Sending rules for marketing email: where the official sources are

This page points to the official sources. It isn't legal advice. No tool can tell you what the law requires of your business. Neither can a summary like this one. If you're unsure, ask the regulator or a qualified adviser. Rules change, so read the current page yourself.

An AI tool can write a newsletter that looks complete and still breaks these rules. It knows nothing about how you collected your list. Or what your signup form says. Those parts stay with you.

Rules depend on where your readers are

The three regulator pages below each touch on permission to send, honest sender details and a way to stop. The details differ. A rule in one country may not apply in another, and a business with readers in several countries may need to look at each. Other regulators exist beyond these three.

Australia

The regulator is the Australian Communications and Media Authority. It explains the Spam Act 2003 on its page "Avoid sending spam", which is the place to start.¹

On consent, the ACMA says you must have it before you send marketing email.¹ It adds that proving consent is up to you.¹ So keep a record of how and when each person signed up.

Buying a list doesn't remove the duty. Even when a stranger collected the addresses, you're still responsible for having consent for each one that you use.¹

On sender details, the page says messages need to identify the business. That information must stay correct for at least 30 days after sending.¹

On unsubscribing, it lists a requirement to honour a request "within 5 working days". It also says the option must not need a fee or a login.¹ Read the full list on the page, because it has more conditions than this summary.

United Kingdom

The Information Commissioner's Office covers email marketing in its guide to the Privacy and Electronic Communications Regulations. Its summary says you must not send marketing emails or texts to individuals without specific consent.²

There's a limited exception for a business's own past customers, often called the soft opt-in. The ICO says it does not cover new contacts, such as people on bought-in lists.²

On sender details, it says you must not disguise your identity. You must also give a valid contact address so people can opt out.²

A notice on the ICO page says a change in law has put its advice under review, so it could change. Check for updates before relying on it.²

United States

The main rule is the CAN-SPAM Act. A summary of it lists a visible, working unsubscribe option in every email. It also lists opt-out requests being honoured within 10 business days.³

The same summary lists a real physical address for the publisher or advertiser.³ The summary notes that the FTC issued final rules clarifying "primary purpose" (16 CFR 316).³ As our own advice, not the source's, the FTC's business guidance is the place to confirm the current requirements.

Read the US page on its own terms. Don't assume that what's fine in one country is fine in another. It often isn't.

What this means when you use AI

• Look for your sender name, contact details and unsubscribe link in every draft before it goes out. A tool may drop them, or make up a postal address.
• "Is this legal?" is a question for the regulator. A chatbot's reply may sound sure and still be wrong.
• Hold your signup records yourself. They're your proof of consent.
• Don't paste your subscriber list into a tool to "clean" it. The customer data page gives the reasons.

Your last pass before sending is set out in the pre-send routine.