Email marketing consent for online stores: GDPR, CAN-SPAM

Privacy law doesn't ban an online store's email marketing. It asks for three things: a lawful basis for each kind of email, a clear purpose, and an easy, free way out. Order emails rest on the purchase contract. Marketing emails rest on consent (opt-in) in most of Europe, on the soft opt-in for existing customers in the EU and UK, and on an opt-out model under the US CAN-SPAM Act. Whatever the jurisdiction, keep proof of how each address joined your list. Below is what the main rules say and how to apply them at checkout and signup.

The rules that matter for store email

GDPR (EU) and UK GDPR

• Lawful basis (Article 6): consent (6(1)(a)), contract (6(1)(b)) and legitimate interests (6(1)(f)) are the ones that matter for store email.
• Proof (Article 7(1)): when you rely on consent, you must be able to demonstrate that the person consented.
• Withdrawal (Article 7(3)): withdrawing consent must be as easy as giving it.
• Fines (Article 83(5)): up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements.

ePrivacy rules (EU) and PECR (UK)

These sit on top of GDPR for electronic marketing. The general rule is prior consent for marketing emails to individuals, with an exception known as the soft opt-in: you may email existing customers about your own similar products or services if you got their address in the context of a sale, gave them a simple way to refuse at that moment, and give it again in every message.

CAN-SPAM (US)

The FTC's compliance guide summarizes the main duties: no misleading headers or subject lines, identify the message as an ad, include a valid physical postal address, give a clear way to opt out and honor opt-outs within 10 business days. Messages whose primary purpose is transactional or relationship content are exempt from most of the Act.

Other markets have their own laws (Canada's CASL is notably consent-based, Brazil has the LGPD). If you sell internationally, build for the strictest market you serve.

Three kinds of email, three bases

The key point: order emails don't need consent, and that's exactly why they must not become disguised campaigns. A confirmation with a small recommendations block is still transactional; a "confirmation" that is mostly promotion is marketing. More in order confirmation and shipping emails.

Collecting valid consent

At checkout

• An unticked checkbox with specific wording: "Email me offers and news from Example Store. I can unsubscribe anytime."
• Consent must not be a condition of completing the purchase.
• For soft opt-in, show the opt-out at checkout ("Don't send me offers by email") and repeat it in every email.
• Keep channels separate: email and SMS or WhatsApp are different permissions (see email vs. WhatsApp for ecommerce).

Signup forms and pop-ups

• Say what people will get and how often ("1 to 2 emails a week with launches and offers").
• If you offer a discount for signing up, be clear the signup is for marketing email.
• Link to your privacy policy in the form.

Double opt-in

Not required by most laws, but very useful: the person confirms by clicking a link in an email. It proves the address exists and belongs to the person who signed up, and it filters out bots and typos, which matters a lot for discount-driven pop-ups. The first email of your welcome series can be the confirmation itself.

Keep the proof

Because you must be able to demonstrate consent, record for each contact:

email:              ana@example.org
consent:            marketing_email = true
timestamp:          2026-10-18T14:32:05Z
source:             checkout | homepage-popup | account-signup
wording shown:      consent text v2026-09
ip / user agent:    stored by the form
double opt-in:      2026-10-18T14:35:40Z

On Pidgely, contacts take custom properties (for example consent_source, consent_at, consent_version), so the proof travels with the contact instead of living in a separate spreadsheet. See the contacts guide.

Unsubscribe: free, easy, immediate

• A visible unsubscribe link in every marketing email, with no login required.
• One-click unsubscribe through the List-Unsubscribe header (RFC 8058), which Gmail and Yahoo require from bulk senders. Google recommends processing unsubscribes within 48 hours (Google FAQ). How it works: one-click unsubscribe.
• "Less" instead of "never": offering "big sales only" or "once a month" keeps part of the list.
• Sync unsubscribes across tools: leaving the newsletter but still getting promotional abandoned cart emails from another tool is how complaints happen.

On Pidgely, every broadcast carries one-click unsubscribe, and unsubscribes go to the account's suppression list for future sends.

Data subject requests that arrive by email

Beyond unsubscribing, customers can ask to access, correct or erase their data. Have a clear channel (usually a privacy address in your policy) and a process to find the person in every tool (store, email, CRM, messaging), answer within the legal deadline and keep the address suppressed when they ask to never hear from you again, so an old import doesn't bring them back.

Consent checklist for store email

• Order emails separate from campaigns, never mostly promotional.
• Unticked, specific, optional marketing checkbox.
• Consent wording versioned and stored with timestamp, source and IP.
• Double opt-in on signup forms.
• One-click unsubscribe and a visible link in every campaign.
• Unsubscribes synced across every tool.
• Privacy policy with purposes, bases and a contact.
• No bought or "shared" lists.

Compliance is also deliverability: lists with clear consent generate fewer complaints, and fewer complaints keep your email in the inbox. That side of the story is in ecommerce campaigns that avoid spam.

In numbers: what is included

Pidgely's Free plan includes 6,000 emails per month (200 per day), 3 domains and 3 templates, with the visual template builder on every plan. Starter is R$ 39 (50,000 emails), Growth R$ 149 (250,000) and Scale R$ 449 (1,000,000, with automations and an optional dedicated IP at R$ 129). Extra emails cost R$ 1.00, 0.80 and 0.50 per 1,000 on Starter, Growth and Scale. SPF, DKIM and DMARC are set up aligned, and every email carries one-click unsubscribe headers.