If you send marketing emails to contacts in the United States or the United Kingdom, two different legal frameworks apply, and getting either wrong can mean fines or a damaged sender reputation. Neither is complicated once you understand the basic requirements.
The US CAN-SPAM Act does not require opt-in consent before emailing someone, but it does require: an accurate, non-deceptive subject line; clear identification that the message is an advertisement where applicable; a valid physical postal address in the email; and a working, honored unsubscribe mechanism, with requests processed within 10 business days. Violations can carry penalties per email, so list hygiene and honoring opt-outs promptly both matter operationally, not just legally.
The UK operates under a stricter standard. The Privacy and Electronic Communications Regulations (PECR), alongside UK GDPR, generally require clear, specific consent before sending marketing emails to individuals, with a narrow "soft opt-in" exception for existing customers being marketed similar products or services who were given a clear chance to opt out at the point of data collection. Pre-ticked consent boxes and vague blanket consent are not considered valid under this framework.
In practice, this means a single list built for a US audience is not automatically compliant for a UK audience. If you're marketing across both, the safest approach is to build consent and segmentation with the stricter UK standard as the baseline for both regions, since UK-compliant consent generally satisfies CAN-SPAM's lighter requirements as well.
Not under CAN-SPAM specifically, though many senders use opt-in as best practice regardless. The legal requirement is accurate sender information, no deceptive subject lines, and an honored unsubscribe mechanism.
In most cases yes. UK PECR and UK GDPR generally require clear consent before sending marketing emails, with a limited soft opt-in exception for existing customers.
Penalties vary by jurisdiction and severity, and can include fines from regulators as well as damage to sender reputation and deliverability if recipients report messages as spam.