American marketers often hear that the US is an “opt-out country”. Legally, that is true for email: the CAN-SPAM Act does not require a subscriber’s permission before you send a commercial message. But the question “may I send this?” has three answers in the US, one from the law, one from the mailbox providers and one from your subscribers, and only the first one is permissive.
What the law actually requires
Under CAN-SPAM, a first commercial email can go to someone who never signed up, as long as it meets the Act’s requirements and you stop mailing them once they opt out. Consent matters in only a few legal situations:
- Ad labeling: if a recipient has given affirmative consent, you are not required to label the message as an advertisement.
- Mobile email domains: FCC rules require express prior authorization before sending commercial email to addresses that deliver as texts through a wireless carrier.
- Text messages: marketing SMS falls under the TCPA, which requires prior express written consent. This is the area where US law is strict.
- Foreign recipients: Canadians under CASL and Europeans under the GDPR must opt in first.
What Gmail, Yahoo and Outlook expect
The practical gatekeepers are the mailbox providers. Gmail and Yahoo’s rules for bulk senders, in place since 2024, require domain authentication, a one-click unsubscribe and a spam complaint rate kept below 0.3%. Microsoft introduced similar requirements for Outlook.com in 2025. Mailing people who never asked to hear from you is the fastest way to exceed that complaint threshold, and once your domain’s reputation drops, even your opted-in customers stop seeing your emails.
That is why we advise against rented or purchased lists; our article on why you should never buy email lists explains the damage they do.
Three levels of permission
| Approach | How it works | When to use it in the US |
|---|---|---|
| Opt-out | You email existing contacts until they unsubscribe | Legally allowed; reserve it for genuine business relationships, such as recent customers |
| Single opt-in | The person ticks a box or submits a form to subscribe | A solid default for most newsletters and promotions |
| Double opt-in | The subscriber confirms through a link sent by email | Recommended for lead magnets, contests and any list that also reaches Canada or the EU |
If you are unsure which one fits, compare them in our FAQ on opt-in versus double opt-in.
Writing consent language that holds up
A good US sign-up form states who is collecting the address, what they will send and how often, and how to unsubscribe. If you also want to text subscribers, use a separate, unticked checkbox with wording that mentions marketing texts, message frequency, that message and data rates may apply, and that replying STOP opts out. Never make SMS consent a condition of purchase. Add a link to your privacy notice, which helps you meet state laws such as California’s CCPA/CPRA.
Keep proof of every opt-in
If a complaint or TCPA claim arrives, the burden falls on you to show consent. Store the date, the source (form, checkout, event), the IP address where available and the wording the person agreed to. Mailpro’s double opt-in subscription records the confirmation automatically, and sign-up forms add new contacts directly to the right list.
Respecting the “no”
Permission can be withdrawn at any time. CAN-SPAM gives you 10 business days to process an email opt-out, and FCC rules set the same window for texts; in practice, act at once. Mailpro removes unsubscribed contacts from future sends automatically, and a rising unsubscribe rate is your cue to adjust frequency or content. For the broader picture, return to our overview of US email marketing law.
This page is general information, not legal advice.