When you can email your customers: CAN-SPAM, the GDPR and the soft opt-in.

The short answer

The US and Europe start from opposite ends. The US lets you send marketing email first and lets people say no. Europe asks for a yes first, with one exception for your own customers. Both treat a booking confirmation very differently from a newsletter, so the first job is sorting your emails.

• Before the first marketing email: in the US, no consent is needed. In the UK and the EU, you need consent or the soft opt-in.
• In every marketing email: the US requires honest headers and subject lines, a notice that it is an ad, your postal address and a clear opt-out. Europe requires the sender's identity, a valid address for opt-out requests and, for soft opt-in contacts, a simple opt-out in every message.
• When someone opts out: in the US you have 10 business days. Under the GDPR, once someone objects to direct marketing, their data can no longer be used for it.
• Business addresses: CAN-SPAM covers them in full. UK rules let you email corporate addresses without consent, and EU countries differ.
• Confirmations, receipts and reminders: not marketing in either system, until you add a promotion.

Text messages have stricter rules of their own, covered in text message consent rules. Whether your email lands in the inbox at all is a separate question, answered in why business emails go to spam.

The US: what CAN-SPAM asks of every message

The FTC's guide for business lists the requirements. In plain words, every commercial email must:

• Use honest header information: the From, To and Reply-To lines and the sending domain must identify who really sent it.
• Use a subject line that matches the content.
• Identify the message as an ad.
• Include your valid physical postal address: a street address, a post office box registered with the US Postal Service, or a registered private mailbox.
• Explain clearly how to opt out of future emails.
• Honour each opt-out within 10 business days, with an opt-out route that keeps working for at least 30 days after you send.

The opt-out itself must be simple. You cannot charge a fee, ask for more personal information than an email address, or make people do more than reply to an email or visit a single web page. Once someone has opted out, you cannot sell or transfer their address.

The law covers all commercial messages, not bulk email alone, and the FTC says it makes no exception for business-to-business email. Each separate email that breaks it can bring a penalty, and you stay responsible when an agency or a platform sends for you, because, in the FTC's words, you cannot contract away your legal responsibility to comply.

Which emails count as marketing

In the US, the test is the message's primary purpose. Messages whose content is only transactional or relationship content are exempt from most of CAN-SPAM. The FTC lists those narrowly: completing or confirming a transaction the customer already agreed to, warranty, recall, safety or security information, notices about changes to a membership, subscription or account, information about employment, and delivering goods or services the customer agreed to. A mixed message counts as commercial if its subject line would make a reasonable reader think it is an ad, or if the transactional part does not come first.

In the UK, the ICO separates service messages from direct marketing. A gym calling to say a membership payment failed is a service message. The same call with a pitch for personal training is direct marketing, because it promotes the gym's services. A neutral tone does not change that, though a logo or general branding does not make a message marketing on its own. The ICO also counts contacting people to ask for their consent to marketing as direct marketing in itself.

Applied to the emails a small business sends:

• Booking confirmation with the date, time and how to change it: a service message.
• Reminder the day before: a service message.
• Receipt, invoice or delivery update: a service message.
• A notice that opening hours are changing, with nothing else in it: a service message. Add "book now before we close for the holidays" and it becomes marketing.
• A rebooking nudge, such as "it has been six weeks since your last cut": marketing, because it promotes a service.
• Newsletter, seasonal offer, birthday discount or abandoned basket reminder: treat each as marketing.
• An email asking whether they would like to hear about offers: marketing, in the ICO's view.

Review requests sit in between, and no regulator has given a single answer for them. The ICO's test is whether a message promotes you, so one that also pushes an offer or a booking link is marketing. Keep review requests to the job just done, and send them only to people you may contact, as review request rules explains.

The UK and the EU: consent first

Article 13 of the EU's ePrivacy Directive allows email for direct marketing to individuals only with their prior consent, apart from the soft opt-in below. The UK has the same rule in its own regulations. The GDPR then sets what consent means. In practice:

• It is a clear action by the person, such as ticking an empty box. The ICO says you must not use pre-ticked boxes, silence or inactivity as evidence of consent.
• It is separate from other matters, such as accepting your terms, and written in plain words.
• It names you, and what you will send.
• You can show it was given: the GDPR requires the business to be able to demonstrate consent.
• Withdrawing it is as easy as giving it.

A checkbox that does the job reads: "Send me news and offers from Bramble Hair by email. You can unsubscribe at any time." It starts unticked and sits apart from any box about terms.

Separately, the GDPR gives everyone the right to object to direct marketing at any time. Once they do, their data can no longer be used for it, however you first got the address.

The soft opt-in for existing customers

The EU directive lets a business that obtained a customer's email address in the context of a sale use it to market its own similar products or services, as long as the customer is given a clear, free and easy way to object when the address is collected and in every message after that. The ICO's guidance sets out five conditions for the UK version:

• You obtained the contact details from the person yourself.
• You did so while selling, or negotiating to sell, a product or service.
• You only market your own similar products and services.
• You gave the person a chance to opt out when you collected the details.
• You give them a chance to opt out in every message after that.

The ICO adds detail that matters for small businesses. Someone does not have to buy: negotiations for a sale are enough, but a general query is not, and browsing a website does not count. Similar means what the person would reasonably expect from earlier dealings with you. An opt-out hidden in a privacy policy is not simple enough, and one offered only in a later order confirmation misses the moment of collection. The soft opt-in never covers bought-in lists. EU countries apply the rule through their own laws, with local differences.

At checkout or booking, the opt-out can be one line next to the email field: "We'd like to email you about our services and offers. Tick here if you would rather we didn't." A bike shop that sells a road bike this way can email that customer about servicing and accessories. It cannot pass the address to a partner, and it cannot use the soft opt-in for an address collected from a raffle at a fair, because nothing was sold or negotiated.

Emailing business addresses

In the US, CAN-SPAM applies to business email exactly as it does to consumers.

In the UK, the ICO says you can send marketing email to corporate subscribers without consent or the soft opt-in. Sole traders and ordinary partnerships count as individuals, so the consent rules apply to them. A named contact at a company, such as the practice manager at an architect's firm, is still personal data under the UK GDPR, so you need a lawful reason, a privacy notice and an opt-out that works.

The EU directive leaves countries to decide how business addresses are protected, and the rules differ from country to country. If you sell to businesses across Europe, check the rule in each country you email, or ask for consent everywhere and keep one simple process.

What to record with each address

If anyone asks how an address got onto your list, the answer should be in your records, not in someone's memory. Store these with each contact:

• Where it came from: a purchase, a booking, an enquiry, a newsletter form or a business card.
• The date it was collected.
• The basis: consent, the soft opt-in, a corporate address, or a US contact needing neither.
• The exact wording the person saw, such as the checkbox text or the opt-out line, and the form or page it was on.
• For the soft opt-in, what they bought, so you know what counts as similar.
• Every unsubscribe or objection, with its date, on a suppression list that stops the address being emailed again, even if it comes back in a later import.

Keep the old versions of your form wording too. A record that says "consent" without the words the person agreed to is half a record.

What to do with the list you already have

Most small businesses have a list built over years from bookings, sales and enquiries. Sort it by how each address arrived:

• US customers: you may email them, as long as each message follows CAN-SPAM and opt-outs are honoured.
• UK and EU customers who bought from you, or negotiated to, and were given a way to opt out when you took their address: the soft opt-in can cover marketing about similar products, with an opt-out in every message.
• UK and EU contacts who never bought, or were never offered an opt-out: you need consent, and you cannot email them to ask for it, because asking is marketing too.
• Addresses you cannot trace: leave them out.

For the last two groups, ask at the next real contact: when they book, at checkout, on the phone or with an unticked box on your forms.

Our own enquiry form works this way. The privacy notice says enquiry details are used to reply and arrange a conversation, and are not added to a mailing list or sold. If you want enquiries to join a list, ask on the form with a box of its own.

One trade, two countries

Take two barbershops that use the same booking software, one in Leeds and one in Austin.

• Confirmations and reminders: both send them to everyone. They are service messages, as long as no offer rides along.
• The rebooking nudge after six weeks: the Austin shop sends it to every client, with its postal address and an unsubscribe link in the footer. The Leeds shop sends it only to clients who booked through the online form, which carried the opt-out line, and to clients who ticked a consent box.
• Walk-ins in Leeds who gave an email address at the till with no opt-out offered: no marketing until the next visit, when staff ask.
• The newsletter: the same split as the nudge.
• Review requests: both keep them to the visit and send one only.

The software is the same. The difference is two fields on each client's record: how the address was collected, and whether the client said no. A salon or barbershop that stores those two fields can run one email plan in both countries.

Set up your email tool once

• Put your postal address in the footer of every marketing template.
• Keep an unsubscribe link in every marketing email, working in one step: no login, no fee, nothing asked beyond the email address.
• Import contacts with fields for source, date and basis, and tag soft opt-in contacts with what they bought.
• Keep the suppression list when you change tools. Export it before you cancel the old account.
• Send booking messages from your booking tool and marketing from your email tool, so unsubscribing from offers never stops a reminder.
• If an automation sends follow-ups, make each message check the customer's answer before it goes. Booking and calendar automation handles reminders, which need no marketing consent.

An online store should check the store platform's own email settings as well, because abandoned basket emails and product news can be switched on there rather than in the email tool.

Mistakes to avoid

• Adding every enquiry to the newsletter.
• A pre-ticked box at checkout.
• Emailing an old European list to ask for permission.
• Using the soft opt-in for products nothing like what the customer bought.
• An unsubscribe link that needs a login.
• Re-importing addresses that unsubscribed.
• Putting an offer in a booking reminder, which turns a service message into marketing.
• Buying a list. In Europe the soft opt-in never covers it, and in the US every message to it still has to follow CAN-SPAM.

This is general information, not legal advice. The rules differ between the US, the UK and each EU country, and they change. Ask an adviser before you email a list you are unsure about.