Every store that sends email or text messages has to answer the same questions: who agreed to hear from us, what did they agree to, and can we prove it? Getting this right is partly about the law, and partly about practical things that affect sales: whether your emails reach the inbox, whether customers trust you, and whether a complaint turns into a problem.
This guide explains the basic ideas in plain language. It names the main laws so you know what to look up, but it does not summarize them in detail, and the rules change. Treat it as a starting point and check the requirements that apply where your customers live.
Key takeaways
- Transactional messages and marketing messages are treated differently. Order confirmations are not newsletters.
- Clear, affirmative opt-in is the safest standard for marketing, even where the law in your country is looser.
- SMS is stricter than email in many places, especially the US.
- Unsubscribing must be easy and must work quickly.
- Keep records of who agreed, when, where and to what wording.
Transactional vs marketing messages
The first question for any message is what kind it is.
| Transactional (service) messages | Marketing messages | |
|---|---|---|
| Purpose | Complete or update something the customer started | Promote products, offers or the brand |
| Examples | Order confirmation, shipping updates, password reset, receipt, a requested back-in-stock alert | Newsletters, sale announcements, product launches, abandoned cart offers |
| Consent | Generally not marketing consent; sent because of the transaction or request | Usually needs consent or, in some places, a lawful alternative basis |
| Unsubscribe | Customers usually cannot opt out of essential order messages | Must always be possible |
The line blurs when transactional messages carry promotions. A shipping notice with a large “20% off your next order” banner may be treated as marketing, depending on the rules that apply and on how much of the message is promotional. Keep transactional messages mainly transactional.
Some messages sit in the middle. A back-in-stock alert the customer explicitly asked for is close to a requested service message, as long as it stays about the item they asked about. Our back-in-stock notifications guide explains how to keep alerts focused. Abandoned cart reminders, on the other hand, are generally treated as marketing in many places, so check your consent status before sending them. Our guide to abandoned cart emails covers timing, content and discounts.
How people opt in
| Method | How it works | Notes |
|---|---|---|
| Single opt-in | The person enters their email and ticks a box or submits a form | Simple; vulnerable to typos and fake signups |
| Double opt-in | After signing up, the person clicks a link in a confirmation email | Stronger proof of consent and cleaner lists; some signups never confirm |
| Checkout checkbox | An unticked box at checkout: “Email me with news and offers” | Common on store platforms; must not be pre-ticked where consent is required |
| Existing customer rules | Some countries allow emailing existing customers about similar products if they were given a chance to opt out | Often called the soft opt-in in the UK; conditions apply and it rarely covers SMS |
Practical rules for signup forms
- Use unticked boxes. Pre-ticked boxes do not count as consent under GDPR and similar laws, and they create customers who did not expect your emails.
- Say what people will get: “Weekly emails about new products and offers. Unsubscribe any time.”
- Keep email and SMS consent separate. One checkbox for each channel.
- Do not bundle consent with something else. Agreeing to terms of sale, entering a giveaway or creating an account should not automatically sign someone up for marketing.
- Link to your privacy policy near the form.
Should you use double opt-in?
Double opt-in is not required everywhere, but it has real advantages for small stores: it filters out typos and fake addresses, gives you clear evidence that the person controls the address, and tends to produce a more engaged list. The cost is that some people never click the confirmation link. Many stores use double opt-in for newsletter forms and rely on the checkout checkbox for customers. Our guides to a welcome email series and email deliverability basics cover what to send after someone signs up and how a clean list helps you reach the inbox.
Why SMS consent is stricter
Text messages are personal, immediate and often cost the recipient something, so many countries regulate them more tightly than email.
- In the US, the Telephone Consumer Protection Act (TCPA) governs marketing calls and texts, and some states have their own additional rules. Marketing texts generally require prior express written consent, which in practice means a clear statement the customer actively agrees to, separate from other terms.
- Mobile carriers set their own requirements. In the US, businesses texting from standard phone numbers generally need to register their use case with carriers (often called 10DLC registration), and carriers can filter messages that do not follow their guidelines.
- Other countries have their own rules on consent, sender identification and sending times.
Common elements of a compliant SMS signup and program:
- A clear description of what messages the customer will get and roughly how often.
- A statement that consent is not a condition of purchase, where required.
- A note that message and data rates may apply, common in the US.
- Your store’s name in messages, so people know who is texting.
- Support for standard keywords such as STOP to opt out and HELP for information.
- Sending at reasonable hours in the recipient’s time zone; some places restrict sending times.
Because the rules and penalties around texting can be significant, SMS is the area where it is most worth getting professional advice before you start, and most worth using a reputable SMS provider that builds these requirements into its tools.
Unsubscribe and opt-out
Making it easy to leave is both a legal requirement in many places and good practice.
- Every marketing email needs a clear unsubscribe link. Do not hide it, require a login or ask people to email you.
- Act on opt-outs promptly. Laws such as CAN-SPAM set time limits; most email platforms process unsubscribes instantly, which is the best approach anyway.
- One-click unsubscribe: major mailbox providers now expect bulk senders to support it. Most email platforms handle this for you; check that it is switched on.
- Offer a preference center if you send several types of email, so people can reduce frequency instead of leaving entirely. Always keep a “unsubscribe from all” option.
- Respect opt-outs across tools. If someone unsubscribes in your email platform, make sure another tool does not add them back through a sync.
- SMS opt-outs usually come through keywords like STOP. Confirm the opt-out with one final message and send nothing else.
What records to keep
If a customer, a mailbox provider or a regulator asks how someone came to be on your list, you should be able to answer.
| Record | Example |
|---|---|
| Contact | Email address or phone number |
| Channel | Email, SMS or both, recorded separately |
| Date and time | When consent was given |
| Source | Checkout, footer form, pop-up, in-store tablet |
| Wording shown | The exact text next to the checkbox or form at that time |
| Confirmation | Double opt-in click, if used |
| Changes | Unsubscribes and preference changes, with dates |
Most store and email platforms record some of this automatically. Check what yours keeps, and save a copy of each version of your signup wording with the dates it was live.
Things to avoid
- Buying or renting lists. People on them did not agree to hear from you, deliverability suffers and many laws treat it as a breach.
- Importing contacts from other sources such as business cards, marketplace orders or social media followers without checking consent.
- Adding back-in-stock or giveaway signups to your newsletter without separate consent.
- Emailing old lists that have not heard from you in years. Even if consent was valid, expectations have faded; consider a re-permission email first.
- Copying another store’s consent wording without checking it fits what you actually send.
A simple consent checklist
- List every place you collect email addresses and phone numbers.
- Check each form has clear wording and unticked, separate boxes for email and SMS.
- Confirm transactional messages stay mainly transactional.
- Test the unsubscribe link and SMS STOP handling yourself.
- Check what consent records your platforms keep, and save your signup wording.
- Review your privacy policy so it describes what you collect and which services process it.
- For SMS or international sending, get advice on the rules that apply.
Bottom line
Ask clearly, record it, send what people agreed to, and let them leave easily. Keep transactional and marketing messages apart, treat SMS with extra care, and look up the specific laws for the places your customers live. This guide is general information; for anything beyond the basics, especially SMS, talk to someone qualified in the relevant law.
