As someone who works with email marketing, automation and global audiences, one question I get asked all the time is:
“In which countries do I legally need consent before sending marketing emails?”
If you’re only targeting India or Middle Eastern countries, you may never feel the pressure. But once your audience expands to Europe, UK, Canada, Australia, or South Africa, the rules change completely. These regions have some of the strictest email marketing laws in the world and compliance is not optional.
Let’s break down the exact countries where marketing emails legally require consent, how the laws differ, and what you should absolutely avoid if you don’t want your campaigns labelled as spam.
TL;DR – Leads
| Region | Consent needed? | Rules |
|---|---|---|
| Europe (GDPR) | Yes | Explicit opt-in required. No cold marketing allowed. |
| United Kingdom (GDPR + PECR) | Yes | Explicit opt-in required. No cold marketing allowed. |
| South Africa (POPIA) | Yes | Opt-in required for new prospects with no prior relationship. |
| Canada (CASL) | Yes | Express or implied consent required. Cold email illegal. |
| Australia (Spam Act 2003) | Yes | Consent required. Inferred consent does NOT apply to leads. |
| India | No | No strict laws, but recommended to get opt-in for deliverability. |
| Middle East | No | No strict laws, but recommended to avoid spam issues. |
TL;DR – Customers
| Region | Active Customers | Expired / Inactive Customers | Legal Basis | Best Practice Recommendation |
|---|---|---|---|---|
| Europe (GDPR) | Yes | Legally yes (soft opt-in) but risky | Soft opt-in for similar products, must offer opt-out | Avoid sending; ask for re-permission |
| United Kingdom (GDPR + PECR) | Yes | Legally yes (soft opt-in) but unclear timeframe | Past customer relationship recognized; opt-out required | Avoid sending; send a re-opt-in email instead |
| South Africa (POPIA) | Yes | Yes, explicitly allowed for related products | POPIA section 69 allows marketing to existing customers | You can, but still better to re-permission after expiry |
| Canada (CASL) | Yes (Implied consent) | Yes but time-limited (2 years after purchase) | Implied consent expires after 24 months | Stop sending after 24 months unless they re-consent |
| Australia (Spam Act 2003) | Yes (Inferred consent) | Yes if “reasonable expectation” exists | Inferred consent based on customer relationship | Stop when the relationship feels “ended” to the user |
| United States (CAN-SPAM) | Yes | Yes | No consent required, but must include unsubscribe | Allowed, but poor engagement hurts deliverability |
| India | Yes | Yes | No strict laws | Allowed but still avoid for deliverability reasons |
| Middle East (general) | Yes | Yes | Generally no strict consent laws | Allowed but risky for domain reputation |
🇪🇺 Europe (EU) — GDPR + ePrivacy Directive
Europe is the strictest region for email consent.
✔ Consent required
To send marketing emails in the EU, you must get explicit, active, and documented opt-in.
What counts:
- Unticked checkboxes
- Signup forms
- Newsletter opt-ins
- Double opt-in (recommended but not mandatory)
What doesn’t count:
- Pre-ticked boxes
- Buying or scraping email lists
- Adding someone automatically to marketing after a download or purchase
✔ Soft Opt-In Exists, But Only for Customers
You can send marketing emails without fresh consent if:
- The person is an existing customer
- The marketing is related to what they bought
- You offered an unsubscribe link at collection
- They can opt out anytime
Bottom Line
If your audience is in Europe, always assume: no consent = no marketing email.
🇬🇧 United Kingdom — UK GDPR + PECR
After Brexit, the UK retained almost identical email consent rules.
✔ Consent required
Marketing emails need explicit opt-in, same as GDPR.
✔ Soft opt-in allowed
For existing customers only.
Bottom Line
Rules are practically the same as Europe.
🇿🇦 South Africa — POPIA (Protection of Personal Information Act)
South Africa’s POPIA aligns closely with GDPR, but it has its own nuances.
✔ Consent required for marketing
You must have:
- Explicit permission, or
- A customer relationship that qualifies for soft opt-in
✔ Soft opt-in allowed
If the person purchased from you and you gave them an opt-out at the time.
Bottom Line
POPIA = “GDPR lite,” but still requires consent for all new subscribers.
🇨🇦 Canada — CASL (Canadian Anti-Spam Legislation)
CASL is widely considered the toughest anti-spam law in the world.
✔ Express consent required
This is the safest and strongest type of consent, and it never expires.
✔ Implied consent allowed but temporary
- Valid for 2 years after a purchase
- Valid for 6 months after an inquiry
Once that period ends, you must stop sending marketing emails unless you obtain express consent.
✔ No marketing without consent
Even a small promotional line can classify an email as a “Commercial Electronic Message” (CEM), which requires consent.
Bottom Line
Canada is extremely strict. Always go for express opt-in.
🇦🇺 Australia — Spam Act 2003
Australia requires consent, though the definition is slightly broader.
✔ Consent required
You can rely on:
- Express consent
- Inferred consent (only in ongoing relationships where marketing is expected)
❌ No emailing random people
Buying lists or harvesting emails is illegal.
Bottom Line
If you’re contacting someone for the first time, you must have explicit permission.
My Practical Advice as an Email Marketer
Even though some countries don’t legally enforce consent, inboxes like Gmail and Outlook still expect permission-based sending.
So my own rule — and the rule I tell my team is,
Always get consent unless it’s a transactional email.
Even where it’s not legally required, it’s the only way to protect your domain reputation.
Clean lists = Better deliverability
Clean lists = Higher conversion
Clean lists = Fewer spam complaints
And that ultimately matters more than the law.
