Consumer Consent for Email: Marketing vs. Transactional Messages

Overview

One of the most common questions we receive from clients setting up their email program is: "Do I need explicit consent to send every type of email, or just marketing messages?"

The answer depends on the type of email you are sending, the jurisdiction your customers are in, and in some cases the specific content of the message. Getting this wrong can expose your business to legal liability, damage your sender reputation, and erode customer trust.

This article explains the distinction between marketing and transactional email, what consent is required for each, and how requirements differ across key markets.

Understanding the Two Types of Email

Before diving into consent requirements, it is important to clearly understand what distinguishes a marketing email from a transactional one — because the line is not always obvious.

Marketing / Promotional Email

A marketing email is any message whose primary purpose is to promote or advertise a product, service, or brand. This includes:

• Promotional offers, discounts, and sale announcements
• Newsletter and brand content
• New product or feature announcements
• Loyalty program promotions and reward offers
• Event invitations and announcements
• Win-back or re-engagement campaigns

The defining characteristic of a marketing email is that its primary intent is to drive a commercial action — a purchase, a visit, a sign-up, or engagement with your brand.

Transactional Email

A transactional email is a message triggered by a specific action or interaction the customer has taken, primarily serving to facilitate, confirm, or support that transaction. This includes:

• Order confirmations and receipts
• Shipping confirmations and delivery updates
• Appointment confirmations and reminders
• Password reset and account security notifications
• Loyalty points earned or reward notifications
• Account creation and welcome emails
• Billing statements and payment confirmations

The defining characteristic of a transactional email is that its primary purpose is to provide information the customer needs as a result of their own action or request.

The Gray Area — Mixed Content

The distinction becomes complicated when an email contains both transactional and promotional content. For example:

• An order confirmation that also includes a "You might also like" product recommendation
• A shipping notification with a promotional banner at the bottom
• A loyalty points update with an offer to redeem points on a current promotion
• An appointment reminder that also promotes an upsell service

How these are treated varies by jurisdiction — but as a general rule, if promotional content is present the entire message may be treated as a marketing email for consent purposes. When in doubt, keep transactional emails clean of promotional content or ensure you have marketing consent before adding it.

United States — CAN-SPAM Act

Transactional Email

Under CAN-SPAM, purely transactional emails do not require prior consent. If a customer has made a purchase, created an account, or taken an action that reasonably warrants a follow-up communication, you may send them the relevant transactional message without an explicit opt-in.

However, transactional emails must still:

• Accurately identify the sender
• Not use deceptive subject lines
• Include your physical mailing address
• Not contain false or misleading routing information

Marketing Email

Marketing email requires express consent, though CAN-SPAM does not require prior opt-in — it is an opt-out based law. This means you can technically send marketing emails to acquired addresses as long as you provide a clear unsubscribe mechanism and honor it promptly.

However this permissive standard is increasingly out of step with:

• ISP and mailbox provider standards — Gmail, Outlook, and Yahoo have tightened their filtering and increasingly require prior opt-in behavior to maintain good deliverability
• Best practice — most reputable email senders and platforms require opt-in to protect sender reputation and list quality
• State laws — several US states have enacted stricter privacy laws that go beyond CAN-SPAM, including California (CCPA/CPRA), Virginia, Colorado, and others

Our recommendation: Even though CAN-SPAM technically permits opt-out-based marketing email, we strongly recommend collecting explicit opt-in consent for all marketing communications. It produces better list quality, better deliverability, fewer complaints, and reduces legal risk as state-level laws continue to tighten.

Mixed Content Emails

CAN-SPAM treats mixed content emails based on their primary purpose. If the primary purpose of the email is transactional, it is treated as transactional even if it contains some promotional content. However determining primary purpose is a judgment call and carries risk — when in doubt, treat the email as marketing.

Canada — CASL (Canada's Anti-Spam Legislation)

CASL is significantly stricter than CAN-SPAM and applies to all commercial electronic messages sent to or from Canadian recipients, including emails.

Transactional Email

CASL provides an exemption for messages that:

• Facilitate, complete, or confirm a commercial transaction the recipient has previously agreed to
• Provide warranty, recall, safety, or security information about a product or service the recipient uses
• Provide factual information about an ongoing subscription, membership, or account

These purely transactional messages do not require prior consent under CASL. However the exemption is narrow — the message must be genuinely and exclusively transactional. Any promotional content can remove the exemption.

Marketing Email

CASL requires express or implied consent before sending any commercial electronic message.

Express consent — the recipient has explicitly opted in, with a clear description of what they are agreeing to receive. This is the gold standard and is always preferable.

Implied consent — is recognized in specific circumstances:

• The recipient has made a purchase or business transaction within the past 24 months
• The recipient has made an inquiry within the past 6 months
• The recipient has conspicuously published their email address without a statement that they do not wish to receive commercial messages

Implied consent is time-limited and expires automatically. Once the time window passes, you must obtain express consent or cease sending.

Key CASL requirements for all commercial messages:

• Clearly identify the sender and any organization on whose behalf the message is sent
• Provide contact information including a mailing address
• Include a functional unsubscribe mechanism that works for at least 60 days after sending
• Honor unsubscribe requests within 10 business days
• Maintain records of consent — the burden of proof is on the sender

Penalties: Up to $1 million CAD per violation for individuals and $10 million CAD per violation for businesses.

European Union — GDPR and ePrivacy Directive

The EU operates under two overlapping frameworks that together create some of the strictest email consent requirements in the world.

Transactional Email

Under GDPR, sending a transactional email can be justified under the contractual necessity legal basis — meaning you do not need separate consent to send an order confirmation or shipping update to a customer who has made a purchase, because sending it is necessary to fulfill the contract.

However:

• The message must be genuinely and exclusively transactional
• You must have a documented lawful basis for processing the recipient's data
• Adding promotional content risks removing the contractual necessity justification
• The recipient retains the right to object to processing of their personal data

Marketing Email

GDPR and the ePrivacy Directive together require explicit, freely given, specific, informed, and unambiguous consent for marketing email. This means:

• Pre-checked opt-in boxes do not qualify — the subscriber must take an active affirmative action
• Bundled consent does not qualify — consent for marketing email cannot be buried in general terms and conditions
• Consent must be granular — if you send multiple types of marketing emails, you may need separate consent for each
• Consent must be documented — you must be able to prove when, how, and for what purpose consent was obtained
• Withdrawal must be easy — subscribers must be able to withdraw consent as easily as they gave it

Additional GDPR rights impacting email:

• Right of access — subscribers can request a copy of all data you hold about them
• Right to erasure — subscribers can request deletion of their data, including removal from all lists
• Right to portability — subscribers can request their data in a portable format
• Data minimization — you should only collect data necessary for the stated purpose

Penalties: Up to €20 million or 4% of global annual revenue, whichever is higher.

Important note: Individual EU member states may have additional national legislation layered on top of GDPR. Requirements can vary by country within the EU.

Australia — Spam Act 2003 and Privacy Act 1988

Transactional Email

Australia's Spam Act provides an exemption for messages where:

• Consent can be inferred from the existing business relationship
• The message is sent in direct response to a customer action or inquiry
• The primary purpose is genuinely informational rather than commercial

Purely transactional messages — order confirmations, receipts, account notifications — generally fall within this exemption provided they contain no promotional content.

Marketing Email

The Spam Act requires consent for all commercial electronic messages. Consent can be:

Express consent — explicit opt-in, always the safest approach.

Inferred consent — can be inferred from the conduct of the parties or a business relationship, but this is a judgment call and carries more risk than express consent. The ACMA (Australian Communications and Media Authority) generally expects businesses to be able to point to a clear basis for inferring consent.

Key requirements for all commercial messages:

• Clearly identify the sender
• Include accurate contact information
• Provide a functional unsubscribe mechanism in every message
• Honor unsubscribe requests within 5 business days — one of the shortest windows of any jurisdiction

Penalties: Up to $1.1 million AUD per day for serious or repeated violations.

Jurisdiction Comparison at a Glance

Building a Compliant Multi-Jurisdiction Email Program

If your customer base includes recipients in Canada, the EU, or Australia, we strongly recommend building your consent practices to meet the highest common standard — which means GDPR-level explicit opt-in for all marketing communications. This single approach will keep you compliant across all jurisdictions simultaneously.

Keeping Transactional Emails Clean

To preserve the transactional exemption across all jurisdictions, keep your transactional emails free of promotional content. If you want to include recommendations or offers in post-purchase communications, either:

• Ensure you have separate marketing consent for those recipients, or
• Send a separate follow-up marketing email to those who have opted in

Documenting Consent

Regardless of jurisdiction, maintain a record of:

• The date and time consent was obtained
• The method of opt-in (web form, in-store, keyword, etc.)
• The specific language shown to the subscriber at the time of opt-in
• The source — which form, page, or touchpoint the opt-in came from

This documentation is your legal defense in the event of a complaint or regulatory inquiry.

When an Existing Customer Database Has No Documented Consent

If you have an existing customer database with email addresses but no documented marketing consent, do not simply begin sending marketing emails. The safest approach is to:

1. Send a single re-permission email from a channel where you have an established relationship, clearly explaining your email program and inviting customers to opt in
2. Only send marketing emails going forward to those who actively opt in
3. Accept that some of your existing database will not re-subscribe — this is normal and produces a healthier, more engaged list

Attempting to send to an unconsented list, even an existing customer database, risks spam complaints, blacklisting, and legal exposure particularly in Canada and the EU.

Quick Reference — Which Type of Email Are You Sending?

Use this guide to determine how to classify your email before sending:

Likely transactional — lower consent threshold:

• Order confirmation with no promotional content
• Shipping or delivery notification
• Password reset or security alert
• Account creation confirmation
• Loyalty points earned notification (points balance only, no offer)
• Appointment confirmation or reminder
• Billing statement or payment receipt

Likely marketing — full consent required:

• Promotional offer or discount
• Newsletter or brand content email
• New product or feature announcement
• Event invitation
• Loyalty reward redemption offer or promotion
• Re-engagement or win-back campaign
• Any email whose primary purpose is to drive a commercial action

Gray area — treat as marketing to be safe:

• Order confirmation with product recommendations
• Shipping notification with a promotional banner
• Loyalty points update with a current promotion offer
• Appointment reminder with an upsell

Need Help?

If you have questions about consent requirements for your specific email program or need help setting up compliant opt-in flows, our team is here to help.

Submit a support request at the My Support Portal or email us at suport@bloyal.com 

This article is provided for informational purposes only and does not constitute legal advice. Requirements vary by jurisdiction and change over time. We strongly recommend consulting with qualified legal counsel for guidance specific to your business and the markets you operate in.