# Email marketing consent for online stores: GDPR, CAN-SPAM

> How consent works for a store's email marketing under GDPR, ePrivacy and CAN-SPAM: opt-in vs soft opt-in, proof of consent, unsubscribes and order emails.

Source: https://pidgely.com/blog/ecommerce-email-consent-gdpr/ · Published: 2026-10-18 · Pidgely

Privacy law doesn't ban an online store's email marketing. It asks for three things: a **lawful basis** for each kind of email, a **clear purpose**, and an **easy, free way out**. Order emails rest on the purchase contract. Marketing emails rest on **consent** (opt-in) in most of Europe, on the **soft opt-in** for existing customers in the EU and UK, and on an **opt-out** model under the US CAN-SPAM Act. Whatever the jurisdiction, keep proof of how each address joined your list. Below is what the main rules say and how to apply them at checkout and signup.

> This article is informational and not legal advice. For your specific case, talk to your privacy counsel or data protection officer.

## The rules that matter for store email

### GDPR (EU) and UK GDPR

- **Lawful basis (Article 6)**: consent (6(1)(a)), contract (6(1)(b)) and legitimate interests (6(1)(f)) are the ones that matter for store email.
- **Proof (Article 7(1))**: when you rely on consent, you must be able to demonstrate that the person consented.
- **Withdrawal (Article 7(3))**: withdrawing consent must be as easy as giving it.
- **Fines (Article 83(5))**: up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements.

### ePrivacy rules (EU) and PECR (UK)

These sit on top of GDPR for electronic marketing. The general rule is prior consent for marketing emails to individuals, with an exception known as the **soft opt-in**: you may email existing customers about your own similar products or services if you got their address in the context of a sale, gave them a simple way to refuse at that moment, and give it again in every message.

### CAN-SPAM (US)

The [FTC's compliance guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) summarizes the main duties: no misleading headers or subject lines, identify the message as an ad, include a valid physical postal address, give a clear way to opt out and **honor opt-outs within 10 business days**. Messages whose primary purpose is transactional or relationship content are exempt from most of the Act.

Other markets have their own laws (Canada's CASL is notably consent-based, Brazil has the LGPD). If you sell internationally, build for the strictest market you serve.

## Three kinds of email, three bases

| Email | Examples | Typical basis | Unsubscribe |
|-------|----------|---------------|-------------|
| Transactional | Order received, payment, shipping, return | Contract | Not applicable; customers must get them |
| Customer relationship | Review request, replenishment reminder for a product they bought | Legitimate interests or soft opt-in, carefully | Yes, always |
| Marketing | Newsletter, promotions, launches, Black Friday | Consent or soft opt-in | Yes, one click |

The key point: **order emails don't need consent**, and that's exactly why they must not become disguised campaigns. A confirmation with a small recommendations block is still transactional; a "confirmation" that is mostly promotion is marketing. More in [order confirmation and shipping emails](/blog/order-confirmation-shipping-emails/).

## Collecting valid consent

### At checkout

- An **unticked** checkbox with specific wording: "Email me offers and news from Example Store. I can unsubscribe anytime."
- Consent **must not be a condition** of completing the purchase.
- For soft opt-in, show the opt-out at checkout ("Don't send me offers by email") and repeat it in every email.
- Keep channels separate: email and SMS or WhatsApp are different permissions (see [email vs. WhatsApp for ecommerce](/blog/email-vs-whatsapp-for-ecommerce/)).

### Signup forms and pop-ups

- Say what people will get and how often ("1 to 2 emails a week with launches and offers").
- If you offer a discount for signing up, be clear the signup is for marketing email.
- Link to your privacy policy in the form.

### Double opt-in

Not required by most laws, but very useful: the person confirms by clicking a link in an email. It proves the address exists and belongs to the person who signed up, and it filters out bots and typos, which matters a lot for discount-driven pop-ups. The first email of your [welcome series](/blog/ecommerce-welcome-email-series/) can be the confirmation itself.

## Keep the proof

Because you must be able to demonstrate consent, record for each contact:

```text
email:              ana@example.org
consent:            marketing_email = true
timestamp:          2026-10-18T14:32:05Z
source:             checkout | homepage-popup | account-signup
wording shown:      consent text v2026-09
ip / user agent:    stored by the form
double opt-in:      2026-10-18T14:35:40Z
```

On Pidgely, contacts take **custom properties** (for example `consent_source`, `consent_at`, `consent_version`), so the proof travels with the contact instead of living in a separate spreadsheet. See the [contacts guide](https://docs.pidgely.com/guides/contacts/).

## Unsubscribe: free, easy, immediate

- A **visible unsubscribe link** in every marketing email, with no login required.
- **One-click unsubscribe** through the `List-Unsubscribe` header (RFC 8058), which Gmail and Yahoo require from bulk senders. Google recommends processing unsubscribes within 48 hours ([Google FAQ](https://support.google.com/a/answer/14229414)). How it works: [one-click unsubscribe](/blog/one-click-unsubscribe-rfc-8058/).
- **"Less" instead of "never"**: offering "big sales only" or "once a month" keeps part of the list.
- **Sync unsubscribes across tools**: leaving the newsletter but still getting promotional abandoned cart emails from another tool is how complaints happen.

On Pidgely, every broadcast carries one-click unsubscribe, and unsubscribes go to the account's suppression list for future sends.

## Data subject requests that arrive by email

Beyond unsubscribing, customers can ask to access, correct or erase their data. Have a clear channel (usually a privacy address in your policy) and a process to find the person in every tool (store, email, CRM, messaging), answer within the legal deadline and keep the address suppressed when they ask to never hear from you again, so an old import doesn't bring them back.

## Consent checklist for store email

- Order emails separate from campaigns, never mostly promotional.
- Unticked, specific, optional marketing checkbox.
- Consent wording versioned and stored with timestamp, source and IP.
- Double opt-in on signup forms.
- One-click unsubscribe and a visible link in every campaign.
- Unsubscribes synced across every tool.
- Privacy policy with purposes, bases and a contact.
- No bought or "shared" lists.

Compliance is also deliverability: lists with clear consent generate fewer complaints, and fewer complaints keep your email in the inbox. That side of the story is in [ecommerce campaigns that avoid spam](/blog/ecommerce-campaigns-avoid-spam/).

## In numbers: what is included

Pidgely's Free plan includes 6,000 emails per month (200 per day), 3 domains and 3 templates, with the visual template builder on every plan. Starter is R$ 39 (50,000 emails), Growth R$ 149 (250,000) and Scale R$ 449 (1,000,000, with automations and an optional dedicated IP at R$ 129). Extra emails cost R$ 1.00, 0.80 and 0.50 per 1,000 on Starter, Growth and Scale. SPF, DKIM and DMARC are set up aligned, and every email carries one-click unsubscribe headers.

## Frequently asked questions

### Do I need consent to send order confirmations?

No. Order, payment, shipping and return emails are needed to perform the purchase contract, which is its own lawful basis under GDPR (Article 6(1)(b)). Under CAN-SPAM, transactional or relationship messages are exempt from most provisions. Consent rules apply to marketing.

### Can I email past customers who never ticked the marketing box?

In the EU and UK, the soft opt-in lets you email existing customers about similar products if you collected their address during a sale, offered a clear opt-out at that moment and offer it in every email. In the US, CAN-SPAM is opt-out based. Rules differ by country, so check where your customers are.

### Can the consent checkbox be pre-ticked?

Not under GDPR. Consent must be a clear affirmative act, and the regulation's recitals say pre-ticked boxes do not constitute consent. You also carry the burden of proving consent was given (Article 7(1)).

### How fast must I process unsubscribes?

CAN-SPAM requires honoring opt-outs within 10 business days. GDPR says withdrawing consent must be as easy as giving it. Google recommends processing unsubscribes within 48 hours. In practice, make it immediate with one-click unsubscribe.