Express vs. Implied Consent: What’s Legal in Email Marketing Now?

If you're sending marketing emails, you need permission. But not all permission is created equal — and not all of it is legal anymore.

Following the wrong approach can do more than hurt your deliverability. It can cost you big fines, damage your brand's reputation, and erode trust with your audience. People are more protective than ever of their inboxes. If your emails show up uninvited, you're not just ignored — you're blocked, reported, or blacklisted.

This article explains the difference between express and implied consent, how different countries treat each type, and what this means for your email strategy today. We’ll cover the legal requirements across regions, but keep in mind: legal compliance is just the starting point. If you want to build trust and engagement, the gold standard is always to use express opt-in—no matter where your audience is located.

What’s the Difference Between Express and Implied Consent?

Express consent (also called "explicit consent" or "affirmative consent") is when someone clearly agrees to receive your emails — usually by filling out a form to subscribe to your newsletter, checking a box to subscribe when opting in for a lead magnet, or filling out a form that includes an option for “Yes, send me updates.”

Implied consent (sometimes called "passive consent" or "inferred consent") means you think they’d be okay with it — maybe because they gave you their email in a contact form (that lacked an explicit opt-in checkbox), gave you their business card, or made a purchase.

A few years ago, marketers relied heavily on implied or inferred consent. That’s no longer safe. Today, most privacy laws require clear, active permission — meaning express consent — for marketing emails.

So let’s look at what’s legal — and what’s not — based on where your contacts are.

🇺🇸 United States (CAN-SPAM)

The U.S. is one of the few regions where you don’t legally need permission before sending marketing emails. Under the CAN-SPAM Act, email marketing is allowed without prior consent, as long as you follow specific rules. These include using accurate sender details, providing a clear opt-out method, and including a physical address.

While this may sound flexible, it doesn't mean it's wise to skip consent. Just because you can send cold emails doesn't mean you should. Inboxes are crowded, and unwanted messages are often flagged as spam. Gaining permission up front helps protect your sender reputation, improves deliverability, and shows respect for your audience’s preferences.

• You do need to:
  
  
• Include your real name and physical address (not just a post office box).
  
• Use honest subject lines and sender info (no spoofing).
  
• Make it easy to unsubscribe.
  
• Honor opt-out requests within 10 business days.
  
  

💡 Best Practice: Even though permission isn't required, it’s still smart to get express consent. It keeps your list cleaner and your audience happier.

🇨🇦 Canada (CASL)

Canada has strict rules when it comes to email marketing. The law here is called CASL — the Canadian Anti-Spam Legislation — and it requires you to have either express or implied consent before sending any commercial electronic messages.

Under CASL, express consent means someone has clearly agreed to hear from you — usually by filling out a form or checking a box that says "Yes, I want to receive emails."

Implied consent is only allowed if you have an existing business or non-business relationship with the person — like if they bought something from you, requested a quote, or made a donation. But even then, that implied consent only lasts for two years.

Canada takes this seriously. You could face fines of up to $10 million if you send messages without proper consent. And it's not just Canadian companies who need to follow CASL. If you're based in the U.S. or any other country and you're emailing someone with a Canadian email address, you're still subject to these rules. CASL applies based on where the recipient is located, not where the sender operates.

💡 Best Practice: Always ask for express consent — and keep a record of when and how you got it.

• Express consent = someone clearly said yes.
  
• Implied consent = they gave you their email as part of a business relationship (e.g., bought something, asked for a quote) in the past 2 years.
  
  

Implied consent has a time limit. After 2 years, you must have express consent to keep emailing them.

Fines can reach $10 million for companies that break the law.

💡 Best Practice: Always ask for express consent — and keep a record of when and how you got it.

🇬🇧 UK and 🇪🇺 European Union (GDPR + ePrivacy)

The UK and EU have the toughest rules. Under the General Data Protection Regulation (GDPR) and the ePrivacy Directive, express consent is required for marketing emails. That means you can't assume someone wants to hear from you just because they downloaded a white paper or filled out a contact form. Consent must be freely given, specific, informed, and unambiguous. Pre-checked boxes or vague opt-in language don’t count.

Organizations must clearly explain what someone is agreeing to, keep a record of the consent, and make it easy for people to withdraw it at any time. These rules apply even if your business is outside the EU — if you’re emailing someone in the UK or EU, you’re expected to comply.

You must:

• Ask for permission in plain language.
  
• Keep proof of consent (date, source, what was agreed to).
  
• Give people an easy way to unsubscribe.
  
• Let them delete or change their info at any time.
  

No implied consent. No gray areas. Just clear, opt-in permission.

💡 Best Practice: Use a double opt-in. Ask people to sign up, then confirm it by email. This gives you stronger proof of consent — and filters out fake signups.

🇦🇺 Australia (Spam Act 2003)

Australia requires either express or inferred consent under its Spam Act of 2003. Express consent means someone has clearly agreed to receive your messages — usually by signing up through a form or ticking a box. Inferred consent means there’s an existing relationship and a reasonable expectation they’d want to hear from you — such as being an active customer or member.

While this might sound similar to implied consent in Canada or the U.S., Australia still puts responsibility on the sender to prove consent exists. If you're unsure whether someone gave you clear permission, you're better off asking first. And you cannot send marketing emails to people from a third-party list unless you can verify they consented to receive emails from you specifically.

• Express consent: They signed up directly.
  
• Inferred consent: They’ve had a relationship with your business — like they bought something or joined a membership.
  

But even inferred consent is risky if you’re not sure how or when you got the contact. And you can’t use someone else’s list without permission.

💡 Best Practice: Don’t rely on inferred consent. Ask for express permission and make it easy to unsubscribe.

🌏 Asia (Various Jurisdictions)

Asia is a diverse region with a mix of privacy and anti-spam laws, and enforcement varies widely from country to country. Some nations, like Singapore and South Korea, have strict laws requiring clear consent for marketing emails. Others, like India or Indonesia, have less mature or less consistently enforced regulations. But across the board, the trend is moving toward tighter control and more emphasis on consumer privacy.

For example:

• Singapore's PDPA (Personal Data Protection Act) requires express consent for marketing and mandates that senders clearly state who they are and provide a way to opt out.
  
  
• South Korea’s laws are among the strictest in Asia, requiring both consent and registration of senders.
  
  
• India currently allows more flexibility, but the upcoming Digital Personal Data Protection Act will bring more GDPR-style requirements.
  
  

Even in countries with lighter enforcement, the same principles apply: people want to feel safe about who’s contacting them and why. Just because the law might not require it doesn’t mean your brand should cut corners.

💡 Best Practice: Treat Asia like the rest of the world. Ask for express permission and document the consent. It keeps your marketing clean and builds trust across borders.

So… Can You Send Marketing Emails Without Consent?

• US: Technically, yes — but not a good idea.
  
  
• Canada: Only with an existing relationship — and only for 2 years.
  
  
• UK & EU: No.
  
  
• Australia: Only with a real business relationship — but it’s safer to ask first.
  
  

What About Sales Emails?

Sales emails — especially cold outreach — are often treated separately from traditional marketing emails, but they’re still covered under most email and privacy laws. If you're reaching out to someone you haven't engaged with before, you need to understand what’s permitted in their region. Here's how it breaks down:

🇺🇸 United States

The U.S. allows unsolicited sales emails under the CAN-SPAM Act. You don’t need prior consent, but you do need to:

• Include accurate sender information
• Use truthful subject lines
• Include a physical mailing address
• Offer a clear opt-out mechanism and honor unsubscribes within 10 days

💡 Best Practice: Even if you’re legally allowed to send a cold sales email, personalizing it and being transparent about why you’re reaching out will increase the chances of a response — and reduce the risk of being marked as spam.

🇨🇦 Canada

Sales emails fall under CASL, just like marketing emails. You must have express or implied consent before reaching out. That means no cold emails unless there’s an existing business relationship or they’ve given you their email voluntarily and with context.

💡 Best Practice: Don’t send cold emails into Canada without a prior relationship or clear consent. Even B2B outreach is subject to CASL and its penalties.

🇬🇧 UK and 🇪🇺 EU

Under GDPR and the ePrivacy Directive, sales outreach is treated as direct marketing. You must have prior opt-in consent to email individuals. There’s a narrow exception (the “soft opt-in”) for existing customers, but cold emails to new contacts are not allowed without consent.

💡 Best Practice: Use LinkedIn or other channels to warm up prospects before asking for permission to email. Always provide a clear unsubscribe option and document consent when you get it.

🇦🇺 Australia

Sales outreach is covered under the Spam Act. You can only send commercial messages if you have express or inferred consent. Inferred consent may apply if there’s an existing business relationship, but that’s risky without a clear history.

💡 Best Practice: Avoid cold emailing in Australia unless you’ve had previous interactions that reasonably justify it.

🌏 Asia

Laws vary widely, but the trend is toward requiring consent — even for B2B sales. In places like Singapore and South Korea, express consent is required. India is more flexible for now, but privacy regulations are evolving fast.

💡 Best Practice: When in doubt, treat sales emails like marketing: ask first, document consent, and offer a clear way to opt out.

What This Means for Your Email Program

1. Get express consent — every time.
   Make sure people know exactly what they’re signing up for. If you’re using a form, include a checkbox that explains what kind of messages they’ll receive — newsletters, product updates, offers, etc. Do not pre-check the box. The person must actively choose to receive your emails. That’s what counts as valid, express consent.
2. Use a double opt-in.
   After someone signs up, send a confirmation email asking them to verify their subscription. This extra step helps filter out typos, bots, and fake signups — and gives you clear proof of consent.
3. Keep records.
   Document the details of each signup — when it happened, where it came from, and what the consent language said. You may need this to prove compliance.
4. Make unsubscribing easy.
   Every email should include a simple, clear opt-out link. If someone unsubscribes, honor that request quickly — ideally immediately, but always within the timeframes set by local law.
5. Don’t buy lists.
   Most purchased lists don’t include proper consent, and using them can lead to legal trouble and deliverability issues. Build your list organically — it’s slower, but it works better and keeps you compliant.

What About Conference Lists or Third-Party Emails?

Sometimes event organizers offer to share a list of attendees. Be careful.

• If you’re sending the email yourself: You must confirm that recipients have given express consent for their data to be shared.
  
  
• Better option: Ask the organizer to send the email on your behalf and link to a landing page where contacts can opt in to your list.
  
  

Be Safe, Not Sorry

Laws have changed. What was okay in 2014 could get you fined today. So if you’re marketing across borders, the safest move is always:

• Get clear, express permission
• Never pre-check opt-in boxes on forms
• Use double opt-in
• Keep good records
• Make it easy to unsubscribe

Need help figuring out how to apply this to your business? We’ve helped lots of companies build compliant, high-converting email programs. Reach out anytime.

Final Thoughts: A More Human Way to Build Relationships

If you’re tired of worrying about email laws — or frustrated by how hard it is to stand out in someone’s inbox — there’s a better path.

We teach sales professionals how to start real, human-to-human conversations on LinkedIn. No spam. No gray areas. Just thoughtful outreach that sparks genuine interest.

Our Prospecting Mastery program shows you how to build visibility and trust with the right people — and turn cold outreach into warm introductions. You'll learn:

• How to identify the right prospects without scraping, spamming or pitch-slapping

• How to reach out in ways that feel like a conversation, not a pitch

• How to build a strong personal brand that draws the right leads to you

If that sounds like the kind of approach your team needs, come check it out. Let’s help you prospect in a way that actually works — and keeps you on the right side of the law.

About the Author: Candyce Edelen is founder of PropelGrowth, where she teaches B2B entrepreneurs and sales professionals to build authentic, human-to-human relationships on LinkedIn. Her strategies have helped clients shift from spammy automation to genuine outreach, resulting in higher-quality leads and increased sales. Candyce is passionate about helping professionals build trust and create a reliable, predictable sales pipeline. She's also a firm believer that you can't automate a relationship.