Email Marketing Rules for Online Stores: CAN-SPAM, GDPR and Consent Basics (2026)

Not legal advice. This is a plain-English summary of official guidance from the US Federal Trade Commission, the UK Information Commissioner’s Office and the European Commission, plus Shopify’s and email vendors’ documentation, checked October 21, 2026. It’s based on published information, not hands-on testing or legal review. Rules depend on where your customers are – talk to a qualified lawyer about your specific situation.

The short version: in the US, CAN-SPAM is mainly an opt-out law – identify yourself, don’t mislead, include a postal address and honor unsubscribes quickly. In the UK and EU, marketing email to individuals generally needs opt-in consent (with a limited “soft opt-in” for existing customers in the UK). If you sell to both, building your store around clear opt-in consent covers the stricter case.

United States: CAN-SPAM

The FTC’s compliance guide says the law covers all commercial email, not just bulk mail, and “makes no exception for business-to-business email.” Its core requirements:

• Accurate headers: “From”, “To”, “Reply-To” and routing information must identify who sent the message.
• Honest subject lines that accurately reflect the content.
• Identify the message as an ad clearly and conspicuously.
• Include a valid physical postal address – a street address, a registered PO box or a registered private mailbox.
• Explain how to opt out clearly, with a return email or easy online method. You can offer topic choices, but must include an option to stop all marketing email.
• Honor opt-outs within 10 business days. Don’t charge a fee, ask for more than an email address, or require more than a reply or a single web page visit. The opt-out must keep working for at least 30 days after you send.
• You’re responsible even if you outsource your email marketing.

Penalties: the FTC says each separate email in violation can cost up to $53,088 (its inflation-adjusted figure, rechecked on the FTC guide Nov 11, 2026).

Order emails vs marketing emails. Transactional or relationship messages – such as completing a purchase or delivering goods – are largely exempt except for the rule against false routing information. But the FTC looks at the message’s primary purpose: if the subject line suggests a commercial message, or the transactional content isn’t mainly at the beginning, it’s treated as commercial. Keep promotions out of order confirmations, or follow the marketing rules for them.

UK: PECR and the soft opt-in

The ICO’s guidance on electronic mail marketing says you must not send marketing email to individuals unless they have specifically consented – or the soft opt-in applies. The soft opt-in covers existing customers who bought (or negotiated to buy) a similar product or service from you, provided you gave them a simple way to opt out when you collected their details and in every message since. It doesn’t cover prospects or bought-in lists.

Other points from the ICO:

• You must not disguise or conceal your identity, and you must give a valid contact address for opt-outs.
• Sole traders and some partnerships are treated as individuals; companies and other corporate bodies are covered by different rules.
• The ICO notes this guidance is under review because of changes made by the Data (Use and Access) Act, so check for updates.

EU and UK GDPR: what valid consent looks like

When you rely on consent, both the ICO and the European Commission describe the same standard: consent must be freely given, specific, informed and unambiguous. Key practical points:

• No pre-ticked boxes. The European Commission states that “pre-ticked boxes are not considered to be valid consent under the GDPR.” The ICO adds that silence and inactivity don’t count either.
• Keep consent separate from terms and conditions, and don’t make it a condition of buying unless it’s actually needed.
• Keep records so you can show who consented.
• Make withdrawal easy and tell people how to do it.

How Shopify handles email marketing consent

According to Shopify’s help center:

• Checkout checkbox: turn it on under Settings > Checkout > Marketing opt-in > Email. Shopify records consent when the customer selects the box and continues. Customers can also opt in when signing in to their account or through a newsletter form.
• Pre-selection by region: you can use Regions recommended by Shopify, which follows local rules, or Regions you choose. Selecting no regions means the box is never preselected – the safer choice given the GDPR guidance above.
• Consent wording: you can edit the text next to the checkbox, and Shopify says you need to change it if you enable abandoned cart reminders.
• Double opt-in: enable it under Settings > Notifications > Customer notifications > Marketing double opt-in. Customers then confirm by clicking a link in an email. Shopify says double opt-in “can help you meet GDPR compliance requirements” and that in some countries it’s required by law. Subscribers who joined before you switched it on aren’t asked to confirm.
• Automations: Shopify’s abandoned checkout automation is sent only to email marketing subscribers by default; you can change it to all customers, which is where consent rules matter most. See our abandoned cart setup guide.

Shopify also states that its automated consent settings “aren’t a substitute for legal advice.”

Practical checklist

• Checkout marketing checkbox on, with no preselection for UK/EU customers
• Consent wording that says what you’ll send (and mentions cart reminders if you use them)
• Double opt-in enabled where you sell to customers in countries that require or favor it
• Sender name and “From” address clearly identify your store
• Subject lines match the email content; no misleading claims
• Physical postal address in every marketing email footer
• Working unsubscribe link in every marketing email, processed within 10 business days at the latest
• Order and shipping emails kept free of primary promotional content
• No bought-in lists; UK soft opt-in used only for past customers with an opt-out offered each time
• Consent records kept, including when and how each contact opted in
• Re-check the ICO guidance for Data (Use and Access) Act updates

Tools that help

Double opt-in support, as described in each vendor’s help center:

Note the Omnisend limitation: contacts collected at Shopify checkout don’t receive its confirmation email, so use Shopify’s own double opt-in setting for checkout sign-ups. For plan and pricing details, see our GetResponse review, MailerLite review, ActiveCampaign review and Omnisend pricing guide.

See GetResponse plans

Again, this summary isn’t legal advice. Laws and official guidance change; verify the current rules for every country you sell into.