Marketing email: types, rules and examples

The minimum, wherever your subscribers live#

This section is the checklist; the region notes further down are reference for when a case comes up. A subscriber in Canada or the EU brings their country’s rules with them, and a gmail.com address could be anywhere, so run one process that meets all four sets of laws (US, EU, UK and Canada):

• Permission before the first email: an unticked box on the sign-up form. The one exception, the soft opt-in, lets you email your own customers about products like the ones they bought if you offered a way to say no when they gave their address (the checkout notice).
• Who you are, in every email: your business name, a contact email and a postal address. The US and Canada require the postal one; UK and EU email rules ask you to name the sender clearly and give “a valid contact address” to opt out, not a postal address.^[7] Working from home? In the US, “a post office box you’ve registered with the U.S. Postal Service, or a private mailbox” works.^[1] A UK limited company must still show its registered office address on its website and business letters;^[20] a registered-office or virtual-office service keeps your home address private.
• An unsubscribe link in every email. The legal deadline in the US and Canada is 10 business days. Gmail also expects one-click unsubscribe from bulk senders (anyone who has once sent “close to 5,000 messages or more” to Gmail accounts in a day) and recommends honouring every unsubscribe “within 48 hours”.^[17] See one-click unsubscribe and the Gmail and Yahoo requirements.
• A record for each subscriber of when, where and with what wording they agreed.
• No promotions in receipts. US law tolerates a short one below the order details, but Google asks you not to mix the two, so the safe default is none.^[2]
• A rhythm you state and keep. Put it on the sign-up form and stick to it (see how often to send).

Starting from zero#

Build the first list only from people who ask: a sign-up box on your site, one at checkout, and a form at your counter or event. Never import your phone contacts or a bought list. Don’t send a newsletter from your own Gmail or Outlook either: it can’t add the one-click unsubscribe or keep consent records. Pick an email service that adds the unsubscribe link for you, stores when and how each person signed up, and lets you export that record. Before the first send, the service has you add a few DNS records to your domain (public settings anyone can look up, which here prove to mailbox providers that the mail really comes from you): Gmail requires “SPF or DKIM” from every sender and “SPF, DKIM, and DMARC” from bulk senders.^[2] DKIM, SPF and DMARC explained says what each one does. Ask a lawyer before you email bought addresses, cold-email businesses in Europe, or market a regulated product. Other countries, such as Australia, are not covered here.

Marketing or transactional? The primary-purpose test#

An email is transactional only if everything in it serves something the person already has: an order, a booking, an account. The US Federal Trade Commission (FTC), which enforces the CAN-SPAM Act, lists those purposes: confirming a purchase, warranty, recall or safety information, changes to an account or subscription, employment, and delivering what was bought. It adds that “the law views these categories narrowly”.^[1] A mixed email is marketing “if a recipient reasonably interpreting the subject line would likely conclude that the message contains an advertisement or promotion”, or if the transactional part “does not appear mainly at the beginning of the message”.^[1]

Canada exempts service emails from consent only when that is all they do; they still need your identification and an unsubscribe mechanism, and one that adds a promotion needs consent too.^[3] The EU and UK sources here set no primary-purpose test, so treat anything that promotes as marketing there.

When you cannot decide, send it as marketing.

Sending the two from separate addresses#

Google’s guidelines give promotions and receipts different From addresses in their own example (deals@ and sales@).^[2] Once campaigns reach about 1,000 emails a month on a regular schedule, give them a subdomain too, such as news.yourshop.example, with its own DKIM and SPF records (the DNS entries that prove mail is really from you); below that, a subdomain sees too little steady mail to build a record of its own, so a separate address on your main domain is enough. That is the subdomain guide’s judgement, not a rule. A subdomain gets its own Gmail statistics, but the parent’s bulk-sender count, and its DMARC policy unless the subdomain publishes its own, still cover it.

Types of marketing email, and who may get each#

So an app can tell existing users about a change to the plan they pay for without a box; a “what’s new” that sells a bigger plan needs consent or the soft opt-in.

For abandoned checkouts, start with three reminders, one hour, one day and three days after the checkout stalls, as a default to test. Whatever the schedule, stop the moment they buy, as Rasket’s store flows do.^[12]

The rules by region: US, EU, UK and Canada#

United States: CAN-SPAM#

The ad label needs no set words: you must “disclose clearly and conspicuously that your message is an advertisement”.^[1] The statute drops it when “the recipient has given prior affirmative consent”, so a newsletter people signed up for needs no label.^[4] The narrow exception: some addresses deliver to a phone as a text message, at a mobile carrier’s domain on a list the Federal Communications Commission keeps. Email to those needs “the express prior authorization of the addressee”.^[10]

European Union and EEA#

The European Data Protection Board’s (EDPB) draft guidelines on legitimate interest say email marketing “can only take place with the prior consent of the individual recipient” and “may not be based on” legitimate interest.^[5] Under the General Data Protection Regulation (GDPR), pre-ticked boxes and silence are not consent, withdrawing must be as easy as agreeing, and consent bundled into your terms is presumed not freely given.^[6] The exception is the soft opt-in, from the ePrivacy Directive, which each country writes into its own law. In November 2025 the Court of Justice ruled that an address given to open a free account, on a site that also sells paid access, counts as given “in the context of the sale”, and that when the soft opt-in’s conditions are met, the GDPR’s separate legal-basis test does not apply.^[19] So a free tier of a paid app can qualify; still check your country’s version. Every marketing email must show who sent it and give a valid address to opt out.^[11]

United Kingdom: PECR#

The Privacy and Electronic Communications Regulations (PECR) are enforced by the Information Commissioner’s Office (ICO). The soft opt-in applies when you got the address “while selling or negotiating to sell a product or service”. “A person doesn’t need to actually buy anything from you”: a service booking, a quote request or “signing up to a free trial” counts. Browsing does not, and a free account with no paid plan in view is not clearly covered, so use the box there. You must have offered the opt-out when you took the address, with “a prominent opt-out box”, not one hidden in a privacy policy. ^[7]

Canada: CASL#

Under Canada’s Anti-Spam Legislation (CASL), you carry the burden of proving consent, and the maximum penalty for a business is $10,000,000 per violation.^[3] The unsubscribe “must be able to be readily performed”.^[8]

What to put on your sign-up form and at checkout#

A sign-up box has four parts: your business name, what you will send and how often, a line saying people can withdraw, and a box they tick themselves. Canada adds your mailing address and a contact address to the request itself.^[8] In the EU and UK, link your privacy notice next to it: consent has to be informed.^[6]

Keep the proof. M3AAWG, the industry group where senders and mailbox providers agree best practice, says to record each sign-up’s IP address, date and time, and a copy of the wording and privacy policy shown.^[9] In a spreadsheet, that is one row per subscriber. A confirmation link the person must click adds proof the address is theirs: how double opt-in works.

At checkout: the soft opt-in notice#

For the soft opt-in, the notice and opt-out sit next to the checkout’s email field, where the customer types the address.^[7]

Abandoned carts and your shop’s own checkbox#

The ICO’s test for the soft opt-in is whether the shopper “actively” expressed an interest in buying, and its guidance does not say whether a stalled checkout counts.^[7] Show the checkout notice on the first step, where the address is typed, or send cart reminders only to shoppers who ticked a marketing box.

A shop platform’s built-in marketing checkbox is enough if it starts unticked for EU and UK shoppers, names your shop and what you will send, and records when it was ticked. On Shopify, Rasket’s store flows email only customers the store marks as subscribed.^[12]

Re-permissioning and warming a list you already have#

Sort the list by how each address got there, then treat each group differently:

• Signed up, with a record: keep mailing them what they signed up for.
• Customers who saw an opt-out when they gave their address: the soft opt-in covers similar products. For anything wider you may email this group to ask: M3AAWG advises moving customers whose consent is only implied to explicit consent “via a permission pass or confirmation campaign”, one email asking them to confirm, then marketing only to those who click.^[9]
• Customers who never saw an opt-out, and anyone with no record: no soft opt-in in the UK or EU, because the notice had to come at collection, and outside the US you may not email them to ask.^[7] Follow the steps below.

For that no-record group, step by step:

1. Stop sending them marketing. Their order, booking and account emails carry on as before.
2. Add the unticked box to your sign-up and account pages, and the notice to your checkout.
3. Add each person who ticks when they next buy, book or sign in, with a record; silence adds nobody.
4. Outside the US, don’t email them to ask: under CASL that email “is also considered to be a commercial electronic message”,^[3] and in the UK and EU it is marketing sent without consent. In the US you may send one, with your address and an unsubscribe link.

Restart a list you have not mailed in months with the newest sign-ups and buyers, widening only while bounces and complaints stay flat; the warm-up guide’s example schedule gives volumes.

Getting it delivered: reputation, bounces and frequency#

Mailbox providers judge your sender reputation by what recipients do, and people who never asked are the ones who report spam, so a lawful list without consent can still land in spam. Google asks you to keep your spam rate “below 0.10%” and never reach 0.30%.^[2] Reading the rate on a small list explains what that means at a few hundred sends.

• Promotions tab: Gmail files much of its marketing there, and it is part of the inbox, not spam. Is the Promotions tab bad for your email? weighs it.
• Bounces: remove an address at once when the bounce says the mailbox does not exist; the hard vs soft bounce post sorts the rest.

How often to send#

M3AAWG warns that unexpected jumps in frequency bring more complaints and asks senders to state the frequency at sign-up.^[9] No source sets a right number. As a default to test for a small business, start at about twice a month, the rhythm in the example box above, and keep to it. Send more often only while unsubscribes and complaints stay flat, and offer topics or a digest so people can get less without leaving.

Marketing email in Rasket#

Rasket handles the unsubscribe and the record from the dashboard, with no code. A campaign “adds the unsubscribe link and the one-click unsubscribe header, keeps unsubscribed people off the next send”.^[13] Every opt-in or opt-out writes a consent record “with its source, time and, where there was one, the IP address and user agent”,^[14] and Rasket’s sign-up forms “record the published version a person saw, with its consent text”.^[15] From your own app’s sign-up, the topics API writes the same record. A newsletter sent through the email API or SMTP must carry its own unsubscribe link (one-click unsubscribe explains).

The Free plan holds 900 contacts and sends up to 100 emails a day, campaigns included, so a campaign to a bigger list needs a paid plan. Pro is $20 a month with 4,500 contacts and 50,000 emails of any kind included; every email, campaign or receipt, counts toward that one allowance. A list of 5,000 contacts costs $28.80 a month on the pricing page’s calculator.^[16]

Rasket cannot tell you which law applies to a contact, or whether an old list’s consent holds. That comes from your records and, for edge cases, a lawyer. Start with the sign-up form: if it lacks any part of the example above, fix that before the next campaign.