Email Compliance
for Email Marketers

Why Compliance Matters for Deliverability

Email compliance isn't just a legal concern — it's a deliverability signal. Gmail, Outlook, and Yahoo use complaint rates, unsubscribe behavior, and sending patterns to assess your sender reputation. When your emails don't comply with regulations, two things happen:

• Legal exposure — major frameworks can impose substantial penalties; verify current limits in official regulator guidance.
• Inbox placement drops — High complaint rates (from frustrated recipients who can't easily unsubscribe) trigger spam filtering long before regulators notice.

The good news: compliance best practices and deliverability best practices are almost always the same. Easy unsubscribes reduce complaints. Consent-based lists engage better. Honest subject lines reduce spam reports.

CAN-SPAM (United States)

The CAN-SPAM Act governs commercial email sent to US recipients. It applies to any email whose primary purpose is commercial — including promotional campaigns sent via Klaviyo.

For deeper legal interpretation, see CAN-SPAM Act Explained.

Core Requirements

• No deceptive "From" lines — Your sender name and email address must accurately identify who's sending the email.
• No misleading subject lines — Subject lines must reflect the actual content of the message.
• Identify the email as an advertisement — Required unless you have prior express consent (which you should have for your marketing list).
• Include your physical mailing address — A valid postal address must appear in every commercial email. A P.O. Box is acceptable.
• Provide a clear unsubscribe mechanism — Every email must include a way for recipients to opt out of future messages.
• Honor unsubscribes within 10 business days — CAN-SPAM allows 10 business days, but Gmail, Yahoo, and Apple now require one-click unsubscribes processed within 2 business days. Design to the stricter standard. Klaviyo handles this automatically when properly configured.
• Don't charge for unsubscribing — The opt-out process must be free and require no more than a reply email or visiting a single web page.

What CAN-SPAM Does NOT Require

Unlike GDPR, CAN-SPAM does not require prior opt-in consent before emailing someone. It's an opt-out law — you can send to contacts who haven't explicitly subscribed, as long as you honor unsubscribes. However, this approach typically produces poor engagement and damages deliverability, so it's not recommended regardless of legality.

GDPR (European Union)

The General Data Protection Regulation applies any time you process personal data of EU residents — regardless of where your business is located. For email marketers using Klaviyo, this means:

For full legal detail and implementation depth, see GDPR for Email Marketing.

• If you send to EU residents, GDPR applies to you
• You must have a lawful basis for processing their data — for marketing email, this is almost always explicit consent
• Consent must be freely given, specific, informed, and unambiguous — pre-ticked boxes don't count

Key GDPR Requirements for Email

• Lawful basis — For marketing emails, use consent. Document when and how consent was collected for each contact.
• Right to be forgotten — Contacts can request deletion of their personal data. In Klaviyo, open the profile, then use Profile actions in the upper right to delete it.
• Data portability — Contacts can request their data in a portable format. For a single person, open their profile and choose Profile actions → Export profile; the .zip appears on your Downloads page. For a whole audience, use Audience → Lists & segments, open the list or segment, then Manage list → Export list to CSV.
• Privacy policy link — Include a link to your privacy policy in your email footer.
• Clear consent records — You must be able to prove when and how a contact gave consent. This is typically done at the signup form level.

Double Opt-In as GDPR Best Practice

While GDPR doesn't strictly require double opt-in, it's the clearest way to demonstrate explicit consent. A double opt-in creates a timestamped confirmation email that proves the contact actively confirmed their subscription. This is your best defense in a GDPR audit.

CASL (Canada)

Canada's Anti-Spam Legislation is widely considered the strictest email marketing law in North America. Unlike CAN-SPAM, CASL requires prior express consent before sending commercial electronic messages to Canadian recipients.

For complete consent, expiry, and documentation handling, see CASL Compliance.

Two Types of Consent Under CASL

CASL Requirements

• Identify yourself — Name, mailing address, and either phone, email, or web address must be in every message.
• Unsubscribe mechanism — Must be functional for at least 60 days after the message is sent. Klaviyo's unsubscribe links comply with this by default.
• Honor unsubscribes within 10 business days — Same as CAN-SPAM.
• Record consent — If challenged, you must prove you had consent. Keep records of when, where, and how consent was obtained.

List-Unsubscribe Headers

The List-Unsubscribe email header is a technical standard that lets email clients show a native "Unsubscribe" button at the top of the email — separate from the link in your body. Gmail, Outlook, and Apple Mail all support this.

Why This Matters

• Required by every major mailbox provider — Gmail and Yahoo mandated List-Unsubscribe with 2-day processing in February 2024. Microsoft began enforcing equivalent bulk sender rules on 5 May 2025, rejecting non-compliant mail outright at the SMTP level (550 5.7.515) rather than filtering it to spam. Apple now requires one-click unsubscribe too.
• Reduces spam complaints — When subscribers can easily unsubscribe, they're less likely to click "Report Spam" instead. Fewer complaints = better reputation.
• One-click standard (RFC 8058) — Google requires the newer List-Unsubscribe-Post header for one-click unsubscribe. Klaviyo handles this automatically.

Klaviyo and List-Unsubscribe

Klaviyo automatically inserts List-Unsubscribe headers into all outbound campaigns. You don't need to configure this manually. To verify it's working: send a test email to a Gmail address, click the three-dot menu, and check "Show original" — you should see List-Unsubscribe in the raw headers.

Configuring Compliance in Klaviyo

Klaviyo ships with the compliance primitives already built in — most of the work is filling them in correctly once. Here's each one:

Physical Mailing Address (Required for CAN-SPAM)

1. Click your company name in the bottom-left corner, then click Settings
2. Select Organization (visible to account Owners and Admins only)
3. Complete every field, then click Update Information. A P.O. box is acceptable if you'd rather not publish a street address
4. In your footer, click the personalization icon, choose Organization from the All types menu, and insert the Organization address tag — update the address later and every template using the tag updates with it

Unsubscribe Footer

1. Klaviyo requires an unsubscribe link in every email, so this is enforced rather than optional
2. Use the {% unsubscribe %} tag for a standard text link. To change the wording, pass it in: {% unsubscribe 'Update your preferences' %}
3. Use {% unsubscribe_link %} instead when you want the bare URL — for a button, an image, or a link colour that differs from your template's link styling
4. Make the link visible — don't hide it in grey 8px text
5. Consider offering both "Unsubscribe" and "Manage Preferences" to reduce full opt-outs

Suppressed Profiles

1. Go to the Profiles tab and click View suppressed profiles in the upper right
2. Klaviyo suppresses unsubscribers globally and automatically — an opt-out from one campaign stops all future marketing sends, not just that list
3. Filter the view by Unsubscribed or Manually Added to see how people ended up suppressed
4. To suppress people yourself, use Add Email Address for one or Upload File for a batch

Exporting Consent Records (GDPR)

1. Go to Audience → Lists & segments and open the list or segment you need
2. Choose Manage list (or Manage segment) → Export list to CSV, then pick which profile properties to include. Only Owner, Admin, and Analyst roles can export
3. Include the consent timestamp and source properties — these are your evidence of opt-in
4. Collect the file from your Downloads page, which keeps the last 30 days of exports, and store it securely

Klaviyo Compliance Checklist

Use this checklist before sending any campaign. Each item has a legal basis and a deliverability benefit.

Account Setup (One-Time)

• ☐ Physical mailing address completed under Klaviyo Settings → Organization and pulled into the footer via the Organization address tag
• ☐ Unsubscribe link included in default footer template
• ☐ Global suppression list enabled and tested
• ☐ Privacy policy URL added to footer
• ☐ SPF, DKIM, and DMARC records published for your sending domain — SPF Builder | DMARC Generator

List Management

• ☐ All contacts have documented opt-in consent (source + date)
• ☐ Canadian contacts have express consent (not just implied)
• ☐ No purchased or scraped lists
• ☐ Double opt-in enabled for new subscribers where possible
• ☐ Consent records exportable for GDPR documentation

Per-Campaign

• ☐ "From" name accurately identifies your business
• ☐ Subject line accurately reflects email content (no misleading teasers)
• ☐ Unsubscribe link visible (not hidden) in footer
• ☐ Physical address visible in footer
• ☐ Not sending to suppressed/unsubscribed contacts

Ongoing

• ☐ Spam complaint rate monitored weekly in Google Postmaster Tools and Yahoo Sender Hub (keep as low as possible; investigate upward trends quickly)
• ☐ Unsubscribes honored within 2 business days (Gmail/Yahoo/Apple/Microsoft requirement; Klaviyo handles this automatically)
• ☐ CASL implied consent expiry dates tracked for Canadian contacts
• ☐ Deletion requests processed promptly