Email Compliance: GDPR, CAN-SPAM, and Consent
If you send marketing emails, you are responsible for making sure your campaigns comply with the laws that apply to your recipients. MailerLogic provides tools to help you meet some of these requirements, but how you collect consent and manage your recipients is your responsibility.
Understand the Main Requirements
GDPR
GDPR applies to personal data, including email addresses. For marketing email, you generally need a lawful basis to process a contact's data, with consent being the most common basis.
You should also:
Be transparent about what the contact is signing up for.
Give contacts an easy way to withdraw consent.
Honor requests to access or delete their personal data.
Keep evidence of how and when consent was collected.
CAN-SPAM
CAN-SPAM applies to commercial email sent to recipients in the United States. Your marketing emails must:
Clearly identify the sender.
Include a valid physical postal address.
Provide a working unsubscribe mechanism.
Honor unsubscribe requests within 10 business days.
Use accurate, non-deceptive subject lines.
What MailerLogic Handles for You
MailerLogic provides several features that help you meet these requirements.
Marketing emails include the {{unsubscribe}} merge tag, and the email editor's footer presets add it automatically. The email linter also warns you if the tag is missing.
When a contact unsubscribes, MailerLogic processes the request immediately and adds the contact to your suppression list. Suppressed contacts are excluded from future sends, even if you import them again.
MailerLogic also provides the {{postalAddress}} merge tag for adding your physical postal address to campaigns. Your From name and address identify the sender, while SPF, DKIM, and DMARC help authenticate your sending domain.
For data requests, you can export or delete individual contacts, or export and close your entire account.
What You Are Responsible For
MailerLogic provides the tools, but you are responsible for obtaining valid consent.
Before sending marketing email:
Send only to people who have actively opted in to receive marketing email.
Keep evidence of consent, including the date and source.
Make it clear what the person is agreeing to when they provide their email address.
Don't treat a purchase, receipt request, or publicly available email address as marketing consent.
Don't add promotional content to transactional emails unless you have the required marketing consent.
Honor requests to delete personal data.
Keep your suppression and unsubscribe lists when moving to another email provider.
Make Unsubscribing Easy
Don't hide or make your unsubscribe link difficult to use.
An unsubscribe is a normal part of email marketing. If recipients can't easily opt out, they may mark your emails as spam instead. Spam complaints can have a much greater impact on your sending reputation than unsubscribes.
MailerLogic's email footer presets automatically include:
{{email}}{{unsubscribe}}{{postalAddress}}
Keep these fields in your marketing email footer.
Capture Consent With Forms
If you collect email addresses through a MailerLogic form, configure the form so that consent is clear and specific.
Add a checkbox specifically for marketing consent.
Leave the checkbox unticked by default.
Make the checkbox required if marketing consent is necessary for the subscription.
Store the consent information in a custom property or tag.
Consider using double opt-in if you need stronger evidence of consent.
For example, use a label such as:
Send me product updates and tips
Avoid vague wording such as:
I agree to the terms and receive marketing.
A double opt-in flow can send a confirmation email after form submission and only treat the contact as opted in after they confirm.
Know the Difference Between Transactional and Marketing Email
Transactional and marketing emails are treated differently.
| Transactional | Marketing | |
|---|---|---|
| Consent | Implied by the transaction | Explicit opt-in |
| Unsubscribe | Not required | Required |
| Postal address | Not required under CAN-SPAM | Required under CAN-SPAM |
| Examples | Password reset, receipt, order update | Newsletter, promotion, product announcement |
Be careful when combining transactional and promotional content. For example, adding a promotional banner to a receipt can cause the message to be treated as a marketing email and subject it to additional requirements.
Handle Data Deletion Requests
GDPR gives individuals the right to request deletion of their personal data.
If a contact asks you to delete their data:
Go to Contacts.
Find the contact.
Delete the contact according to your data-erasure process.
MailerLogic provides the technical tools to delete individual contacts, but you are responsible for receiving and acting on the request.
If you need to delete your entire MailerLogic account, see Exporting Your Data & Closing Your Account.
Frequently Asked Questions
Do I need double opt-in to comply with GDPR?
No. Single opt-in can be sufficient if you can demonstrate that the contact gave valid consent. Double opt-in provides stronger evidence of consent.
Can I import contacts from my previous email provider?
Only if you have valid consent for those contacts to receive marketing email from you. Having purchased from you previously or appearing on an old customer list does not automatically make someone a marketing subscriber.
Do unsubscribes expire?
No. Once a contact is added to the suppression list, they remain suppressed. Re-importing the contact does not automatically subscribe them again.
What if someone asks me to unsubscribe them directly?
If they don't use the unsubscribe link, you can manually add the contact to the suppression list from the Suppressions page.
Do I need a physical postal address if I work from home?
Yes. CAN-SPAM requires a valid physical postal address for commercial email. A PO Box or registered business address can be used instead of your home address.
Are pre-ticked consent boxes valid?
No. Under GDPR, consent must involve a positive action. Pre-ticked boxes and bundled consent don't meet this requirement.
Does MailerLogic provide a Data Processing Agreement?
Contact MailerLogic Support with your DPA requirements. The applicable terms are covered by the MailerLogic privacy policy and service agreement..
