CAN-SPAM vs GDPR/PECR: What You Can Legally Send After Someone Unsubscribes
One unsubscribe can create a messy internal problem.
Marketing stops sending. Customer success wants to invite the account to a QBR. Billing needs to send renewal reminders. Product wants to announce a new feature. Sales assumes a manual 1:1 email is still fine because it is “not marketing automation.”
The legal answer is not “you can never email them again.” The real question is narrower: is the message genuinely necessary to deliver or administer a service, or is it promoting something?[^1][^2]
That distinction matters everywhere, but the rules are not identical. In the US, CAN-SPAM focuses on whether an email is commercial or transactional, and for mixed messages it looks closely at the email’s primary purpose.[^1][^3] In the EU and UK, GDPR and PECR are usually less forgiving once a message qualifies as direct marketing, because people have a strong right to object and organizations generally need to stop using their data for that purpose.[^2][^4][^5]
What an unsubscribe actually means
It usually stops marketing, not every email
In plain English, an unsubscribe usually stops marketing. It does not automatically ban every email a business may need to send forever.[^1][^2]
That is why receipts, invoices, password resets, fraud alerts, and service outage notices are treated differently from newsletters, webinar invites, or upgrade campaigns.[^1][^2] A recipient may still need certain account or transaction emails to use what they bought, protect their account, or understand changes to an existing service.
Where teams get sloppy is in treating “important to us” as if it means “transactional.” It does not. A message can matter to revenue and still be marketing.
The real question: marketing, transactional, or truly personal?
A useful way to think about post-unsubscribe email is to sort messages into three buckets:
- Transactional or service: needed to confirm, deliver, secure, or administer an existing transaction or service.
- Marketing: designed to promote, upsell, re-engage, or encourage more commercial activity.
- Gray area: operational on the surface, but promotional in intent.
The label does not decide the answer. “Onboarding,” “customer success,” “account review,” and “product update” are not legal categories. Content, purpose, and recipient expectation matter more.[^1][^2][^6]
The big difference: CAN-SPAM vs GDPR/PECR
CAN-SPAM looks at an email’s primary purpose
Under FTC guidance, CAN-SPAM distinguishes between commercial emails and transactional or relationship messages.[^1] Some emails contain both. When they do, the analysis turns on the email’s primary purpose.[^3]
That matters more than many teams realize. A renewal notice can become a commercial message if the subject line or body makes it read mainly as a promotion, or if the transactional content is buried under upsell language.[^3]
The FTC also makes clear that an existing customer relationship alone does not make a message transactional.[^1] You do not get a blanket exemption just because the recipient already pays you.
GDPR and PECR focus on direct marketing and the right to object
In the UK, PECR restricts unsolicited electronic direct marketing, and the ICO defines direct marketing broadly as promotional material sent to particular individuals.[^2] The UK GDPR adds another layer: people have an absolute right to object to the processing of their personal data for direct marketing.[^4][^5]
That is why the EU/UK analysis often feels stricter in practice. Once a message is promotional, there is much less room to keep sending it after an opt-out. A business may still retain minimal suppression data so it can honor the objection, but it should stop using that person’s data for direct marketing.[^4]
For EU readers, local ePrivacy rules can vary by member state. Still, as a practical rule, once an email looks like direct marketing, the bar is high and “but this was helpful” is a weak defense.[^5][^7]
Why the EU and UK are usually stricter after opt-out
The US framework gives clearer room for genuine transactional or relationship messages.[^1] The UK/EU framework asks a different question: is this direct marketing? If it is, an objection changes the picture quickly and decisively.[^2][^4]
So the same email may feel defensible in the US and much harder to justify in the UK or EU if it includes even modest promotional language.
A practical framework for classifying messages after unsubscribe
If your teams need one workable rule, use this three-part test.
1. Transactional or service messages you can usually still send
Ask:
- Is the message necessary to provide, confirm, secure, or administer an existing service or transaction?
- Would the recipient reasonably expect it as part of their account, purchase, contract, or security setup?
- Can the message stand on its own without promotional language?
This category usually includes receipts, invoices, password resets, service outage notices, security alerts, and required account notices.[^1][^2]
2. Marketing messages you should stop sending
Ask:
- Does the message promote a product, feature, add-on, event, or next step?
- Is the real goal re-engagement, expansion, pipeline creation, or brand promotion?
- Would removing the promotional content leave little reason to send the email?
If yes, suppress it after unsubscribe. That generally includes newsletters, webinars, feature launches framed as benefits, upgrade pushes, cross-sells, and win-back campaigns.[^2][^4]
3. Gray-area messages that need closer review
This is where most risk lives.
A useful audit lens:
- Purpose: Why does this email exist?
- Trigger: What event caused it?
- Audience: Active customer, prospect, former customer, dormant user?
- Content: Informational or persuasive?
- CTA: Manage account, or book demo / upgrade / attend event?
- Expectation: Would the recipient see this as service communication or a campaign?
That framework is not copied from any single regulator. It is a practical synthesis of the FTC’s primary-purpose logic and the ICO’s service-vs-direct-marketing distinction.[^1][^2][^3]
Concrete examples
Receipts, invoices, password resets, security alerts
These are the clearest cases.
- US: Usually allowed if they are genuinely transactional or relationship messages.[^1]
- EU/UK: Usually allowed if they are routine customer service or account administration, not promotional.[^2]
What changes the answer? Adding “upgrade now” banners, promo blocks, or cross-sell footers.
Onboarding and product adoption emails
This category splits in two.
Account setup onboarding — “Verify your email,” “Complete setup,” “Connect your domain,” “Your workspace is ready” — is easier to defend because it helps deliver a service the person already requested.[^1][^2]
Adoption nurture onboarding — “Try this feature,” “Join our webinar,” “Here are five ways to get more value,” “You haven’t used X lately” — is riskier. Those messages often shift from service delivery into encouragement and re-engagement. In the EU/UK especially, that starts to look like marketing.[^2][^6]
Renewal reminders and contract notices
A pure renewal notice is often one of the stronger examples of an allowed post-unsubscribe email.
- “Your contract renews on August 1.”
- “Your subscription will expire unless payment is updated.”
- “Here is the cancellation deadline.”
Those are easier to defend than a “renew now and move to annual for 20% off” campaign.[^1][^3]
Small edits matter. A notice about timing, billing failure, agreed pricing, or a contract deadline may stay service-related. A message that bundles in upgrade prompts, add-ons, or expansion language starts to look promotional.
Product updates, feature announcements, newsletters
“Product update” is one of the most abused labels in SaaS.
A security fix, downtime notice, or terms change may be a legitimate service message because the customer needs the information to use the service safely or understand their rights.[^1][^2]
A feature announcement that highlights benefits, encourages usage, or promotes a higher-tier capability is more likely to be marketing. The same goes for newsletters, release roundups, and “what’s new” emails written to drive engagement rather than communicate something necessary.[^2][^6]
QBR invites, expansion conversations, and webinar invites
This is classic gray territory.
A genuine QBR invite for an active customer may be more defensible if it is narrowly tied to account management, service performance, or contractual review. But many “QBR” emails are really expansion meetings in business-casual clothing.
If the real goal is to create pipeline, discuss additional seats, pitch a new module, or drive event attendance, treat it as marketing and suppress it.[^2][^6]
Webinar and event invites are even harder to defend. They usually look promotional unless there is a specific service-administration reason they must be sent.
Manual 1:1 sales outreach
Manual does not mean exempt.
In the US, a 1:1 email can still be commercial if its purpose is promotional.[^1] In the UK/EU, the ICO’s approach matters here too: direct marketing is defined by purpose and content, not by whether the email came from a sequence tool or a human rep.[^2][^6]
That means these are still high risk after unsubscribe:
- “Wanted to bump this.”
- “Can we book time to discuss expansion?”
- “Thought you’d be interested in our new platform.”
- “I know you unsubscribed, but this felt relevant.”
The last one is not a compliance strategy. It is evidence.
Where teams get into trouble
Transactional emails with marketing extras
This is the most common failure pattern.
A valid receipt becomes risky when it includes a promo banner. A renewal notice gets muddied by an upgrade CTA. A security alert includes a panel for premium controls. Under CAN-SPAM, mixed-content placement and subject-line cues matter.[^3] Under PECR-style analysis, adding promotional material can turn the message into direct marketing.[^2]
Calling a campaign a service update
Calling an email a “service update” does not make it one.
Regulators look at substance, not internal naming. If the message is trying to persuade the recipient to use more, buy more, or come back, teams should treat it as marketing.[^2][^6]
Letting sales or CS bypass suppression lists
This is usually a governance problem, not a legal theory problem.
The marketing platform honors opt-out. The CRM does not. The CS tool has its own templates. Sales engagement runs separately. Then someone says, “It was a personal note.”
That is exactly why suppression should follow purpose, not just channel or sender.[^4]
Treating all customer email as exempt
Being an existing customer helps in some narrow scenarios. It is not a free pass.[^1][^7]
If an email exists mainly to drive expansion, adoption, event attendance, or another commercial outcome, the fact that the recipient is already a customer does not remove its marketing character.
How to operationalize compliance
Separate message types in your systems and templates
Do not keep service and marketing content in the same template family.
Create distinct categories such as:
- billing and account administration
- security and fraud
- contractual notices
- product or service availability notices
- marketing and lifecycle campaigns
- sales and expansion outreach
That alone reduces accidental remarketing.
Apply suppression by purpose, not just by channel
Your unsubscribe state should not live only in the email platform.
It should sync into CRM, customer success, support, and sales engagement systems wherever promotional outreach might happen. The ICO explicitly notes that retaining minimal suppression data is often appropriate so you can ensure the person is not marketed to again.[^4]
Require review for mixed-purpose emails
If an email contains both operational and promotional elements, require review.
A practical internal rule is simple: if a service message includes any non-incidental promotional CTA, marketing block, event invite, or upgrade mention, reclassify it for compliance review.
Document why each recurring message exists
For recurring sends, write down:
- why the message exists
- who gets it
- what triggers it
- why the recipient needs it
- what makes it service-related rather than promotional
- what content is prohibited in that template
This creates consistency across legal, lifecycle, sales, and CS teams. It also makes edge cases easier to review with counsel.
The simplest rule to remember
If the message primarily informs, confirms, secures, or administers an existing service, it may still be allowed.[^1][^2]
If it primarily promotes, encourages, re-engages, or expands commercial activity, treat it as marketing and suppress it after unsubscribe.[^2][^4]
That sounds obvious. In practice, this is where most mistakes happen, because teams let useful account communication and revenue-focused outreach blur together inside the same systems, templates, and workflows.
Conclusion
The safest way to think about unsubscribe is not “never email again.” It is “stop marketing, and be disciplined about what is truly service-related.”
That discipline matters even more under GDPR and PECR, where direct marketing objections carry real weight and promotional intent is interpreted broadly.[^2][^4][^5] But it matters in the US too, because CAN-SPAM does not let you call something transactional just because it mentions an account or goes to an existing customer.[^1][^3]
A practical next step is to build a message taxonomy. Separate service, transactional, mixed-purpose, and promotional email. Sync suppression across every team that can send. And for gray-area messages like onboarding, renewals, QBRs, and 1:1 sales outreach, review the actual content, not the label.
FAQ
Does an unsubscribe mean you can never email that person again?
Not necessarily. It usually stops marketing or direct marketing emails, not every possible email. You can often still send messages that are genuinely necessary to deliver, secure, or administer an existing service, such as receipts, invoices, password resets, or security alerts.[^1][^2]
What is the main difference between CAN-SPAM and GDPR/PECR after someone unsubscribes?
CAN-SPAM focuses on whether an email is primarily commercial or transactional.[^1][^3] GDPR and PECR are generally stricter once a message counts as direct marketing, because the person can object to that processing and you usually need to stop sending promotional messages for that purpose.[^2][^4]
Can you still send receipts, invoices, password resets, or security alerts after opt-out?
Usually yes, as long as those messages are genuinely transactional or service-related and do not include promotional content.[^1][^2]
Are renewal reminders allowed after someone unsubscribes?
Often yes if the reminder is narrowly focused on a real renewal, expiry, billing, or contract notice the customer reasonably expects. It gets riskier when the email also pushes upgrades, add-ons, or annual plan conversions.[^1][^3]
Are onboarding emails always allowed after unsubscribe?
No. Account setup emails are easier to justify than onboarding sequences that drift into product promotion, feature adoption, webinar invitations, or re-engagement.[^1][^2]
Can product update emails still be sent after unsubscribe?
It depends. Security fixes, terms changes, or important service notices may be service-related. Feature announcements that highlight benefits, encourage usage, or promote upgrades are more likely to be marketing.[^1][^2]
Can sales reps send manual 1:1 emails after someone unsubscribes?
Not safely just because the email is manual. A 1:1 message can still count as commercial or direct marketing if its purpose is promotional.[^1][^2]
Are QBR invites and customer check-ins marketing?
Sometimes. A genuine service review for an active customer may be more defensible. But if the real purpose is expansion, pipeline creation, or pitching additional services, it can cross into marketing.[^2][^6]
What is the simplest way to classify emails after unsubscribe?
Use a three-part test: is the email necessary to provide, confirm, secure, or administer an existing service; does it promote or re-engage; and would the recipient reasonably expect it as part of their account or transaction? If it mainly informs, it may still be allowed. If it mainly promotes, suppress it.[^1][^2][^3]
How should unsubscribe suppression work across systems?
Suppression should be based on message purpose, not just whether a person is in one email platform. In practice, that means syncing opt-out status across marketing automation, CRM, customer success, support, and sales engagement tools.[^4]