Can I email customers without consent?
It depends where they are.
And how you got the address.
In the US, yes: CAN-SPAM asks for no permission, only an honest email with your address and a working opt-out. In the UK and the EU, mostly no. You need consent, unless the person bought from you (in the UK, a quote request counts too), you offered an opt-out when you took the address and in every email, and you are selling them similar things. That is the soft opt-in. Canada gives you two years after a purchase, Australia wants consent, and a bought list fails everywhere except the US.
This is general information, checked against the official texts on 29 October 2026. It is not legal advice; for your own case, ask a lawyer.
By the Builderify team
Can you send marketing emails without consent?
Five laws, five answers.
The law that counts is usually the one where your reader is, not where you are. Canada’s law applies when a computer in Canada is used to send or open the email,CASL and Australia’s covers email opened there.Spam Act A UK shop with buyers in Toronto has the Canadian question too.
The US rules are in the CAN-SPAM compliance checklist, rule by rule. This page is the question before it: may you send at all?
-
United States
CAN-SPAM ActNo consent needed
You may email anyone, customer or not, as long as the email is honest, carries your postal address and a working opt-out, and you stop when asked.FTC
-
United Kingdom
PECR, enforced by the ICOConsent, or the soft opt-in
People who bought from you or asked for a quote can get emails about similar products if you offered an opt-out when you took the address and in every email. Limited companies need no consent; sole traders do.PECR reg. 22
-
European Union
ePrivacy Directive, Article 13Consent, or the customer exception
The same idea as the UK, narrower: it covers addresses obtained in the context of a sale. Each country writes it into its own law, and the rules for business addresses vary.ePrivacy Art. 13
-
Canada
CASL, enforced by the CRTCExpress or implied consent
A purchase gives you two years of implied consent and an enquiry six months. A business card handed to you covers email relevant to the person’s job.CASL
-
Australia
Spam Act 2003, enforced by the ACMAExpress or inferred consent
Inferred consent is narrow: the ACMA says a one-off purchase or an enquiry isn’t enough. Ask, and keep the proof.ACMA
What is the soft opt-in?
It is the UK’s exception to the consent rule, in regulation 22 of PECR. You may email someone without asking first if all three are true: you got their address while selling, or negotiating to sell, them something; you only market your own similar products or services; and you offered a free, simple way to refuse at the moment you collected the address and in every email since.PECR reg. 22 The ICO counts a quote request, a free trial or asking for more details as negotiating; browsing your site isn’t.ICO Since 5 February 2026, charities have a second version for people who supported or showed interest in their cause, but only for addresses collected on or after that date.DUAA 2025 s.114
Can I email this person?
Four questions, one answer.
Say where they are, how you got the address and what you want to send. The answer names the rule it rests on, links to the official text, and lists what every email to them needs. Run it once for each kind of contact on your list.
You can email them
Soft opt-in
This is the soft opt-in: you got the address while selling or negotiating a sale (the ICO counts a quote request), you market only your similar products or services, and you offered an opt-out when you took the address and in every email since.PECR reg. 22
- Who you are, not hidden or disguised
- A free, simple way to opt out, in every email
- A valid address for opt-out requests
The tree covers email to individuals and businesses in five places. It doesn’t cover texts, calls, charities’ own soft opt-in or anyone under 18, and it is not legal advice.
Who can you email without consent?
Every country, every relationship.
This assumes you are sending marketing about things like what they bought or asked about, and that you offered an opt-out when you took the address. Change either and some greens turn amber; the tree above shows which.
| How you got the address | US | UK | EU | Canada | Australia |
|---|---|---|---|---|---|
| They bought from you | Yes Opt-out law | Yes Soft opt-in | Yes Customer exception | Yes 2 years | Narrow |
| They asked for a quote or enquired | Yes Opt-out law | Yes Soft opt-in | Not a sale | Yes 6 months | Ask first |
| They signed up for your emails | Yes Opt-out law | Yes Consent | Yes Consent | Yes Express consent | Yes Express consent |
| A business contact you met | Yes Opt-out law | Companies: Yes Corporate Sole traders: Individual | Varies | Yes Business card | Ask first |
| From a bought or rented list | Yes Legal, risky | No Bought list | No Bought list | No Bought list | No Bought list |
A bought list never qualifies for the soft opt-in. The ICO’s words: there is no such thing as a third-party marketing list that is compliant with it.ICO The US is the one place on this grid where the law allows it, and the CAN-SPAM guide explains why harvested addresses still get you in trouble.
What counts as consent to email?
A yes you can show.
Consent is a clear action, for email from you, recorded when it happened. A newsletter box nobody ticked by default, with your name in the sentence next to it, does the job in all five places.
Email me news and offers from Hollis Bikes. I can unsubscribe at any time.
Unticked, its own box, your business name, what they will get and how to stop. Consent for cookies is a separate question, covered in do I need a cookie banner?
-
01
An action, not silence
An unticked box they tick, or a button they press. The ICO says pre-ticked boxes, silence and inactivity aren’t consent, and the CRTC says a pre-checked box can’t give express consent in Canada.ICOCRTC
-
02
Your name, and email
The ICO says the request has to make clear it covers your email marketing and name your business. Consent given to “partners” doesn’t carry over to you.ICO
-
03
Written down
Keep who agreed, when, how, and the words they saw. The ICO lists exactly that, plus whether and when they withdrew. In Canada and Australia, whoever claims consent has to prove it.ICOCASLACMA
-
04
Easy to take back
Every law on this page wants a working way out in every marketing email, and once someone uses it, consent is gone until they give it again.FTCICO
How long does it last? In Canada, express consent lasts until the person withdraws it.ISED UK law treats consent as given “for the time being”, and the ICO suggests that if you are in doubt, you refresh consent every two years.ICO Implied consent in Canada runs out on a clock: two years after a purchase, six months after an enquiry.CASL
Do order confirmations need consent?
No, until you add an offer.
An email that only does a job the person asked for isn’t marketing anywhere on this page. The ICO’s test is whether it promotes anything: a service message with advertising added becomes direct marketing.ICO Canada lists the exempt kinds by name, but still wants your name and an unsubscribe in them.CASL
| The email | Counts as | Consent? |
|---|---|---|
| Order confirmation, receipt, delivery note | Service | No consent needed anywhere on this page. In Canada it still needs your name and an unsubscribe. |
| A quote they asked you for | Service | Not marketing. Canada lists it by name as a message that needs no consent. |
| A receipt with “10% off your next order” | In the UK, adding an offer makes it direct marketing. In the US it depends on the subject and what comes first. | |
| “We’ve updated our privacy policy” with no offer | Service | Fine, as long as it doesn’t slip in a promotion. |
What do you do with an old customer list?
Sort it before you send.
Most old lists are a mix: some people you can email, some you can only ask, some you should drop. Six steps, in order, sort one into the three.
-
01
Sort it by how each address arrived
Sign-up form, checkout, quote request, business card, spreadsheet from somewhere. If you can’t say how an address got there, treat it as the last kind.
-
02
Take out anything bought, rented or scraped
For the UK, the EU, Canada and Australia, those addresses carry no consent given to you. In the US the law allows them, but they are where complaints come from.
-
03
Keep the sign-ups you can show
A sign-up with a date, a source and the words the person saw is the strongest thing on the list.
-
04
Check customers and enquiries against the rule
UK and EU: only if you offered an opt-out when you took the address; the ICO says you can’t add it later. Canada: purchases in the last two years, enquiries in the last six months. Australia: only an ongoing relationship.
-
05
Ask the rest somewhere other than their inbox
A sign-up popup on your site, a box at checkout, a question at the counter. Anyone who says yes joins with a fresh record.
-
06
Never re-add someone who unsubscribed
An old spreadsheet is the usual way it happens. Their opt-out outlives every list you import.
Can Builderify show how someone joined?
Every contact keeps its source.
Sign-ups from your popups, forms and quizzes land in Leads with the popup or form that produced them, so step one of sorting a list is already done. Broadcast campaigns and Sequences follow-ups read each contact’s status before they send.
-
A consent record for each sign-up
Each time someone joins through a popup, form or quiz, Builderify keeps how and when, the page they were on and their IP address, plus the exact consent wording they were shown if your form has a consent line.
-
A confirmation for every hand-added contact
Adding someone by hand asks you to tick “I confirm this person agreed to receive email from us.” Putting back someone who unsubscribed takes a confirmation that they asked.
-
A question before you send
Connecting a sender asks how people joined your list, and a person on our team approves a new sender before its first campaign.
-
An opt-out that sticks
One-click unsubscribe in every campaign and sequence email. The unsubscribe is checked before every send, and Broadcast and Sequences skip unsubscribed and bounced contacts.
What stays with you
Whether your list qualifies. Builderify records what happened; it doesn’t decide which law applies to a contact, whether your wording is clear, or whether an opt-out was offered at your checkout. The confirmation you tick when adding someone by hand is your word, so only tick it when it’s true.
Every account gets 250 free credits a month. A new lead costs 1 credit and each email sent costs 0.5 credits. There is no monthly fee: one-time packs start at $9 and never expire. See the pricing page.
Start freeEmailing without consent, before you ask.
It depends where they are. In the US, yes: CAN-SPAM needs no permission, only an honest email with your postal address and a working opt-out. In the UK and the EU you need consent unless the soft opt-in or the customer exception applies, Canada allows implied consent for two years after a purchase, and Australia generally wants consent. This is general information, not legal advice.
It is the UK exception in regulation 22 of PECR that lets you email without asking first when three things are true: you got the address while selling or negotiating a sale (the ICO counts a quote request), you only market your own similar products or services, and you offered a free, simple opt-out when you collected the address and in every email since. An opt-out added later, for example in an order confirmation, doesn't meet it.
In the UK, the EU, Canada and Australia, not without consent the people gave to you, which a bought list doesn't carry. The ICO says no third-party list meets the soft opt-in. US law doesn't ban bought lists, but addresses that were harvested from websites or guessed make a violation worse.
In the US, no. In the UK, not for limited companies and LLPs, but sole traders and ordinary partnerships count as individuals and need consent or the soft opt-in. In Canada, an address someone gave you without saying no covers email relevant to their job. EU countries each decide how business addresses are treated, so check yours.
No. A receipt, a quote someone asked for or an account notice isn't marketing under any of the five laws in this guide. Add an offer, such as a discount on the next order, and the ICO treats it as direct marketing. In Canada these messages need no consent but still need your name and an unsubscribe.
Sources
- FTC CAN-SPAM Act: A Compliance Guide for Business
- US Code 15 U.S.C. § 7704: requirements for commercial email, including harvested and generated addresses
- legislation.gov.uk PECR 2003, regulation 22: consent, the soft opt-in and the charity soft opt-in
- legislation.gov.uk Data (Use and Access) Act 2025, section 114: email marketing by charities, in force 5 February 2026
- ICO How do we comply with the PECR electronic mail marketing rules? (updated 28 April 2026)
- ICO Key concepts for direct marketing using electronic mail: service messages and subscriber types
- ICO How should we obtain, record and manage consent?
- EUR-Lex Directive 2002/58/EC (ePrivacy), Article 13: unsolicited communications
- Justice Laws Canada’s Anti-Spam Legislation, S.C. 2010, c. 23: sections 6, 10, 11, 12 and 13
- ISED Getting consent to send email (Canada)
- CRTC Compliance and Enforcement Information Bulletin 2012-549: no pre-checked boxes for express consent
- Federal Register of Legislation Spam Act 2003 (Australia), sections 6, 7, 16 to 18 and Schedule 2
- ACMA Avoid sending spam: consent, identification and unsubscribe rules
Each law and regulator page was read on 29 October 2026, and the Builderify details were checked against the product the same day. Laws change, and countries apply the EU directive in their own words. This is general information, not legal advice. For your own case, ask a lawyer.
Stop losing the visitors
you already paid for.
More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.