# Email Consent Explained: Opt-In, GDPR, CAN-SPAM and CASL

> What makes email consent valid, single vs double opt-in, the proof to keep, and how GDPR, CAN-SPAM and CASL differ, with the AcelleMail settings.

- Canonical URL: https://acellesend.com/kb/articles/email-consent-and-opt-in-explained
- Author: Daniel Reyes, Technical Editor
- Category: Domain Knowledge — Email marketing fundamentals — consent, deliverability, metrics, list quality, key terms
- Content type: guide · Difficulty: beginner
- Tags: Email Marketing Basics, Double Opt In, GDPR, Can Spam, CASL
- Published: 2026-09-30 · Last updated: 2026-10-06
- Reading time: 17 min
- Publisher: AcelleMail Knowledge Base, https://acellesend.com/kb

---

Consent is the permission a person gives you to send them email. It is what separates email marketing
from spam: in most countries the law draws that line, and the largest mailbox providers police it by
watching how people react to what you send.

This guide covers:

1. What valid consent looks like
2. Single opt-in vs double opt-in
3. The signup form: say what they will get
4. Keeping proof of consent
5. The rules in the United States, the EU and UK, and Canada
6. Making unsubscribing easy
7. How long consent lasts

Each part shows where the same idea lives in AcelleMail. The guide ends with the most common mistakes
and a one-screen summary.

> **Not legal advice.** This guide explains the general models. Which rules apply to you depends on where > you and your recipients are; the official texts are linked in section 5.

## 1. What valid consent looks like

The EU's General Data Protection Regulation (GDPR) gives the definition most other rules echo. Consent
is a "freely given, specific, informed and unambiguous indication" of what a person wants, given "by a
statement or by a clear affirmative action" ([GDPR, Article
4(11)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). On a signup form, those four words become four
tests:

| Test | What it means on a signup form | It fails when… |
|---|---|---|
| **Freely given** | Saying no costs nothing. | Agreeing to marketing is a condition of buying, downloading or registering. |
| **Specific** | It covers email marketing, from you, about what you described. | The wording is "I agree to receive communications". From whom, about what? |
| **Informed** | They know who you are, what you will send, and that they can leave at any time. | The form names no sender and says nothing about the content or about leaving. |
| **Unambiguous** | They did something: typed their address and pressed the button, or ticked an empty box. | The box was ticked before they arrived, or the page says "by continuing, you agree". |

The European Data Protection Board (EDPB), the EU's joint body of data protection regulators, spells out
what a person must be told for their consent to count: who you are, what you want their data for, what
data you collect, and that they can withdraw at any time ([Guidelines 05/2020 on
consent](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en),
§64; its two other items, automated decisions and transfers abroad, rarely apply to a newsletter). A
good signup form covers all of it in a few lines:

![Anatomy of a consent-ready signup form: the sender's name, what subscribers will get and how often, the Subscribe button as the clear action, how to unsubscribe, and a link to the privacy notice](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/01-signup-form-anatomy.png)

### What does not count

Some things look like permission and are not:

![What counts as consent — submitting a signup form, ticking an empty box, clicking a confirmation link — and what does not: a box ticked in advance, "by continuing you agree", a bought or scraped list, a line buried in your terms](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/02-what-counts-as-consent.png)

- **A box ticked in advance.** "The use of pre-ticked opt-in boxes is invalid under the GDPR," the EDPB
  says, and "silence or inactivity" does not count either (§79).
- **A list you bought, rented or scraped.** The people on it agreed, if at all, to hear from someone
  else. The UK's Information Commissioner's Office (ICO) accepts a bought-in list only if each person's
  consent named your organisation: "If the consent doesn't name you … then it is not valid"
  ([ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/how-do-we-comply-with-the-pecr-electronic-mail-marketing-rules/)).
  Recipients who do not know you report the mail as spam, and most sending services forbid such lists in
  their terms. More in [Email List Quality Explained](https://acellesend.com/kb/articles/email-list-quality-explained).
- **A line hidden in your terms.** The ICO asks you to "keep the consent separate from other things,
  such as terms and conditions". Agreeing to your terms is not agreeing to marketing.

### Implied consent and the "soft opt-in"

A few rules allow marketing email without explicit consent, in narrow cases:

- **EU and UK: the soft opt-in.** You may email your own customers about similar products or services
  when all of these are true (the ICO's list for the UK's Privacy and Electronic Communications
  Regulations, PECR; the EU's ePrivacy Directive has a similar exception):
  1. you got their contact details yourself,
  2. while selling them something, or negotiating to,
  3. you only market your own similar products or services,
  4. you gave them a chance to opt out when you collected the details,
  5. and you give them a chance to opt out in every message.
- **Canada: implied consent.** Canada's Anti-Spam Legislation (CASL) treats an existing business
  relationship as implied consent: a purchase in the past two years, or an inquiry in the past six
  months, and it ends when that period does. CASL also accepts a business address that someone published
  or gave you, without saying they do not want messages, for mail about their work ([CASL, section
  10](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/page-2.html)).
- **United States.** The CAN-SPAM Act does not require consent at all (section 5). But people who never
  asked for your mail report it as spam, and Gmail and Yahoo set limits on spam complaints (section 6).

## 2. Single opt-in vs double opt-in

With **single opt-in**, an address joins your list as soon as the form is submitted. With **double
opt-in** (also called confirmed opt-in), you first send a confirmation email, and the address joins only
when its owner clicks the link inside.

![Single opt-in: form submitted, contact subscribed. Double opt-in: form submitted, contact unconfirmed, confirmation email sent, they click the link, contact subscribed](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/03-single-vs-double-opt-in.png)

| | Single opt-in | Double opt-in |
|---|---|---|
| The address joins | as soon as the form is submitted | after the confirmation link is clicked |
| Shows the address works | No | Yes |
| Shows its owner asked | No | Strong evidence, because the click comes from their own inbox |
| Typos, fake and malicious sign-ups | Join the list, then bounce or complain | Never confirm, so never receive a campaign |
| The cost | None | Some people never click, so the list grows a little slower |

Few laws name double opt-in, but it is the strongest evidence of consent you can have (in Germany it is
the generally expected way to show it), and it keeps mistyped addresses, including the typo domains used
as spam traps, off your list. Use it on every form the public can reach.

### Turn on double opt-in for a list

1. Open **Lists**, choose the list, and open its **Settings** tab.
2. Under **Subscription settings**, switch on **Double opt-in** ("Require subscribers to confirm their
   email before being added").
3. Click **Save settings**.

![A list's Settings tab: under Subscription settings, Double opt-in is switched on, then Save settings](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/04-list-double-opt-in-setting.png)

### What a new subscriber sees

The list's **Forms / Pages → All templates** page shows every page and email of the sign-up journey, in
the order a new subscriber meets them:

![Forms / Pages, Subscribe section, numbered in the order a subscriber meets them: Public signup page, Confirmation page, Confirmation email, Thank-you page, Welcome email](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/05-subscribe-pages.png)

1. **Public signup page**: a hosted page with your signup form.
2. **Confirmation page**: shown after they submit the form. Tell them to check their inbox, and their
   spam folder, for the confirmation email.
3. **Confirmation email**: the email with the confirmation link. Keep it short: who you are, what they
   signed up for, one button. No offers yet.
4. **Thank-you page**: shown after they click the link.
5. **Welcome email**: sent once the subscription is confirmed, if **Send welcome email** is on in the
   list's settings.

Click **Settings** on a card to open that page or email and edit it.

### Contacts who have not confirmed

Until they click the link, new contacts wait with the status **Unconfirmed**, and campaigns skip them:
only **Subscribed** contacts receive campaigns. If some never confirmed, you can send the link once
more:

1. Open **Subscribers → View all** and set the status filter to **Unconfirmed**.
2. Tick the contacts.
3. Choose **Actions → Send confirmation email**.

![Subscribers filtered to Unconfirmed; two contacts ticked; the Actions menu is open with Send confirmation email highlighted](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/06-unconfirmed-subscribers.png)

Send it once. Someone who has ignored two confirmation emails has given you their answer. Leave the
**Subscribe** item in the same menu alone for unconfirmed contacts. It marks them **Subscribed** without
their confirmation.

## 3. The signup form: say what they will get

An AcelleMail signup form adds people to a list; that is its job. Submitting it is the clear,
affirmative action the law asks for, so you do not need an extra "I agree" box. What you need is the
promise next to the button, which makes the consent specific and informed:

![The form builder with example copy: the line under the heading says who sends what and how often, and pressing Subscribe is the consent](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/07-signup-form-promise.png)

Write that line like a promise you intend to keep:

- **What** you will send: "new features and how-to tips", not "updates".
- **How often**: "one email a month".
- **Who** it comes from: your business or team name.

Three rules for checkboxes:

- **Never tick a box in advance.**
- **Keep agreements apart from marketing.** A required box for your terms or privacy policy (the **Terms
  of Service** element in the form builder's **Compliance** group) asks people to accept your terms.
  That is not the same as consenting to marketing.
- **One list per kind of email.** If you also want to send something different, partner offers for
  example, give it its own list and signup form, so each list holds only the people who asked for it.

**Mailing people in Canada?** Under CASL, a request for consent must also give your mailing address plus
a phone number, email address or website, and say that consent can be withdrawn. Put it in the form's
small print.

## 4. Keeping proof of consent

Under the GDPR you must be able to show that a person consented. The burden of proof is yours (Article
7(1)). The EDPB suggests keeping a record of how and when consent was obtained and of the information
shown at the time, and warns that "it would not be sufficient to merely refer to a correct configuration
of the respective website" (§108). Under CASL, too, whoever claims consent has to prove it (section 13).

For each contact, keep:

| Record | Example | What it shows |
|---|---|---|
| When they joined | 2026-09-30 18:26 | When consent was given |
| How they joined | a signup form, the API, an import, added by hand | The route, and which contacts rely on your own records |
| Where from | the IP address of the signup | For a form signup, that it came from a real visit |
| That they confirmed | the status **Subscribed** on a double opt-in list | That someone with access to the inbox said yes |
| What they were shown | the form's wording at the time | What exactly they agreed to |

AcelleMail shows the first three on every contact, under the name at the top of the contact's page:
**Created**, **Source** and **IP address**.

![A contact who joined through the public signup page: Created, Source: web and IP address show when, how and from where they joined](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/08-subscriber-consent-record.png)

**Source** says how the contact arrived: `web` for the hosted signup page, `embedded-form` for a form on
your website, `api` for the API, `added` for someone added by hand, `imported` for a file import. For a
form signup, **IP address** is the visitor's; for contacts added by hand or through the API it is yours
or your server's. For imported contacts AcelleMail cannot know how you collected them, so the proof has
to come from your own records.

What AcelleMail cannot keep for you is the form's wording: when you change a signup form, save a dated
copy or screenshot of the old version. Keep the proof for as long as you email the person, and after
that only as long as you might need it for a legal claim (EDPB §107).

## 5. The rules in the United States, the EU and UK, and Canada

The three best-known models side by side:

| | United States (CAN-SPAM) | EU and UK (GDPR with ePrivacy / PECR) | Canada (CASL) |
|---|---|---|---|
| **Model** | Opt-out: no consent needed, but stop when asked | Opt-in: consent needed to email individuals, apart from the soft opt-in | Opt-in: express or implied consent needed |
| **Business addresses** | Covered: the FTC says the law "makes no exception for business-to-business email" | Varies by country. The UK lets you email company addresses without consent (not sole traders or ordinary partnerships), if you identify yourself and offer an opt-out | Covered, apart from narrow exemptions in the regulations |
| **In every message** | A clear note that it is an ad, your valid postal address, a working opt-out; no misleading From line or subject | Who you are and a working way to opt out | Your name, mailing address and one other way to reach you; an unsubscribe mechanism |
| **Unsubscribe deadline** | 10 business days; the opt-out must keep working for 30 days after you send | No set number of days: once someone objects to direct marketing, you must stop (GDPR Article 21(3)) | 10 business days; the mechanism must stay valid for 60 days after you send |
| **Maximum penalty** | Up to $53,088 per email (the FTC's figure at the time of writing, adjusted for inflation each year) | GDPR: up to €20 million or 4% of worldwide annual turnover, whichever is higher; UK GDPR: £17.5 million or 4%. The email rules in ePrivacy and PECR carry their own penalties | Up to CAD 10 million per violation for a business, CAD 1 million for an individual |
| **Official source** | [FTC compliance guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) | [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) · [ICO guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/) | [CASL](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/) |

What decides which rules apply is where your recipients are, not only where you are: the GDPR covers you
when you offer goods or services to people in the EU (Article 3(2)), and CASL covers messages sent from
or opened on a computer in Canada.

If you mail more than one country, the practical approach is to meet the strictest model everywhere:
express consent (the person actively agreed), collected with double opt-in, and every unsubscribe
honoured at once. That meets the consent and unsubscribe rules of all three; each law's own list of what
every message must contain still applies. For the law-by-law details in AcelleMail, see [GDPR Compliance
for Email Marketing with AcelleMail](https://acellesend.com/kb/articles/gdpr-compliance-guide-for-email-marketing), [CAN-SPAM
Compliance in AcelleMail](https://acellesend.com/kb/articles/can-spam-compliance-checklist) and [CASL Compliance in
AcelleMail](https://acellesend.com/kb/articles/casl-canadian-anti-spam-requirements).

Consent is only one part of the GDPR. What else it asks of a sender, from privacy notices to people's
rights and data processing agreements, is in [GDPR for Email Marketing
Explained](https://acellesend.com/kb/articles/gdpr-for-email-marketing-explained).

## 6. Making unsubscribing easy

Consent can be withdrawn at any time, and the GDPR requires withdrawing to be "as easy" as giving it
(Article 7(3)). The EDPB's example: a festival that took consent with one click online but accepted
withdrawals only by phone, on weekdays during office hours, did not comply (§115).

The deadlines, and the tighter rule the largest mailbox providers apply:

![How fast an unsubscribe must take effect: Gmail and Yahoo 2 days for bulk senders, CAN-SPAM 10 business days, CASL 10 business days, GDPR stop when they object](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/09-unsubscribe-deadlines.png)

Since 2024, Gmail and Yahoo require **bulk senders** to support **one-click unsubscribe**, to show a
visible unsubscribe link, and to honour unsubscribes within two days. For Gmail, a bulk sender is anyone
sending about 5,000 or more messages a day to personal Gmail addresses. One-click unsubscribe works
through **headers**, hidden lines at the top of every email that mail apps read: they let Gmail or Apple
Mail show their own Unsubscribe button ([RFC 8058](https://www.rfc-editor.org/rfc/rfc8058)). The same
rules limit spam complaints: Gmail asks senders to stay below 0.1% and never to reach 0.3%, and Yahoo
sets 0.3% (Google's [Email sender guidelines](https://support.google.com/a/answer/81126), Yahoo's
[Sender best practices](https://senders.yahooinc.com/best-practices/)). More in [Email Deliverability
Explained](https://acellesend.com/kb/articles/email-deliverability-explained).

### In AcelleMail

**One-click unsubscribe.** AcelleMail adds the `List-Unsubscribe` headers, with one-click support, to
every campaign email while **One-Click Unsubscribe Headers** is on. It is an admin setting under
**Settings → General**, section **Email & Campaigns**. Keep it on.

![Admin Settings, General, Email & Campaigns: One-Click Unsubscribe Headers switched on](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/10-admin-one-click-unsubscribe.png)

**The unsubscribe link.** The link in the email opens a short confirmation page: the address being
removed and one button, **Yes, unsubscribe me**. No login, no password, no reason required.

![The Confirm unsubscribe page: the address being removed and the Yes, unsubscribe me button](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-consent-and-opt-in-explained/11-confirm-unsubscribe-page.png)

**Offer a middle way.** Some people want less email, not none. A preference page lets them choose; see
[Subscriber Preferences & Frequency](https://acellesend.com/kb/articles/managing-subscriber-preferences-and-frequency).

**Keep the record.** Do not delete people who unsubscribe: their **Unsubscribed** status is your record
that they said no. A deleted contact can come back with the next import.

## 7. How long consent lasts

- **GDPR: no fixed expiry.** How long consent lasts "will depend on the context, the scope of the
  original consent and the expectations of the data subject", and if what you send changes considerably,
  you need to ask again. The EDPB recommends refreshing consent "at appropriate intervals" (§110–111).
- **CASL: implied consent from a purchase or an inquiry runs out**, two years after the purchase and six
  months after the inquiry. Ask for express consent before then: under CASL, an email that asks for
  consent is itself a commercial message, so it needs a valid consent to be sent.
- **In practice:** people who have not opened or clicked for a long time are the weakest part of your
  consent. Ask them once whether they still want your email, and remove those who do not answer. See
  [Email List Quality Explained](https://acellesend.com/kb/articles/email-list-quality-explained), section 6.

## 8. Common mistakes

| What you see | Why it is a problem | What to do |
|---|---|---|
| A "Keep me updated" box ticked in advance at checkout | Not a clear, affirmative action (EDPB §79) | Leave it empty; mail only the people who tick it |
| A form that only says "Subscribe" | The consent is neither specific nor informed | Add one line: what they will get, how often, from whom |
| A list you bought or rented, or got from a partner or an event | Consent does not pass to you, and the soft opt-in needs details you collected yourself | Import only people who asked to hear from you. Do not email the others to ask: that email is itself marketing. The ICO has fined companies for exactly that, Flybe and Honda among them, and CASL treats it the same way |
| "I agree to the Terms and Privacy Policy" as the only box | Accepting your terms is not consent to marketing | Keep marketing consent separate: the button and the promise next to it |
| An unsubscribe link that asks people to log in | Harder to leave than to join (GDPR Article 7(3)) | One page, one button, as AcelleMail does by default |
| No record of how older contacts joined | You cannot show that they consented (Article 7(1)) | Keep Created, Source and IP address, and a dated copy of each form version |

## Summary

1. Valid consent is freely given, specific, informed and unambiguous: a clear action by the person.
2. Never tick a box in advance, never rely on a bought list, never hide consent in your terms.
3. Put the promise (what, how often, from whom) next to the signup button.
4. Use double opt-in on every public form: **Lists → [your list] → Settings → Double opt-in**.
5. Keep proof: when, how and from where each contact joined, and what they were shown.
6. Know your model: CAN-SPAM is opt-out, while the EU, UK and Canada are opt-in. Or meet the strictest
   everywhere.
7. Make leaving easy with one page and one button, honour it at once, and keep **One-Click Unsubscribe
   Headers** on.
8. Refresh consent over time; in Canada, implied consent from a purchase or an inquiry expires.

Terms used here are defined in the [Email Marketing Glossary](https://acellesend.com/kb/articles/email-marketing-glossary).

---

## Related articles

- [Double Opt-In in AcelleMail: Toggle, Template, Decision Guide](https://acellesend.com/kb/articles/double-opt-in-vs-single-opt-in-which-to-choose): AcelleMail has one Double opt-in toggle per list. This walkthrough shows exactly where the toggle lives, what the confirmation email looks like, and a buyer-style decision guide for when to turn it on.
- [GDPR Compliance for Email Marketing with AcelleMail](https://acellesend.com/kb/articles/gdpr-compliance-guide-for-email-marketing): GDPR governs how you process EU residents' personal data — and email addresses are personal data. This guide walks the five obligations that touch email marketing (consent, access, erasure, portability, processor agreements) and shows the AcelleMail UI for each.
- [CAN-SPAM Compliance in AcelleMail: The 7-Point Checklist](https://acellesend.com/kb/articles/can-spam-compliance-checklist): CAN-SPAM applies to every commercial email you send to a US recipient — fines reach $51,744 per violating message. This checklist walks the 7 rules, marks the ones AcelleMail enforces for you, and tells you exactly where to set the rest.
- [CASL Compliance in AcelleMail: What Canadian Senders Need](https://acellesend.com/kb/articles/casl-canadian-anti-spam-requirements): Canada's Anti-Spam Legislation is one of the strictest in the world — fines reach CAD $10 million per violation. This guide covers express vs implied consent, what every Canadian CEM must contain, and how to record consent inside AcelleMail.
- [Email List Quality Explained: Sources, Spam Traps and List Hygiene](https://acellesend.com/kb/articles/email-list-quality-explained): Why bought lists fail, how good addresses go bad, the three kinds of spam traps, and the routine that keeps a list clean in AcelleMail.