Email marketing is where a small US company most often meets European data protection for the first time, because a mailing list does not check passports. The obligations are not onerous and they are specific, and most of them improve the list anyway: a list built to these rules is smaller, more engaged and less likely to land in spam folders.
The six
One, have a lawful basis, which for cold marketing to individuals in practice means consent. Two, make it specific: the person agreed to this kind of email from this sender. Three, keep the record: who, what wording, when, by what route. Four, make withdrawal as easy as giving, which means one click and not a login. Five, act on withdrawal promptly and across every system that holds a copy. Six, tell people at sign-up what they are getting and how often, because the notice obligations apply to the list as they do to everything else.
Two US rules that apply either way
CAN-SPAM governs commercial email in the United States on an opt-out rather than a consent model, and it is not optional for a US sender. It requires accurate header and subject information, identification of the message as an advertisement where that is not otherwise clear, a valid physical postal address in the message, a working opt-out mechanism, and that opt-outs are honoured promptly. The rule applies per message and its obligations sit on the sender even where the sending is outsourced.
Bought lists and the shared-partner trick
A purchased list carries no consent you can evidence, and a sign-up form promising emails from us and our partners cannot make specific, informed consent for a party the reader was never told about. Both patterns also poison the deliverability of everything else you send. The honest version is a list you built yourself, with the wording recorded, and a re-permission campaign for any segment where you cannot say what was agreed.
Segmenting and tracking are processing too
Open and click tracking, profile building from behavior and audience syncing to advertising platforms are each separate purposes, and the notice has to describe them. Syncing a list to an advertising platform is very likely sharing within the meaning of California's statute even though nobody is paid, which brings the opt-out into play. A list is rarely just a list by the time a business has been running for a year.
Questions people ask about GDPR compliance for email marketing
Can we email existing customers without consent?
In the United States, CAN-SPAM's opt-out model permits it subject to its rules. For European recipients the position is narrower and depends on the relationship and on national rules about existing customers, so the safe route is a recorded opt-in.
Is a double opt-in required?
Not by the regulation. It is the cheapest way to produce a record you can rely on and to keep invalid addresses off the list, which is why most senders use it.
How fast must an unsubscribe be honoured?
CAN-SPAM requires opt-out requests to be honoured promptly, and the rule sets an outer limit of ten business days. Any modern mailing tool does it immediately, and the failure is usually a second system nobody suppressed.