: details collected in a sale, similar products, opt-out offered	Existing-customer exception in ePrivacy, varies by country	Implied consent up to 2 years after a purchase, 6 months after an inquiry	Not needed (opt-out law)
Sender identification	Business name (or name and ABN) and contact details, accurate for 30 days	Identity not concealed, valid contact address	Transparency obligations under GDPR	Business name, mailing address, plus phone, email or web address, valid 60 days	Accurate headers, valid physical postal address
Unsubscribe deadline	5 working days; must work 30 days after sending	Promptly (no fixed statutory days in ICO guidance)	Without undue delay; withdrawal as easy as giving consent	10 business days	10 business days; must work 30 days after sending
Transactional emails with promos	Treated as commercial: unsubscribe needed	Marketing content is marketing	Marketing content is marketing	Commercial content can make the message a CEM	Primary purpose test
Maximum penalties	Federal Court civil penalties; ACMA infringement notices (recent penalties up to $3.96m)	Up to £17.5m or 4% of global turnover (per the ICO on the DUAA)	Up to €20m or 4% of global turnover	Up to C$1m (individuals) or C$10m (businesses) per violation	Up to US$53,088 per email

---

Australia: Spam Act 2003 (ACMA)

Australia’s Spam Act 2003 is enforced by the Australian Communications and Media Authority. It covers commercial electronic messages, meaning email, SMS and instant messages, with an “Australian link”. Under section 7 of the Act, that includes messages sent by a business based in Australia and messages accessed on a device located in Australia. Overseas brands emailing Australian customers are covered.

The three rules

The ACMA summarises compliance as: consent, identify, unsubscribe.

1. Get consent. There are two types:

• Express consent. The person knowingly agrees to receive marketing, for example by filling in a form, ticking a box, or agreeing over the phone or face to face. The ACMA calls this best practice. You must keep a record of who consented, when and how, because under the Spam Act it’s up to you to prove consent.
• Inferred consent. You may infer consent where someone has knowingly given you their address and would reasonably expect marketing, usually because of an ongoing relationship (an account, subscription or membership) and only for directly related marketing.

Here’s the line that matters most for ecommerce. The ACMA states that inferred consent “does not cover sending messages after someone has just bought something from your business.” Unlike the UK soft opt-in or Canada’s two-year implied consent, a one-off Shopify purchase doesn’t let you add that customer to your marketing list in Australia. The marketing checkbox at checkout does the job instead, and you need to respect it.

You also can’t send an email asking for consent, because the ACMA treats that request as a marketing message itself.

2. Identify yourself. Every message must accurately identify your business (your legal name, or your name and ABN) and include correct contact details, which must remain accurate for at least 30 days after sending. If an agency sends on your behalf, the message must still identify you.

3. Make it easy to unsubscribe. Every commercial message needs an unsubscribe option that:

• presents clear instructions
• is honoured within 5 working days
• is free (beyond the normal cost of using the address, such as a standard SMS charge)
• works for at least 30 days after the message was sent
• doesn’t require the person to log in, create an account or give extra personal information.

For SMS, note the ACMA’s reminder that alphanumeric sender IDs usually can’t receive replies, so “Reply STOP” won’t work from one.

The transactional email trap (the Lululemon case)

In March 2026 the ACMA announced that Lululemon Athletica Australia had paid a $702,900 penalty after sending more than 370,000 emails with commercial content and no way to unsubscribe. The emails were service messages, including delivery and order confirmations, that also contained sales material and links to promotions. The ACMA’s position:

If an electronic message contains any promotional or sales content, it is considered commercial regardless of whether the message has any other purpose.

Lululemon also entered a court-enforceable undertaking requiring an independent compliance review. The ACMA called it the fifth enforcement action in 18 months against businesses treating messages as non-commercial when they contained commercial material. This is much stricter than the US “primary purpose” test in CAN-SPAM. A “You might also like” block in an Australian order confirmation turns it into a marketing email that needs an unsubscribe.

What to do in Klaviyo: either keep order, shipping and account emails strictly transactional, or treat any that carry product recommendations or discount codes as marketing, with an unsubscribe link and consent checks. There’s no in-between under Australian law. If you want this set up for you, see our Klaviyo agency for Australian brands.

Penalties and enforcement

The ACMA can issue formal warnings and infringement notices, accept court-enforceable undertakings, or take a business to the Federal Court. Recent announcements show the scale: Lululemon ($702,900, March 2026), Latitude Finance ($3.96m for further spam breaches, April 2026) and TAB ($2.7m for telemarketing and spam breaches, July 2026). The ACMA says businesses paid over $6.7 million in spam penalties in the 18 months to March 2026.

The Privacy Act 1988 may also apply to how you collect and use customers’ personal information. The Spam Act governs sending the message; privacy law governs the data behind it.

---

United Kingdom: PECR and UK GDPR (ICO)

In the UK, electronic marketing is governed by the Privacy and Electronic Communications Regulations (PECR), alongside UK GDPR for the personal data involved. Both are enforced by the Information Commissioner’s Office.

• Consent. You must not send marketing email to individuals unless they’ve specifically consented to email from you.
• The soft opt-in. The exception ecommerce brands rely on. You can email existing customers if you got their details in the course of a sale or negotiation of a sale, you’re marketing your own similar products or services, and you gave them a clear chance to opt out both when you collected their details and in every message since. The ICO notes it doesn’t cover prospects or bought-in lists.
• Business contacts. PECR’s consent rule applies to individual subscribers, including sole traders. You can email corporate bodies (companies, LLPs, Scottish partnerships and government bodies) without consent, though you must still identify yourself and provide a valid contact address, and the ICO recommends keeping a do-not-email list.
• Identity. Don’t disguise or conceal who you are, and give a valid address for opt-outs.
• Penalties. The ICO says the Data (Use and Access) Act 2025 gives it power to fine up to £17.5 million or 4% of global turnover under PECR, bringing PECR in line with UK GDPR. The ICO also notes its PECR guidance is under review following the Act.

The soft opt-in is the biggest practical difference from Australia. A UK customer who bought from you and didn’t untick an opt-out box can receive related marketing. An Australian customer in the same situation generally can’t.

---

European Union: GDPR and ePrivacy

In the EU, marketing email sits under two layers:

• The ePrivacy Directive (implemented by each member state’s own law) sets the rules for unsolicited electronic marketing, generally requiring prior consent, with an existing-customer exception for similar products where an opt-out was offered.
• The GDPR governs the personal data. Consent must be “freely given, specific, informed and unambiguous” (Article 4(11)), and under Article 7(1) you must be able to demonstrate that the person consented. Pre-ticked boxes don’t count.

Maximum fines under Article 83(5) reach €20 million or 4% of total worldwide annual turnover, whichever is higher.

Germany and double opt-in

Germany is the market where double opt-in moves from best practice to de facto requirement. German unfair competition law requires prior express consent for email advertising, and the sender carries the burden of proving it. In a 2011 decision (I ZR 164/09), Germany’s Federal Court of Justice accepted double opt-in as a method of documenting email consent, and German courts have treated a bare single opt-in as insufficient proof. If you market to German customers, use double opt-in for them and keep the confirmation logs.

---

Canada: CASL (CRTC)

Canada’s Anti-Spam Legislation is one of the strictest regimes and is enforced by the CRTC, with the Competition Bureau and the Office of the Privacy Commissioner.

• Consent. Express consent (the person agreed to receive commercial messages from you) doesn’t expire unless withdrawn. Implied consent applies in limited situations, including an existing business relationship: up to two years after a purchase, or six months after an inquiry or application.
• Identification. Messages must include your business name (and anyone you’re sending on behalf of), a current mailing address, and a phone number, email address or web address. The contact information must remain valid for at least 60 days after sending.
• Unsubscribe. A free unsubscribe mechanism in every message, with requests actioned within 10 business days.
• Penalties. Administrative monetary penalties of up to $1 million for individuals and $10 million for businesses per violation, according to the Government of Canada.

The two-year clock is the operational catch. If you rely on implied consent from purchases, you need to track when each Canadian customer’s consent expires and either obtain express consent or stop mailing them. A Klaviyo segment on “last order date more than 2 years ago” plus “no express consent” handles it.

---

United States: CAN-SPAM and state laws

The CAN-SPAM Act is the outlier: an opt-out law. You don’t need consent to send commercial email, but you must use accurate headers and subject lines, identify the message as an ad, include a valid postal address, offer an opt-out, and honour it within 10 business days. Penalties reach $53,088 per violating email, per the FTC. We break down all seven requirements, the transactional test and the penalties in our CAN-SPAM guide.

US state laws

• Commercial email laws are largely pre-empted. CAN-SPAM overrides state laws that expressly regulate commercial email, except where they prohibit falsity or deception (15 U.S.C. § 7707(b)).
• California’s Business and Professions Code § 17529.5 survives that pre-emption for deceptive emails. It targets falsified or misrepresented header information and subject lines likely to mislead, and it allows recipients, email service providers and the California Attorney General to sue for liquidated damages of up to $1,000 per email. Honest From names and subject lines are your defence.
• State privacy laws, such as California’s consumer privacy law, don’t create an email opt-in requirement, but they do govern how you disclose, share and let consumers control their personal data. That includes the email lists you sync to ad platforms. Check your privacy policy and data-sharing setup with counsel.
• SMS is a different regime. Text marketing is governed by the TCPA, FCC rules and carrier requirements, and several states have their own telemarketing laws that cover texts. Our SMS marketing service builds consent capture for this.

---

How to run one compliant program across every market

You don’t need five Klaviyo accounts. You need one consent model built to the strictest standard you’re subject to, with a few regional switches.

1. Use express consent everywhere. An unticked checkbox or a sign-up form with clear wording (“Get emails about new products and offers”) satisfies Australia, Canada, the UK, the EU and the US. Never pre-tick.
2. Record consent. Klaviyo stores consent history on each profile. Make sure every source (forms, Shopify checkout, quizzes, giveaways, integrations) passes a consent flag and source, rather than dumping everyone into a list.
3. Don’t treat purchasers as subscribers by default. Only customers who ticked the marketing box go into marketing flows. That’s legally required in Australia and good practice everywhere.
4. Keep transactional flows transactional, or add an unsubscribe to them. Australia makes this mandatory; elsewhere it avoids ambiguity.
5. Use double opt-in for Germany (and wherever list quality justifies it). See our double opt-in guide.
6. Put a postal address and your legal business name in every footer. It satisfies CAN-SPAM, CASL and the Spam Act at once.
7. Keep the unsubscribe one click away, and let Klaviyo’s one-click unsubscribe headers do their job. That also meets Gmail and Yahoo’s sender requirements.
8. Track Canadian implied consent expiry if you rely on purchase-based implied consent.
9. Audit third parties. Agencies, affiliates and influencers sending on your behalf create liability for you in every regime.

Compliance and deliverability pull in the same direction. Consented, engaged subscribers complain less, which keeps your sender reputation healthy. If you sell supplements or health products, there’s a second layer of rules about what your emails can say. See structure/function claims for supplement emails.

---

Get your consent setup reviewed

Most compliance gaps we find in Klaviyo accounts are plumbing: an integration subscribing every purchaser, an old import with no consent source, or product recommendations added to Australian order confirmations. If you’d like a review of consent capture, flows and deliverability together, start with a free Klaviyo audit, or see our email deliverability service.

This article is general information, not legal advice. For advice on your obligations, speak to a qualified lawyer in each jurisdiction you market to.