Email rules are not paperwork for big companies only. They apply to any business that sends marketing emails, including a one-person shop with a small list. The two frameworks small senders hear about most are GDPR, which protects people in Europe, and CAN-SPAM, which covers the United States. They differ in detail, but they share one principle: only email people who asked to hear from you, be honest about who you are, and let them leave easily. This guide explains the practical requirements in plain language. It is general information, not legal advice — if your situation is complex, talk to a lawyer — but following these basics keeps you safe in almost every normal case.
Why Compliance Is Worth Taking Seriously
Compliance is often treated as a chore, but it protects your business in three ways. First, it protects your deliverability. Inbox providers and spam filters treat law-breaking senders harshly, and a reputation damaged by complaints is slow to repair. Second, it protects your revenue: fines under GDPR can be large, and even a warning from a regulator costs time and stress. Third, it builds trust. Readers who know you respect their inbox are more likely to stay subscribed, open your emails, and buy from you. The senders who struggle most with compliance are usually the ones cutting corners elsewhere too — bought lists, misleading subject lines, hidden unsubscribe links — and those shortcuts hurt results anyway. Doing things properly is not just safer; it is better marketing.
The First Rule: Permission
Both GDPR and CAN-SPAM start from permission, but GDPR is stricter. Under GDPR, you generally need clear, freely given consent before sending marketing emails to someone in Europe: they must take a positive action, like ticking an unticked box or confirming through a double opt-in email. Pre-ticked boxes do not count, and consent buried in terms and conditions does not count either. CAN-SPAM does not require prior consent in the same way, but it still punishes deceptive practices, and emailing people who never asked for your messages will generate complaints that hurt you regardless of the law. The practical approach is simple and works everywhere: only email people who subscribed through your own forms, keep a record of when and how they subscribed, and never buy, rent, or scrape a list. A list built person by person, as described in our guide to building an email list from scratch, is compliant by construction.
What Every Marketing Email Must Contain
Whatever the law, every marketing email you send should contain the same few elements. First, honest identification: your sender name and subject line must reflect who you are and what the email is about. Misleading subject lines — like “Re: your order” for a sales pitch — are banned under CAN-SPAM and will get you marked as spam. Second, a working unsubscribe mechanism in every email. Under CAN-SPAM it must work for at least 30 days after sending and be honoured within 10 business days; under GDPR, withdrawing consent must be as easy as giving it. Make the unsubscribe link visible and one-click if your tool allows it — hiding it only converts unsubscribes into spam complaints. Third, a valid postal address for your business. This is a CAN-SPAM requirement, and most email tools include it in the footer automatically. Fourth, a clear statement of why the recipient is getting the email, which helps forgetful subscribers remember they signed up instead of reporting you.
GDPR Essentials for Small Senders
If any of your subscribers are in Europe, GDPR adds a few specific duties. You must tell people, at signup, what you will send them and how often — a short privacy note on your form covers this. You must let subscribers access, correct, or delete their data on request, and most email tools provide a way to handle these requests. You must keep subscriber data secure and not share it with tools or partners without a reason. And if you use a signup incentive, the consent to receive marketing must still be separate from the transaction: someone downloading a free guide has not automatically agreed to weekly promotions unless that was clearly stated. One habit makes all of this easier: store only the data you actually need. If you only need an email address and a first name, do not collect phone numbers, birthdays, and job titles “just in case”. Less data means less risk and simpler compliance.
CAN-SPAM Essentials for Small Senders
CAN-SPAM, the US law, is less strict about consent but strict about honesty and opt-outs. Its core requirements are: do not use false or misleading header information; do not use deceptive subject lines; identify the message as an advertisement where appropriate; include your valid postal address; and provide a working opt-out that you honour promptly. It also requires that you monitor anyone who sends email on your behalf — if you hire an agency or freelancer to run campaigns, you are still responsible for their compliance. Unlike GDPR, CAN-SPAM does not require an unsubscribe confirmation page or a double opt-in, but both are good practice anyway. The most common CAN-SPAM violation by small businesses is not a missing address — it is continuing to email people after they unsubscribed, usually because of a broken automation or a second list that was not updated. Audit your lists after every unsubscribe to make sure the person is removed everywhere.
What to Do With an Old or Messy List
Many small businesses have a list built before they knew the rules: contacts imported from a spreadsheet, business cards collected at events, customers who bought once years ago. Do not simply start emailing that list. First, separate it by source: people who clearly subscribed to marketing, people who were only customers, and people whose source you cannot prove. Customers can usually be emailed about their own orders and closely related products, but not about unrelated promotions. For the rest, run a permission pass: one short email asking them to confirm they want to stay subscribed, and remove everyone who does not respond. This is the same re-engagement approach described in our guide to win-back email campaigns, and it turns a risky list into a clean one. Going forward, keep records: which form someone used, when they subscribed, and what they consented to. If a regulator or a provider ever asks, those records are your answer.
Mistakes That Get Small Senders in Trouble
The most dangerous mistake is emailing a purchased or rented list. It violates GDPR consent rules, generates complaints, and damages your sender reputation in ways that take months to repair. The second is a broken or hidden unsubscribe process — every complaint it causes is avoidable. The third is misleading subject lines and sender names, which CAN-SPAM bans outright and readers punish anyway. The fourth is ignoring data requests: if a subscriber asks to be deleted, delete them everywhere, including backups and secondary lists, and confirm it. The fifth is collecting data you do not need and keeping it forever. Set a retention habit: remove inactive subscribers regularly, as covered in our guide to email list cleaning, and you reduce both compliance risk and costs. None of these mistakes comes from malice — most come from haste. Slow down, check the basics, and your list stays safe.
Frequently Asked Questions
Do I need to follow GDPR if my business is not in Europe?
If you email people who are in Europe, yes — GDPR applies based on where the subscriber is, not where you are. Since most small lists include at least some European subscribers, following GDPR basics for your whole list is simpler than trying to split it by location.
Is a single opt-in enough, or do I need double opt-in?
Single opt-in is legally sufficient in many cases, but double opt-in — where the subscriber confirms via email — gives you a clear consent record, blocks fake and mistyped addresses, and improves deliverability. For most small businesses, it is worth the small drop in signup numbers.
Conclusion
Email compliance comes down to a few habits: get real permission, be honest about who you are, include a working unsubscribe link and your address, respect data requests, and keep only the data you need. Build those habits into your signup forms and your sending routine once, and compliance stops being a worry — and starts being one more reason subscribers trust you.
Pingback: Migrate to a New Email Tool Without Losing Anyone