Email is the easiest channel almost everywhere: in the US you can send marketing email without asking first, and in Canada, the UK, the EU and Australia you can email your existing customers about similar things you sell, as long as every message lets them stop. Texts are stricter, and in the US automated marketing texts need written consent. WhatsApp needs an opt-in everywhere, because Meta requires one whatever the local law says. The table below sets out the rule for each channel in each place, with the law it comes from.
This is a summary of the rules as written, checked against the laws and regulators’ own pages. It is not legal advice, and the rules change, so check the source for anything you are about to rely on.
Send, then stop on request
Postal address and an opt-out, honoured within 10 business days
Consent first
Written consent for marketing texts sent with an autodialer
Consent first
Meta requires opt-in; federal law is unsettled
Consent, or an existing customer
Implied for 2 years after a purchase, 6 months after an enquiry
Consent, or an existing customer
Same as email
Consent first
The law allows implied consent; Meta requires opt-in
Consent, or an existing customer
Soft opt-in for your own similar products
Consent, or an existing customer
Same as email
Consent first
Soft opt-in in law; Meta requires opt-in
Consent, or an existing customer
Similar products to past buyers; countries vary
Consent, or an existing customer
Same as email
Consent first
Meta requires opt-in
Consent, or an existing customer
Consent can be inferred from your relationship
Consent, or an existing customer
Same as email
Consent first
Meta requires opt-in
The pattern behind the rules
Read across the grid and three things hold almost everywhere.
- Your customers are the easy audience. Outside the US, the existing-customer route (the UK and EU soft opt-in, Canada’s implied consent, Australia’s inferred consent) lets you market to people who bought from you, about the kind of thing they bought. The US doesn’t ask for consent before email at all.
- Every message needs a way out. Each law asks for a working opt-out, and several set a clock: 10 business days in the US and Canada, 5 business days in Australia.
- The phone is stricter than the inbox. Texts get the same rule as email in Canada, the UK, the EU and Australia, but US marketing texts need written consent, and WhatsApp needs an opt-in everywhere because Meta says so.
The growth lesson is that consent is cheapest to collect at the moment someone buys or asks you something. A clear tick box per channel on your order form or enquiry form costs nothing then, and saves a lot of guesswork later.
The full table, with sources
Every row links to the law or regulator page it comes from. The same data is available as a CSV, so you can filter it, share it, or check a cell against its source.
| Country | Channel | Before the first message | Existing customers | Every message must include | Opt-out deadline | Maximum penalty | Source |
|---|---|---|---|---|---|---|---|
| United States | No consent needed: email marketing is opt-out | No exception needed | Accurate sender details, a valid postal address, a clear way to opt out, and an ad label unless they opted in | Honour within 10 business days; the opt-out must work for 30 days after sending | $53,088 per email (FTC figure) | FTC CAN-SPAM guide15 U.S.C. 7704 | |
| United States | SMS | Prior express written consent for marketing texts sent with an autodialer | No existing-customer exception in the rule | Not set out in the rule text we checked | Revoke by any reasonable means, honoured within 10 business days; texts only 8am to 9pm local time | $500 per text in a private lawsuit, up to $1,500 if wilful | 47 CFR 64.120047 U.S.C. 227 |
| United States | Unsettled: no federal text clearly covers app messages. Meta requires opt-in (last row) | Unsettled | Unsettled | Unsettled | If the TCPA applies, as for SMS | 15 U.S.C. 7702Facebook v. Duguid | |
| Canada | Express or implied consent | Implied for 2 years after a purchase, 6 months after an enquiry | Your name, mailing address and a phone, email or web contact, plus an unsubscribe; all valid for 60 days | Within 10 business days; the unsubscribe must work for 60 days | Up to C$1m per violation for an individual, C$10m for a business | CASLSOR/2012-36 | |
| Canada | SMS | Same as email: CASL covers texts to a phone account | Same as email | Same as email | Same as email | Same as email | CASL |
| Canada | Same as email: CASL covers instant messaging accounts | Same as email | Same as email | Same as email | Same as email | CASL | |
| United Kingdom | Consent for individuals; company addresses can be emailed without it (ICO) | Soft opt-in: details from a sale or negotiation, your own similar products, a free opt-out every time. Charities too since 5 Feb 2026 | Who you are, and a valid address for opt-out requests | No fixed deadline in the regulations | Up to £17.5m or 4% of global turnover (ICO) | PECR reg 22PECR reg 23ICO on the 2025 Act | |
| United Kingdom | SMS | Same as email: PECR counts texts as electronic mail | Same as email | Same as email | Same as email | Same as email | PECR reg 2ICO guide |
| United Kingdom | Same as email: ICO guidance covers messaging apps | Same as email | Same as email | Same as email | Same as email | ICO guide | |
| European Union | Prior consent, to the GDPR standard: freely given, specific, informed, unambiguous | Your own similar products to past buyers, with a free, easy objection every time | No hidden sender; a valid address to stop messages | No EU-wide deadline; countries set their own | GDPR breaches: up to €20m or 4% of turnover. Other penalties are national | ePrivacy DirectiveGDPR | |
| European Union | SMS | Same as email: the directive’s electronic mail covers text messages | Same as email | Same as email | Same as email | Same as email | ePrivacy Directive |
| European Union | Probably the same as email; no source we opened confirms apps are covered, and countries differ | Same as email, if covered | Same as email, if covered | Same as email, if covered | Same as email, if covered | ePrivacy Directive | |
| Australia | Consent, express or inferred from your relationship | Can be inferred from conduct and business relationships; the Act sets no time limit | Who authorised it, how to contact them, and a working unsubscribe | Takes effect within 5 business days; the unsubscribe must work for 30 days | For a company, 2,000 penalty units a day (10,000 with a prior record) | Spam Act 2003 | |
| Australia | SMS | Same as email: the Act covers texts to a phone account | Same as email | Same as email | Same as email | Same as email | Spam Act 2003 |
| Australia | Same as email: the Act covers instant messages | Same as email | Same as email | Same as email | Same as email | Spam Act 2003 | |
| Everywhere (Meta rule) | Opt-in: they gave you their number and agreed to hear from you on WhatsApp | No exception | The opt-in must name your business and say it is for WhatsApp | Respect every opt-out or block, on or off WhatsApp | Account limits or restrictions, not a fine | WhatsApp policyMeta opt-in guide |
Two cells deserve a word. WhatsApp in the US is unsettled: CAN-SPAM covers messages to email addresses, and the TCPA covers calls and texts sent with an autodialer, a term the Supreme Court read narrowly in Facebook v. Duguid (2021). No federal text we found clearly covers an app message, which is why the Meta rule in the last row is the one to follow. State laws can add to these federal rules, and this table covers federal law only.
What changes in the US on 25 November 2026
The rules for stopping texts in the US have moved twice in two years, and move again in four weeks.
- Since 11 April 2025, a person can revoke consent to texts and calls by any reasonable means, such as replying “stop”, and you must honour it within 10 business days. The FCC’s notice set that date.
- In January 2025 a federal appeals court struck down the FCC’s planned “one-to-one consent” rule, which would have required separate consent for each business on a comparison or lead form.
- From 25 November 2026, under the FCC’s new order, you may name one way to opt out, such as replying STOP, and make it the only one, as long as you say so clearly in each text. If you don’t name one, any reasonable means still counts. An opt-out from a marketing text covers all your marketing to that person; an opt-out from an informational text can be limited to that kind of message. The 10 business day limit stays.
The practical step before 25 November: if you send marketing texts in the US, end each one with the opt-out you want to rely on, for example “Reply STOP to opt out”, and make sure someone acts on those replies.
Turning the rules into a bigger list
Consent rules read like restrictions, but each one pushes you toward a list of people who want to hear from you, and that list is the one that buys. Five habits cover every column of the table:
- Ask per channel, at the moment of contact. An unticked box each for email, text and WhatsApp on order and enquiry forms, with one line saying what they will get and how often.
- Keep the evidence. Save the wording of the form, the date, and what each person ticked. Canada’s implied consent runs out after 2 years, so the purchase date matters too.
- Lean on the existing-customer route, honestly. Past buyers can hear about similar products in most of these places, but only while every message offers a free, simple way out.
- Make leaving easy and fast. One click for email, a STOP reply for texts. People who can leave easily complain less, and complaints are what hurt deliverability.
- Treat WhatsApp as opt-in only. Ask in a reply, on a form, or at the counter, and name your business and WhatsApp in the question.
Our explainer on opt-in consent covers the basic terms, and email, SMS or WhatsApp: which channel for which message helps you choose the channel once you have permission.
Method
We built the table on 28 October 2026 from the primary texts: the US Code and the Code of Federal Regulations, the FTC’s CAN-SPAM guide, Canada’s Anti-Spam Legislation and its regulations, the UK’s Privacy and Electronic Communications Regulations and ICO guidance, the EU ePrivacy Directive and the GDPR, Australia’s Spam Act 2003, and Meta’s WhatsApp Business Messaging Policy. Each row links to the pages we read.
What we left out or could not confirm:
- US states. Only federal law is tabulated.
- The EU text is the 2002 original of the ePrivacy Directive. We could not open the 2009 amending directive, so its changes to Article 13 are not reflected, and national laws differ on top of it.
- Australian penalties are in penalty units, as the Act states them. We could not open the source that converts them to dollars, so no dollar figure is given.
- The US email penalty is the FTC page’s figure of $53,088 per email, from its January 2024 update. The FTC adjusts it for inflation, so a newer figure may exist.
- The UK penalty is the ICO’s statement of the maximum since the Data (Use and Access) Act 2025 changes took effect on 5 February 2026.
Frequently asked questions
Can I email my customers without asking first? In the US, yes, as long as each email identifies you, includes a postal address and offers a working opt-out. In Canada, the UK, the EU and Australia you generally can for similar products to people who bought from you, with an opt-out in every message.
Is a WhatsApp message treated like a text? In Canada and Australia the law covers instant messages like email and SMS, and UK regulator guidance does the same; in the US it is unsettled. Everywhere, Meta’s own policy requires an opt-in before you message someone on WhatsApp.
How fast do I have to act on an unsubscribe? Within 10 business days in the US and Canada, and within 5 business days in Australia. The UK and EU set no fixed number of days, so act on it straight away.