Email Compliance and Permission Best Practices

Purpose: Sending only to recipients who have opted in protects your sender reputation, keeps spam complaints low, and keeps your program on the right side of the law.

Before You Begin

Email compliance is a legal topic, and which regulations apply depends on where your recipients are located, not where you are. This article is general awareness only, not legal advice. Talk to your own attorney to confirm your specific obligations.

All senders using Sure Send’s email services also agree to the Sure Send Email Policy, which sets baseline consent, identification, and content rules regardless of which regulations apply to your audience.

Key Regulations to Know

Most email regulations share one principle: recipients control what lands in their inbox. At minimum, that means honoring opt-outs, managing preferences, and meeting basic content requirements.

Important: Most regulations apply based on the location of the recipient, not the location of the sender. Your obligations can vary depending on where your audience lives.

Regulation	Jurisdiction	What It Covers
CAN-SPAM Act	United States	The primary US email law. Requires accurate sender identification, a truthful subject line, a physical mailing address, and a working opt-out honored within 10 business days. Full details at ftc.gov
CASL	Canada	Canadian Anti-Spam Legislation. Requires express or implied consent before you send a commercial message
GDPR	European Union	Applies to any recipient in the EU, regardless of where you’re sending from
CCPA	California, USA	Addresses data privacy rights for California residents

This list isn’t exhaustive. Confirm which regulations apply to your specific audience with a legal professional.

Why Permission Is Your Most Important Deliverability Tool

Beyond legal compliance, permission is the single biggest factor in whether a recipient reports you as spam. The main driver of spam complaints is simple: recipients getting mail they didn’t expect.

Sending unsolicited email means:

• Higher spam complaint rates
• Damage to your sending reputation
• Exposure under most of the regulations above

Spam Complaint Thresholds

Gmail and Yahoo treat a complaint rate of 0.1% (1 complaint per 1,000 delivered messages) as the target ceiling, and 0.3% as the point where your ability to deliver mail is at risk.

Not every mailbox provider reports complaint data back to senders, and when they do, it’s rarely the full picture. Assume mailbox providers are seeing more complaints from your mail than you’re aware of.

Best Practice: Explicit Opt-In

The most reliable approach is making sure every recipient on your list explicitly opted in to hear from you. It lowers complaints, satisfies most regulatory requirements, and builds an audience that actually wants to hear from you.

Opting Out: What’s Required

Every commercial message needs a working way to opt out. As of 2026, Gmail and Yahoo require one-click unsubscribe for bulk senders (a standard called RFC 8058), not just a link buried in the footer. [VERIFY: Confirm whether Sure Send’s campaign sends implement one-click unsubscribe (RFC 8058 List-Unsubscribe headers) automatically, so this section can state Sure Send’s specific behavior instead of the general industry requirement.] Sure Send does automatically add an unsubscribe link to the body of newsletter and campaign sends.

Whatever the mechanism, opt-out requests need to be honored quickly. The Sure Send Email Policy requires processing within 10 days of receipt. Don’t sit on unsubscribe requests. A slow opt-out process is one of the fastest ways to turn an unsubscribe into a spam complaint instead.

Tips

Tip: Audit your list sources periodically. If you’re not sure how or when a group of addresses was collected, don’t add them to an active campaign until you do. Old or unclear list sources are one of the leading causes of deliverability problems.

What’s Next

Once your permission practices are solid, move on to Email Content Best Practices to make sure what you’re sending holds up its end too.