Commercial email rules for 134 countries and territories, grouped by region, with the consent rule, the governing statute and what every message must contain. Reviewed November 5, 2026.
Last updated November 9, 2026
You are the sender of record for every message you send through Lead-Pitch, not us. The laws below decide who you may email, what consent you need, and what each message must include. Find your recipient’s country, read its consent rule before you send, and treat an unclear case as one that needs prior consent and an obvious unsubscribe.
You need the recipient’s permission before the first message. Silence is not consent, and a purchased list is usually not consent.
You may send without prior permission, provided the message is honest, identifies you, and every message carries a working way to stop.
Individuals need permission, while a registered company address can often be mailed on an opt-out basis. Treat this as the stricter rule until you know who is on the other end.
No dedicated anti-spam statute identified. General data-protection, consumer and e-commerce rules still apply, so consent and a working unsubscribe are the safe default.
Business-to-business outreach is still marketing. Most opt-in countries do not care that the address belongs to a company, and a handful of them, Germany and Austria in particular, ask for consent either way. If you are unsure which rule reaches a recipient, send as though prior consent were required and make the unsubscribe obvious.
134 countries shown
CAN-SPAM Act, 15 U.S.C. § 7701 et seq.
No prior consent needed. No deceptive subject lines, identify the message as an ad, include a valid physical postal address, and honor an opt-out within 10 business days. The FTC and state attorneys general enforce it.
CASL, S.C. 2010, c. 23 (in force July 2014)
Express or implied consent is required before a commercial electronic message. Every message needs sender identification, a physical mailing address and a working unsubscribe that takes effect within 10 business days. Enforced by the CRTC.
LFPDPPP (2010) and the Federal Consumer Protection Law (PROFECO)
Consent is the general basis, but commercial email is widely run on an opt-out basis. Honor the REPEP do-not-contact registry for marketing, identify yourself, and stop on request.
LGPD (Lei 13.709/2018), Marco Civil da Internet (Lei 12.965/2014), CDC art. 33
The consumer code treats unsolicited commercial email as abusive without consent, and LGPD requires a lawful basis. Opt-in is the practical standard; always offer an opt-out and identify the sender. Enforced by ANPD and consumer bodies.
Ley 25.326 (data protection) and Ley 24.240 (consumer defence)
No dedicated anti-spam statute. Consent is the basis for processing, opt-out is expected in practice, and the AAIP enforces data-protection rules. Register your database where required.
Ley 19.628, Ley 19.496 and Ley 21.719 (new data-protection law, from December 2026)
Consumer law allows marketing email with a working opt-out. The new data-protection law raises consent and notice duties when it takes effect, so opt-in is the safer build.
Ley 1581 de 2012 and Decreto 1377 de 2013
Prior, express and informed authorization is required to use personal data for marketing, and the message must offer a way to withdraw it. Enforced by the SIC, which fines non-compliance.
Ley 29733 (data protection) and its regulations
Consent is required for marketing use of personal data unless a legal exception applies, and the sender must allow withdrawal. Enforced by the ANPD.
Ley 18.331 (2008) and Decreto 414/009
Consent is required for direct marketing, with an exception where there is a prior contractual relationship for similar products. Include an opt-out and identify the sender. Enforced by the URCDP.
Ley Orgánica de Protección de Datos Personales (2021)
Consent, or another lawful basis, is required for marketing processing. The law gives people a right to object, so every message needs a working opt-out.
Ley 6534/2020 (personal data protection)
Consent is the basis for processing personal data. No separate anti-spam statute identified; offer a clear opt-out and identify the sender.
Consumer law and the constitutional right to privacy
No dedicated anti-spam statute identified. Commercial email should carry sender identification and a working opt-out.
Ley de Infogobierno and consumer protection rules
No dedicated anti-spam statute identified. Consent-based sending with a clear opt-out is the safe approach.
Ley 8968 (2011), Protección de la Persona frente al Tratamiento de sus Datos Personales
Consent is required to process personal data, including for marketing. Include an opt-out and identify the sender. Enforced by PRODHAB.
Ley 81 de 2019 (personal data protection)
Consent is required for marketing use of personal data, with duties of notice and security. Offer a working opt-out in every message.
Consumer protection law and constitutional privacy rights
No dedicated anti-spam statute identified. Identify the sender and offer an opt-out.
Ley de Protección al Consumidor
No dedicated anti-spam statute identified. Consumer law prohibits misleading commercial messages, so be accurate and offer an opt-out.
Consumer protection and e-commerce rules
No dedicated anti-spam statute identified. Consent-based sending with a working unsubscribe is the safe approach.
Ley 842 de Protección al Consumidor
No dedicated anti-spam statute identified. Commercial messages must be accurate and offer a way to stop.
Ley 172-13 (data protection) and Ley 126-02 (e-commerce)
Consent is the basis for processing personal data. Include sender identification and an opt-out.
Data Protection Act 2020
Personal data may be used for marketing only with consent or another lawful basis, and people can object. Offer a working opt-out.
Data Protection Act 2011
Consent is required for marketing use of personal data, and direct marketing must allow objection. Identify the sender and offer an opt-out.
Data Protection (Privacy of Personal Information) Act 2003
Personal data must be processed fairly and, for marketing, with consent or a lawful basis. Offer a working opt-out.
Data Protection Act 2019
Consent and notice duties apply to marketing processing, and people may object. Include an opt-out.
Consumer protection and e-commerce rules
No dedicated anti-spam statute identified. Use consent-based sending with sender identification and an opt-out.
Personal Information Protection Act 2016
Consent is required for marketing use of personal information, and messages must allow an opt-out.
Data Protection Act (2021 revision)
Direct marketing requires consent or another lawful basis, and people may opt out at any time.
ePrivacy Directive 2002/58/EC art. 13, with the GDPR (EU) 2016/679
Consent is required for commercial email to individuals, and consent must be freely given, specific and recorded. The rules for company addresses vary by member state: some treat them like individuals. Always identify the sender and offer an opt-out.
Telecommunications Act 2021 (TKG 2021) § 174
Prior consent is required for electronic direct marketing, including to most business addresses. The Austrian DSB enforces the GDPR side.
Law of 11 March 2003 on electronic commerce, plus the GDPR
Consent is required for individuals; company addresses may be mailed on an opt-out basis. Include sender identity and a working unsubscribe.
Electronic Communications Act (2007), art. 261
Prior consent is required for commercial electronic messages, with limited exceptions. Enforced by the CPDP.
Electronic Communications Act (Zakon o elektroničkim komunikacijama)
Consent is required for individuals; legal entities can be contacted on an opt-out basis unless they are registered as not wanting marketing.
Regulation of Electronic Communications and Postal Services Law 112(I)/2004
Prior consent is required for unsolicited commercial email. Include sender identity and an unsubscribe route.
Act No. 480/2004 Coll. on Information Society Services
Consent is required for individuals; existing customers may be mailed about similar products with a clear opt-out. The UOOU enforces it.
Marketing Practices Act (Markedsføringslo ven) § 10
Prior consent is required, and Denmark reads strictly even for many business recipients. Existing-customer exceptions are narrow, and the Consumer Ombudsman enforces actively.
Electronic Communications Act § 103¹
Consent is required for individuals; company addresses may be contacted on an opt-out basis. Include an unsubscribe route in every message.
Information Society Code (917/2014)
Consent is required for individuals; direct marketing to companies is allowed with an opt-out, except for certain regulated sectors.
LCEN (2004) and CPCE art. L34-5, with the CNIL’s doctrine
Prior consent is required for individuals; a limited existing-customer exception applies for similar products. The CNIL fines violations and requires a working opt-out in every message.
Act Against Unfair Competition (UWG) § 7
The strictest rule in the EU: prior express consent is required for email advertising, including to businesses, with a narrow existing-customer exception. Cease-and-desist letters and fines are common.
Law 3471/2006, art. 11
Prior consent is required for unsolicited commercial email, and consent must be verifiable. Enforced by the HDPA.
Act XLVIII of 2008 on Business Advertising, § 6
Prior consent is required for electronic advertising, with a narrow existing-customer exception for similar goods or services.
ePrivacy Regulations (SI 336/2011) and the Data Protection Act 2018
Consent is required for individuals; corporate subscribers can be emailed on an opt-out basis. The DPC enforces and requires a valid unsubscribe in every message.
Codice in materia di protezione dei dati personali, art. 130
Prior consent is required for email marketing; company addresses are treated strictly. The Garante issues fines and requires a recorded consent.
Electronic Communications Law and the GDPR
Consent is required for individuals; business recipients may be contacted on an opt-out basis. Include an unsubscribe route.
Law on Electronic Communications (2004)
Consent is required for individuals; legal entities can be mailed once on an opt-out basis. Enforced by VDAI.
Law of 30 May 2005 on electronic commerce, with the GDPR
Consent is required for individuals; company addresses may be contacted on an opt-out basis. Include a working unsubscribe.
Processing of Personal Data (Electronic Communications Sector) Regulations
Consent is required for individuals; corporate subscribers can be emailed on an opt-out basis. The IDPC enforces compliance.
Telecommunicatiewet art. 11.7
Prior consent is required, including for most business addresses. The exception for existing customers covers similar products only.
Act on Providing Services by Electronic Means (2002) art. 10; Electronic Communications Law art. 172
Consent is required for individuals; business recipients can be contacted on an opt-out basis. The UODO enforces the data-protection side.
Lei 41/2004, art. 13, with Decreto-Lei 7/2004
Prior consent is required for unsolicited commercial email. Include sender identity and an unsubscribe route. CNPD enforces.
Law 506/2004, art. 6
Prior consent is required for commercial electronic messages, with a narrow existing-customer exception. ANSPDCP enforces.
Act No. 351/2011 on Electronic Communications, § 55
Consent is required for individuals; business addresses may be contacted on an opt-out basis. Include an unsubscribe route.
ZEKom-1, art. 109
Consent is required for individuals; legal entities can be contacted on an opt-out basis. Include a working unsubscribe.
Ley 34/2002 (LSSI) art. 21, with Ley 9/2014
Prior express consent is required for commercial email, with a limited existing-customer exception. The AEPD fines violations and requires a recorded opt-out.
Marketing Act (2008:486) and the Electronic Communications Act
Prior consent is required for email marketing, and it is read strictly for business recipients too. The Swedish Consumer Agency and IMY enforce.
Marketing Control Act (2009) § 15 and ekomloven § 2-7
Prior consent is required for electronic marketing, including to businesses. Include sender identity and a working unsubscribe. The Consumer Authority enforces.
Electronic Communications Act No. 81/2003, art. 45
Prior consent is required for unsolicited commercial email. The Data Protection Authority enforces.
EEA application of the ePrivacy Directive and the Data Protection Act
Prior consent is required for commercial email, and the GDPR standard applies through the EEA. Include an unsubscribe route.
Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR
Consent is required for individual subscribers; corporate subscribers (limited companies and LLPs) may be emailed on an opt-out basis. Every message needs sender identity and a working unsubscribe. The ICO fines violations.
Unfair Competition Act (UWG) art. 3(1)(o)
Prior consent is required for mass advertising by electronic means. Swiss law also bars using address lists that were gathered without consent.
Law on Advertising, Law on Electronic Communications (2020), Law on Personal Data Protection
Advertising by electronic means requires the recipient’s consent, and an opt-out must be honored. Include sender identity in every message.
Law 133/2011 on personal data protection and the Advertising Law
Consent is required for marketing communications, and people may withdraw it at any time. Include a working opt-out.
Law on Advertising, art. 44; Law on Personal Data Protection (2018)
Consent is required for advertising by electronic means, and consent must be recorded. An opt-out must be easy to use.
Entity-level data protection laws and the Communications Act
No single nationwide anti-spam rule identified; entity-level data-protection laws require consent. Use consent-based sending with an opt-out.
Law 9887/2008 on data protection and Law 9918/2008 on electronic communications
Consent is required for commercial electronic communications, and opt-out requests must be honored.
Law on Personal Data Protection (2020) and Law on Electronic Communications (2022)
Prior consent is required for direct marketing, and it must be recorded and revocable.
Law on Personal Data Protection (2017) and Law on Electronic Communications
Consent is required for marketing processing, and an opt-out must be honored without charge.
Law No. 06/L-082 on Protection of Personal Data
Consent is the basis for marketing processing, and people may object at any time.
Law No. 6563 on the Regulation of Electronic Commerce (2014, amended 2022)
Prior consent is required, and consent is logged in the central İYS registry that recipients use to opt out. Silence is never consent. The Ministry of Trade fines violations heavily.
Federal Law No. 38-FZ on Advertising, art. 18; Federal Law No. 152-FZ
Advertising by email, SMS and push requires the recipient’s prior consent, and the sender must stop immediately on request. Fines are levied under the advertising law.
Law on Advertising (2007) and the Law on Personal Data Protection (2021)
Advertising by electronic means requires prior consent, and an opt-out must be honored.
Law on Personal Data Protection (2011) and the Advertising Law
Consent is required for marketing use of personal data, and it can be withdrawn at any time.
Law on Personal Data Protection (2015, amended 2023)
Consent is the basis for marketing processing, with a right to object. Include a working opt-out.
Law on Personal Data (2010)
Consent is required for the processing of personal data, including marketing. Offer a way to withdraw it.
Federal Decree-Law No. 45 of 2021 and the TDRA Unsolicited Electronic Communications Policy
Prior consent is required for commercial electronic messages, the sender must be identified, and an opt-out must work. The TDRA and the Data Office enforce it.
Personal Data Protection Law (2021, in force 2023) and CITC Anti-Spam Regulations
Prior consent is required, and commercial messages must carry sender identity and an opt-out. CITC blocks and fines senders who ignore it.
Law No. 13 of 2016 on Personal Data Privacy and CRA anti-spam rules
Consent is required for marketing processing, and telecom rules require sender identification and an opt-out. You must also register as a data controller where applicable.
CITRA Data Privacy Protection Regulation (2021)
Consent is required for marketing messages, and an opt-out must be honored. CITRA enforces the rules.
Personal Data Protection Law No. 30 of 2018
Consent is required for marketing processing, and unsolicited messages must include a working opt-out.
Personal Data Protection Law (Royal Decree 6/2022)
Consent is required for marketing use of personal data, with a right to withdraw and to object.
Personal Data Protection Law No. 24 of 2023
Consent is required for direct marketing, and the recipient must be able to opt out.
Law No. 81 of 2018 on Electronic Transactions and Personal Data
Consent is required for marketing processing, and an opt-out must be honored.
Communications Law (Bezeq and Broadcasts) Amendment 40 and the Protection of Privacy Law
Prior consent is required for advertising by email, SMS and fax, with narrow exceptions. Every message must include a clear opt-out that works within a reasonable time.
Law No. 151 of 2020 on Personal Data Protection and the Consumer Protection Law
Consent is required for marketing use of personal data, and messages must identify the sender and offer an opt-out. NTRA rules cover telecom channels.
Law 09-08 on personal data protection and Law 31-08 on consumer protection
Prior consent is required for direct marketing by electronic means, and the CNDP enforces the data-protection side.
Law 18-07 on the protection of natural persons in data processing
Consent is required for marketing processing, and an opt-out must be honored.
Organic Law 2004-63 on personal data protection
Consent is required for marketing use of personal data, with a right to object. The INPDP enforces it.
ECTA s. 45 and the Protection of Personal Information Act (POPIA)
Unsolicited commercial email must state the sender, include a working opt-out and honor it. Under POPIA, direct marketing to non-customers generally needs consent, so ask first. The Information Regulator enforces.
Nigeria Data Protection Act 2023 and the NCC Consumer Code
Consent and a lawful basis are required for marketing messages, and every message must offer an opt-out. NDPC enforces the data-protection side.
Data Protection Act 2019 and the Consumer Protection Act 2012
Direct marketing requires prior consent, or an existing customer relationship for similar goods. Each message must offer an opt-out. The ODPC enforces.
Data Protection Act 2012 (Act 843)
Consent is required to use personal data for marketing, and recipients may object. The Data Protection Commission enforces.
Personal Data Protection Act 2022
Consent is required for marketing processing, and the recipient can withdraw it at any time.
Data Protection and Privacy Act 2019
Consent is required to collect and use personal data for marketing, and an opt-out must be honored.
Law No. 058/2021 on the protection of personal data and privacy
Consent is required for marketing processing, with a right to object and to withdraw consent.
Data Protection Act 2021
Consent is required for direct marketing, and every message must offer a way to opt out.
Cyber and Data Protection Act 2021
Consent is required for marketing use of personal data, and senders must stop on request.
Data Protection Act 2024
Consent is required for direct marketing, and an opt-out must be honored without cost.
Data Protection Act 2017
Direct marketing by electronic means requires consent, and each message must carry sender identity and an opt-out.
Consumer protection rules and the constitutional right to privacy
No dedicated anti-spam statute identified. Consent-based sending with a working opt-out is the safe approach.
Law 2008-12 on personal data protection
Consent is required for marketing processing, and recipients may object. The CDP enforces it.
Law 2013-450 on personal data protection
Consent is required for marketing use of personal data, and messages must allow an opt-out. The ARTCI enforces.
Law 2010/012 on cybersecurity and cybercrime
No dedicated anti-spam statute identified. Consent-based sending with sender identification and an opt-out is the safe approach.
Computer Crime Proclamation No. 958/2016 and data-protection rules
No dedicated anti-spam statute identified. Use consent-based sending and a working opt-out.
Computer Crimes Law and advertising regulations
No dedicated anti-spam statute identified; advertising rules and consent expectations apply. Best practice is prior consent plus an opt-out.
Consumer protection and e-commerce rules
No dedicated anti-spam statute identified. Use consent-based sending with sender identification and an opt-out.
Spam Act 2003 (Cth)
Consent, express or reasonably inferred, is required. Every message needs accurate sender identification, a physical address and a functional unsubscribe honored within 5 business days. ACMA fines run into the millions.
Unsolicited Electronic Messages Act 2007
Consent is required, along with accurate sender identification and a working unsubscribe honored within 5 working days. Enforced by the Department of Internal Affairs.
Act on Regulation of Transmission of Specified Electronic Mail (2002, as amended)
Prior consent (opt-in) is required for commercial email, the sender must be identifiable, and an opt-out must work. Opt-out is only available for existing customers. Enforced by MIC and consumer bodies.
Act on Promotion of Information and Communications Network Utilization (Network Act)
Prior consent is required for commercial email, with recorded consent and a working opt-out. Labels such as "(ad)" are required in the subject line. PIPC enforces.
Advertising Law art. 43, PIPL (2021) and the Internet Email Service Measures
Sending commercial email without consent is prohibited, and the sender must stop when asked. PIPL adds consent and notice duties. Enforcement is by SAMR and the CAC.
Unsolicited Electronic Messages Ordinance (Cap. 593)
Commercial electronic messages must identify the sender, include an unsubscribe facility and honor it within 10 working days. Addresses on the do-not-call register must not be used. Enforced by OFCA.
Personal Data Protection Act and Consumer Protection Act
No dedicated anti-spam act in force. Marketing email requires a lawful basis, must identify the sender, and must honor an opt-out promptly.
Spam Control Act 2007 and the PDPA 2012
Unsolicited commercial email must carry the <ADV> label in the subject, accurate sender details and an unsubscribe facility honored within 10 business days. PDPA adds consent and DNC obligations. Enforced by IMDA and the PDPC.
Personal Data Protection Act 2010 and the Communications and Multimedia Act 1998
Consent is required to process personal data for marketing, and each message must offer an opt-out. MCMC and the PDP Commissioner enforce.
Personal Data Protection Law No. 27/2022 and the ITE Law
Consent is required for marketing processing, and it must be explicit and revocable. Include sender identity and an opt-out route.
Personal Data Protection Act B.E. 2562 (2019)
Consent is required for marketing use of personal data, and it must be withdrawable. Electronic marketing without consent is prohibited, with a narrow existing-customer exception.
E-Commerce Act (RA 8792) and the Data Privacy Act (RA 10173)
Marketing email should carry sender identification and a working opt-out. Consent, or another lawful basis, applies under the Data Privacy Act. The NPC enforces.
Decree 91/2020/ND-CP on anti-spam text messages, email and calls
Prior consent is required before advertising email is sent, and the recipient must be able to opt out. Senders must register with the MIC, and unregistered sending is blocked.
IT Act 2000, SPDI Rules 2011, TRAI UCC Regulations 2018 and the DPDP Act 2023
Commercial communications require consent, and unsolicited marketing is regulated by TRAI for telecom channels. The DPDP Act requires notice and consent for personal data. Include an opt-out in every message.
Prevention of Electronic Crimes Act 2016 and PTA regulations
No dedicated anti-spam statute identified; unsolicited marketing is restricted by PTA rules and consent expectations apply. Offer an opt-out.
Cyber Security Act 2023 and consumer protection rules
No dedicated anti-spam statute identified. Use consent-based sending with sender identification and an opt-out.
Personal Data Protection Act No. 9 of 2022
Direct marketing requires consent or an existing customer relationship for similar goods, plus a clear opt-out in each message.
Electronic Transactions Act 2008
Unsolicited commercial email must be identifiable and allow the recipient to stop receiving it. Use consent-based sending.
E-commerce law and consumer protection rules
No dedicated anti-spam statute identified. Consent-based sending with an opt-out is the safe approach.
Law on Electronic Transactions and consumer rules
No dedicated anti-spam statute identified. Use consent-based sending and a working opt-out.
Electronic Transactions Law and telecommunications rules
No dedicated anti-spam statute identified. Consent-based sending with sender identification and an opt-out.
Data protection and e-commerce rules
No dedicated anti-spam statute identified. Use consent-based sending and a working opt-out.
Law on Personal Information Protection (2021)
Consent is required for marketing processing, and an opt-out must be honored.
Law on Personal Data (2013) and the Advertising Law
Advertising distributed through electronic means requires the recipient’s consent, and an opt-out must be honored.
Law on Personal Data (2019) and the Advertising Law
Consent is required for marketing processing and advertising by electronic means. Offer an opt-out.
Law on Personal Data (2008)
Consent is required for marketing use of personal data, and it can be withdrawn.
Consumer protection and e-commerce rules
No dedicated anti-spam statute identified. Use consent-based sending with an opt-out.
Electronic transactions and consumer rules
No dedicated anti-spam statute identified. Use consent-based sending with sender identification and an opt-out.
Consumer protection rules
No dedicated anti-spam statute identified. Use consent-based sending with an opt-out.
This reference is general information, not legal advice, and it is not a substitute for checking the current text of the law or taking advice in the country you are mailing. Rules change, enforcement priorities shift, and how a rule applies depends on who the recipient is and what you are selling. You are the sender of every message you send through Lead-Pitch, so the obligation to comply is yours.
Need help? Ask Charles
Charles is the Lead-Pitch assistant. Open him with the Ask Charles button in the corner of any page and ask about leads, pitches, credits, plans or the outreach rules. Signed-in members can also press ? for help and keyboard shortcuts.
CEL Website Design LLC, an Arkansas limited liability company
200 W Scenic Drive, North Little Rock, AR 72118
Email: celwebsitedesigns@gmail.com
Web: celwebsitedesigns.com · lead-pitch.com
Web design studio: CEL Website Designs