Email Privacy Laws Explained: GDPR, CAN-SPAM, CCPA and Your Rights

Email privacy laws are the rules that decide who may collect your email address, what they may send you, and what control you keep over that data. The most important are the EU's GDPR and ePrivacy rules (consent-based marketing and strong data rights), the US CAN-SPAM Act (opt-out rules for commercial email), California's CCPA (rights to know, delete and opt out of data sale or sharing) and Canada's CASL (consent before commercial messages). This guide explains each one in plain English and shows you how to use your rights.

This article is general information, not legal advice. Laws change and their application depends on the facts, so check the official guidance of the relevant regulator or speak to a qualified lawyer for a specific situation.

Key takeaways

• EU, EEA and UK rules are opt-in. Marketing email to individuals generally needs prior consent, with a narrow "soft opt-in" for existing customers.
• The US CAN-SPAM Act is opt-out. Senders do not need permission first, but they must be honest, include a postal address and honor unsubscribes within 10 business days.
• GDPR gives you enforceable data rights, including access, correction, erasure, portability and an absolute right to object to direct marketing. Organisations must usually respond within one month.
• The CCPA gives California residents rights to know, delete, correct and opt out of the sale or sharing of personal information, with a 45-day response window.
• Canada's CASL requires express or implied consent and processing of unsubscribes within 10 business days, with penalties of up to C$10 million per violation for organisations.
• Transactional email is treated differently from marketing in all of these regimes.
• Data minimisation helps you too. Giving low-stakes sign-ups a separate or temporary address, such as one from VookMail, reduces how much data companies hold about you in the first place.

What counts as personal data in email?

Personal data, in GDPR terms, is any information relating to an identified or identifiable natural person. An email address such as maria.lopez@example.com is clearly personal data because it identifies a person. Even a less obvious address like ml1987@example.com is usually personal data, because it is linked to one individual and can be combined with other information to identify them.

Email involves more personal data than the address alone:

• Content: the message body and attachments.
• Metadata: sender, recipients, timestamps, subject lines, IP addresses in headers.
• Engagement data: when you opened a message, which links you clicked, collected through tracking pixels and redirect links.
• Derived data: interest segments, purchase propensity scores and other profiles built from your behaviour.

US laws use different terms. The CCPA uses "personal information", defined broadly to include identifiers such as email addresses, online identifiers and inferences drawn to create a profile. CAN-SPAM, by contrast, is not a general data protection law at all; it regulates the content and sending practices of commercial email.

Which email privacy law applies to you?

Most of these laws are triggered by where the recipient is and where the business targets its activity, not only where the company is based.

GDPR: what does it mean for email?

The General Data Protection Regulation (GDPR) is the EU's data protection law, in force since 25 May 2018. It applies to organisations established in the EU and, under Article 3(2), to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour there. The EEA countries (Iceland, Liechtenstein, Norway) apply it too, and the UK retains an almost identical version called the UK GDPR.

The core principles

Article 5 sets out principles that shape everything a business does with your email address:

• Lawfulness, fairness and transparency: you must be told clearly what is collected and why.
• Purpose limitation: an address collected to send an order confirmation cannot automatically be reused for unrelated purposes.
• Data minimisation: only data that is adequate, relevant and necessary should be collected.
• Accuracy, storage limitation (no keeping it longer than needed), integrity and confidentiality (security), and accountability (the organisation must be able to prove compliance).

Lawful bases for processing your email address

Under Article 6, every use of your data needs a lawful basis. For email, the most common are:

• Contract: sending your order confirmation or account notifications.
• Legal obligation: keeping invoices for tax purposes.
• Consent: subscribing to a newsletter.
• Legitimate interests: some security or fraud prevention processing, and in limited circumstances direct marketing, but only where ePrivacy rules also allow it.

What makes consent valid?

GDPR consent must be freely given, specific, informed and unambiguous, expressed by a clear affirmative action. In practice:

• Pre-ticked boxes do not count. The Court of Justice of the EU confirmed this in the 2019 Planet49 case, and Recital 32 of GDPR says silence or inactivity is not consent.
• Bundling is a problem. Making newsletter sign-up a condition of a service that does not need it can mean consent is not freely given.
• Withdrawal must be as easy as giving consent (Article 7(3)). If you subscribed with one click, unsubscribing should not require logging in and navigating five pages.
• The organisation must be able to prove it, which is one reason reputable senders use double opt-in confirmation emails.

Your GDPR rights in an email context

Organisations must respond to rights requests without undue delay and within one month, extendable by two further months for complex or numerous requests (Article 12(3)). They may ask for reasonable proof of identity, and they may refuse or charge a reasonable fee only for requests that are manifestly unfounded or excessive.

The right to object to marketing is absolute

Article 21(3) is one of the strongest rules in GDPR: if you object to processing for direct marketing, your data must no longer be processed for that purpose. There is no balancing test. The company may keep your address on a suppression list so it does not email you again, but it may not keep marketing to you.

Data breaches and email

Under Articles 33 and 34, an organisation must notify its supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights. Where the risk is high, it must also inform affected individuals without undue delay. This is why you sometimes receive breach notification emails from services you used years ago, and it is a good argument for not giving every service your primary address.

The ePrivacy rules: why EU marketing email is opt-in

GDPR is the general data law; the ePrivacy Directive (Directive 2002/58/EC, as amended) contains specific rules for electronic communications, implemented separately in each EU country's national law.

Article 13: unsolicited communications

• Prior consent is required to send direct marketing email to individuals.
• Soft opt-in: a business that obtained your email in the context of a sale of a product or service may market its own similar products or services, as long as you were given a clear and easy chance to object when your details were collected and in every message afterwards.
• No disguised identity: marketing emails must not hide or conceal the sender's identity and must include a valid address for opting out.

Rules for emailing businesses (legal persons) vary by country; some member states extend opt-in to company addresses, others do not. Individual employees' named work addresses such as firstname.lastname@company.com are still personal data under GDPR.

Tracking pixels and the ePrivacy rules

Article 5(3) of the ePrivacy Directive requires consent for storing or accessing information on a user's device, except where strictly necessary. It is best known for cookie banners, but European data protection authorities, through the European Data Protection Board's guidelines on the technical scope of Article 5(3), have indicated that tracking pixels in emails can fall within it. In practice, some EU regulators expect senders to tell recipients about open tracking and, depending on the country, obtain consent for it.

The UK: UK GDPR and PECR

After Brexit, the UK kept GDPR as the UK GDPR alongside the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR) implement the ePrivacy rules. Regulation 22 of PECR mirrors the EU opt-in and soft opt-in model for individual subscribers. The ICO enforces both and regularly fines companies for sending marketing email and text messages without valid consent. Recent UK legislative reforms have also changed parts of the regime, so check the ICO's current guidance for details.

CAN-SPAM: what US law requires

The CAN-SPAM Act of 2003 (Controlling the Assault of Non-Solicited Pornography And Marketing Act) is the main US federal law for commercial email. Despite the name, it does not ban unsolicited marketing email. It sets rules for how commercial email must be sent and gives recipients the right to stop it.

Which messages are covered?

The FTC classifies messages by their "primary purpose":

• Commercial: advertising or promoting a product or service. Fully covered.
• Transactional or relationship: confirming a transaction, warranty or safety information, account changes, subscription status, employment information, delivery of goods already bought. These are exempt from most requirements but must not contain false or misleading routing information.
• Other: non-commercial content such as personal messages.

Unlike many consumer laws, CAN-SPAM makes no exception for business-to-business email. A promotional email to a corporate address must comply too.

The core requirements

1. No false or misleading header information. The "From", "To", "Reply-To" and routing information must accurately identify the sender.
2. No deceptive subject lines. The subject must reflect the content.
3. Identify the message as an advertisement clearly and conspicuously, unless the recipient gave prior affirmative consent.
4. Include a valid physical postal address, which can be a street address, a registered post office box or a registered private mailbox.
5. Tell recipients how to opt out with a clear and conspicuous explanation and a working mechanism, such as a reply address or a link.
6. Honor opt-outs promptly. Requests must be processed within 10 business days, and the opt-out mechanism must work for at least 30 days after the message is sent. Senders may not charge a fee, require any personal information beyond an email address and opt-out preferences, or make you take any step other than sending a reply email or visiting a single web page.
7. Do not sell or transfer opted-out addresses, except to a company hired to help comply with the law.
8. Monitor others acting on your behalf. A company that hires a marketing agency remains legally responsible.

Sexually explicit commercial email must carry a specific warning label in the subject line under a separate FTC rule.

Aggravated violations

The Act treats certain practices as aggravating factors that increase penalties, including harvesting email addresses from websites, generating addresses through "dictionary attacks" that combine names and letters, and using scripts to register multiple email accounts to send spam. Some deceptive practices can also be criminal offences.

Who enforces CAN-SPAM, and can you sue?

Enforcement is by the Federal Trade Commission, other federal agencies for regulated industries, state attorneys general and internet access providers. Individual recipients have no private right of action under CAN-SPAM. You can, however, report violations to the FTC through ReportFraud.ftc.gov. CAN-SPAM also preempts most state laws that specifically regulate commercial email, except to the extent they prohibit falsity or deception.

Phone texts are different

Marketing text messages in the US are governed mainly by the Telephone Consumer Protection Act (TCPA), which generally requires prior express consent for automated marketing texts. If a retailer asks for your phone number at checkout, that is a separate consent decision from email.

CCPA and CPRA: California privacy rights

The California Consumer Privacy Act (CCPA), in force since 2020 and substantially amended by the California Privacy Rights Act (CPRA) from 2023, is a general privacy law rather than an email law. It matters for email because your address is personal information, and companies often share it for advertising.

Who has to comply?

The CCPA applies to for-profit businesses that do business in California and meet at least one of these thresholds:

• Annual gross revenue above a threshold that started at $25 million and is now adjusted for inflation.
• Buying, selling or sharing the personal information of 100,000 or more California consumers or households per year.
• Deriving 50% or more of annual revenue from selling or sharing personal information.

Your rights under the CCPA

• Right to know what personal information is collected, the sources, purposes and categories of third parties it is shared with, and to receive specific pieces of information.
• Right to delete personal information collected from you, subject to exceptions such as completing a transaction or legal compliance.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. "Sharing" specifically covers disclosure for cross-context behavioural advertising, which includes many ways stores upload customer email lists to ad platforms.
• Right to limit use of sensitive personal information, such as precise geolocation or the contents of mail, email and texts where the business is not the intended recipient.
• Right to non-discrimination for exercising these rights, although businesses may offer financial incentives, such as loyalty programmes, if they disclose the terms.

Businesses must respond to requests to know, delete and correct within 45 calendar days, extendable by another 45 days with notice. They must also honor opt-out preference signals such as Global Privacy Control sent by your browser as a valid opt-out of sale and sharing.

Enforcement

The California Privacy Protection Agency and the California Attorney General enforce the law. Individuals have a private right of action only for certain data breaches caused by a business's failure to maintain reasonable security, with statutory damages per consumer per incident. Many other US states, including Virginia, Colorado, Connecticut, Texas and Oregon, have since passed comprehensive privacy laws with broadly similar rights, though details and thresholds differ.

CASL: Canada's anti-spam law

Canada's Anti-Spam Legislation (CASL), largely in force since 1 July 2014, is one of the strictest email marketing laws in the world. It covers commercial electronic messages, including email and texts, sent to or from computers in Canada.

• Consent first. Senders need express consent, or implied consent in specific situations such as an existing business relationship (for example, a purchase within the previous two years or an enquiry within the previous six months).
• Identification. Messages must identify the sender and give contact information.
• Unsubscribe. Every message needs a working unsubscribe mechanism, which must remain valid for at least 60 days after sending, and requests must be processed within 10 business days.
• Penalties can reach C$10 million per violation for organisations and C$1 million for individuals.

Canadians can report spam to the Spam Reporting Centre run under the Government of Canada's anti-spam programme.

Other laws worth knowing

• Australia, Spam Act 2003: commercial messages need consent, must identify the sender and must include a functional unsubscribe facility; unsubscribe requests must be honored within five working days.
• Brazil, LGPD: a GDPR-style general data protection law with rights of access, correction, deletion and information about sharing, enforced by the national data protection authority (ANPD).
• India, Digital Personal Data Protection Act 2023: introduces consent-based processing and rights for individuals, with implementing rules being phased in.
• Switzerland, revised FADP: in force since September 2023, closely aligned with GDPR principles.

How the laws treat transactional versus marketing email

A frequent source of confusion is why unsubscribing from a store's marketing does not stop its order emails. The laws deliberately treat them differently.

How to exercise your email privacy rights, step by step

1. Stop the marketing

1. Use the unsubscribe button your email client shows next to the sender, which relies on the sender's List-Unsubscribe header.
2. If no button appears, use the unsubscribe link in the footer of a legitimate message.
3. Record the date. Under CAN-SPAM and CASL, mail should stop within 10 business days; in the EU and UK, objection to marketing takes effect without delay in principle, though a short processing period is generally tolerated.

2. Find out what a company holds

Send a data subject access request (DSAR) under GDPR, or a request to know under the CCPA. A simple template:

Subject: Personal data access request

I am requesting access to the personal data you hold about me under Article 15 of the GDPR [or: under the California Consumer Privacy Act]. My email address on your records is [address]. Please provide a copy of the data, the purposes of processing, the categories of recipients you have shared it with, how long you will keep it, and the source of the data if you did not collect it from me. I look forward to your response within the legal time limit.

Send it from the email address the company has on file, to the privacy contact listed in its privacy policy, and keep a copy.

3. Ask for deletion

If you no longer use a service, request erasure under Article 17 of GDPR or deletion under the CCPA. Expect the company to keep some records it is legally required to retain, such as invoices, and to keep your address on a suppression list so it does not email you by accident.

4. Opt out of sale and sharing (US states)

Look for a link such as "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" on the business's website, or enable Global Privacy Control in a supporting browser or extension.

5. Escalate if needed

• EU and EEA: complain to your national data protection authority, which you can find through the European Data Protection Board's list of members.
• UK: complain to the ICO; for unwanted marketing emails and texts it also offers a reporting tool.
• US: report deceptive or non-compliant commercial email to the FTC at ReportFraud.ftc.gov; for CCPA issues, file a complaint with the California Privacy Protection Agency or the Attorney General.
• Canada: report to the Spam Reporting Centre.

Where does a disposable email address fit legally?

A disposable email address is a temporary inbox that does not require registration and deletes messages automatically after a short time. Using one for your own privacy is a practical application of the same data minimisation principle that GDPR imposes on organisations: if a service does not need a permanent relationship with you, you can choose not to give it one.

Legitimate uses include receiving a one-time download, testing your own website's sign-up and confirmation emails, or checking how a new service handles email before you trust it with your real address. With VookMail, an address is created when the page loads, you can pick a custom username on one of about 31 domains or use the shuffle button for a random one, and messages and attachments are deleted automatically after about one day. How VookMail itself handles data is explained in its privacy policy, and how the service works technically on the methodology page: mail for its domains is received by a delivery provider through the domains' MX records and forwarded to VookMail over HTTPS.

Limits matter here too:

• Services may lawfully refuse disposable addresses. Some large platforms block disposable domains, and they are entitled to set that policy.
• Temporary addresses are not for important accounts. Banking, government services, healthcare and primary social accounts need an address you will always control, because those services send legally significant notices and account recovery messages.
• Misuse is not protected. Using any email service for fraud, abuse, harassment, impersonation, ban evasion or to break another service's terms can expose you to legal consequences. VookMail's terms and conditions prohibit this.
• Rights requests need a stable address. If you want to exercise GDPR or CCPA rights against a company, it will usually verify you through the address it has on file, which is another reason to use permanent addresses for relationships you may need to manage later.

A compliance checklist for people who send email

If you run a newsletter, an online shop or a small business, the rules apply to you. A practical baseline that satisfies the strictest regimes covered here:

1. Collect consent with an unticked checkbox or explicit sign-up action, and record when and how it was given.
2. Use double opt-in confirmation to prove consent and prevent typos and fake sign-ups.
3. Link a clear privacy notice at every point of collection.
4. Separate transactional and marketing streams, and do not slip promotions into receipts.
5. Include your organisation's identity and a valid postal address in every marketing email.
6. Support one-click unsubscribe through the List-Unsubscribe and List-Unsubscribe-Post headers, and process opt-outs immediately.
7. Keep a suppression list so opted-out addresses are never re-imported.
8. Disclose open and click tracking, and check whether your audience's jurisdiction requires consent for it.
9. Set retention periods and delete inactive subscriber data you no longer need.
10. Have a process to answer access, deletion and correction requests within one month (GDPR) or 45 days (CCPA).
11. Test the full sign-up and unsubscribe flow with a fresh inbox before launching, so you see exactly what a subscriber sees.

Common misconceptions

• "If an email address is public, I can market to it." Under GDPR and CASL, publicly visible addresses still require a lawful basis and usually consent for marketing. Under CAN-SPAM, harvesting addresses from websites is an aggravated violation.
• "Unsubscribing confirms my address to spammers." For legitimate senders, unsubscribing is the correct step and the law requires them to honor it. The risk applies to obvious spam from unknown senders, where reporting as spam is the better option.
• "GDPR only applies to EU companies." It applies to any organisation targeting or monitoring people in the EU or EEA.
• "CAN-SPAM lets me sue spammers." It does not give individuals a right to sue; enforcement is by regulators and internet access providers.
• "Deleting my account deletes all my data." Companies may legally retain some records, such as transaction history for tax, but should explain this when you ask.
• "Transactional emails are completely unregulated." They are exempt from many marketing rules but still need a lawful basis under GDPR and must not be deceptive.

Frequently asked questions

Does the CAN-SPAM Act require companies to get my consent before emailing me?

No. CAN-SPAM is an opt-out law: businesses may send commercial email without prior consent, but each message must be honest, identify itself as an advertisement where required, include a valid physical postal address and offer a working opt-out that is honored within 10 business days.

Can I sue a company for sending me spam in the US?

Generally not under CAN-SPAM. The law is enforced by the FTC, other federal agencies, state attorneys general and internet access providers, and it does not give individual recipients a private right to sue. You can report violations to the FTC at ReportFraud.ftc.gov.

How long does a company have to answer a GDPR access or deletion request?

One month from receiving the request. The organisation can extend that by up to two further months for complex or numerous requests, but it must tell you about the extension and the reasons within the first month.

Does GDPR apply to companies outside Europe?

Yes, when they offer goods or services to people in the EU or EEA or monitor their behaviour there. A non-EU online store that targets EU customers and sends them marketing email must follow GDPR for those customers.

What is the soft opt-in for marketing emails?

It is an exception in EU and UK ePrivacy rules that lets a business email existing customers about its own similar products or services without fresh consent, provided it collected the address during a sale or negotiation, gave a clear chance to opt out at that time, and offers an opt-out in every message.

Who does the CCPA apply to?

For-profit businesses that do business in California and meet at least one threshold: annual gross revenue above an inflation-adjusted figure that started at $25 million, buying, selling or sharing personal information of 100,000 or more California consumers or households, or earning at least half of annual revenue from selling or sharing personal information.

Is using a disposable email address legal?

Using a temporary inbox for your own privacy, spam control or testing is lawful in general and matches the data minimisation idea in laws such as GDPR. It becomes a problem only when used for fraud, abuse, impersonation or to break another service's terms, which VookMail's terms prohibit.

Are transactional emails covered by these laws?

Transactional messages such as receipts, shipping notices and security alerts are treated differently. CAN-SPAM exempts them from most requirements but still bans false routing information, and under GDPR they need a lawful basis such as performance of a contract but not marketing consent. They must not be used to disguise marketing.