[FAQ]

Hope you’re having a good end to the week.

I’m working on the email strategy for my e-commerce business here in Wellington, and I’m trying to get my head around legal compliance, as we have customers in both the US and Europe. I keep seeing two acronyms: GDPR and CAN-SPAM.

I know they’re both about rules for sending emails, but I’m not clear on the actual differences between them. In simple terms, what does one require that the other doesn’t? Is one of them stricter? If I comply with the tougher one, am I automatically covered for the other?

[Jeff Bullas]

A crucial question for any business operating in today’s global market. Understanding this distinction is fundamental to responsible marketing.

Brief Answer: The core difference is that Europe’s GDPR is an ‘opt-in’ law, requiring explicit consent *before* you can email someone for marketing. The US’s CAN-SPAM is an ‘opt-out’ law, which mainly requires that you give recipients a clear way to unsubscribe from future emails.

For any global business, the safest and simplest strategy is to build your email practices to comply with the strictest regulation—which is GDPR—as this will almost always ensure you are compliant with more lenient laws like CAN-SPAM.

As a preliminary note, the following information is for educational purposes and does not constitute legal advice. You should consult with a legal professional for specific compliance matters for your business.

The most significant difference between the two regulations is consent. Under GDPR, you must have documented, freely given, and unambiguous consent from an individual before you send them a marketing email. This is why the double opt-in method is considered the best practice for GDPR compliance. Conversely, CAN-SPAM does not require prior consent. You can send a commercial email to someone without their permission, provided you adhere to the law’s other rules.

The second key difference is their scope. GDPR applies to the data of any person residing in the European Union, regardless of where your company is based. If you have even one customer in an EU country, you must follow GDPR. CAN-SPAM is a US law that governs all commercial emails sent from or to the United States.

Finally, they have different requirements for the text content within the email. CAN-SPAM is very specific about what must be in your email footer: a valid physical postal address of the sender and a clear, functional unsubscribe link. GDPR is more focused on transparency about data rights, requiring you to clearly state why you have someone’s data and how they can exercise their rights to access or erase it.

Cheers,
Jeff

[Author]

Posts