Consent for email, SMS and messaging: CAN-SPAM, the TCPA, CASL, PECR and WhatsApp

This piece is general information, not legal advice. It informs the question behind every send: may we message this person, on this channel, for this purpose, and can we prove it?

• Two models US email law is opt-out: you may email until someone says stop, if the email is honest and identified¹. Canada, the UK and the EU are opt-in for marketing to individuals: consent first, with narrow exceptions^8, 9, 12.
• Texts and calls in the US fall under the TCPA, which changed in 2025 and 2026: the one-to-one consent rule was vacated, the revoke-all rule is delayed to 31 January 2027, and courts no longer have to follow the FCC's reading^3, 4, 6.
• Platforms add their own rules WhatsApp requires an opt-in that names the business and approved templates to start conversations^14, 15.
• The data layer still applies Whether you may use the data at all is a data protection question; see data protection for marketers.

The email primer and the messaging primer cover how each channel works, including the rules in the UAE, Saudi Arabia and India.

What counts as marketing. Under CAN-SPAM, a message that mixes transactional and commercial content is judged by its primary purpose¹. The ICO treats a service message that also promotes something as marketing⁹. The safe habit: keep service messages clean, and put offers only in messages that have consent.

The safe default for a brand that sends across borders is the opt-in model everywhere. It meets the strictest rule, it keeps lists cleaner, and it avoids running two consent systems. The rest of this piece explains where each rule bites.

United States: CAN-SPAM. The Act covers all commercial email, including business-to-business. It requires accurate header information, a subject line that matches the content, a clear statement that the message is an advertisement, a valid postal address and a way to opt out; opt-outs must be honoured within 10 business days, and the mechanism must keep working for at least 30 days after sending¹. Hiring an agency or platform does not transfer the responsibility, and messages whose main purpose is transactional are largely exempt¹.

Canada: CASL. Canada's Anti-Spam Legislation requires consent, express or implied, before a commercial electronic message is sent, and every message must identify the sender and include an unsubscribe mechanism⁸. Express consent does not expire but can be withdrawn; implied consent from a purchase lasts two years⁸. The CRTC lists maximum penalties of $1 million for individuals and $10 million for businesses per violation⁸.

United Kingdom: PECR. Marketing email and texts to individuals need consent, unless the soft opt-in applies: details collected in a sale or negotiation, marketing of your own similar products, and a chance to refuse at collection and in every message⁹. Corporate addresses can be emailed without consent, but sole traders and some partnerships count as individuals⁹. Since 5 February 2026 charities have had their own soft opt-in, usable only for details collected from that date¹⁰. The Data (Use and Access) Act 2025 raised PECR fines to the UK GDPR level¹¹. See soft opt-in.

European Union: ePrivacy. Article 13 of the ePrivacy Directive requires prior consent for marketing by email, text and automated calls, allows the existing-customer exception for similar products, and forbids disguising the sender or omitting a valid address for opting out¹². The Commission withdrew the proposed ePrivacy Regulation in February 2025, so the directive and each country's law implementing it stay in force¹³. See ePrivacy.

For proof, a double opt-in (a confirmation click) is not required by these texts but is the simplest way to show that the address belongs to the person who agreed.

In the US, marketing calls and texts sent with automated technology need the recipient's prior express written consent, and consent can be revoked^2, 7. The rules have moved fast:

• Revocation The FCC's 2024 order says a person may revoke consent by any reasonable means and the sender must honour it within 10 business days; a single confirmation text, without marketing, is allowed².
• One-to-one consent A rule that would have required consent to be given to one seller at a time, aimed at lead-generation sites, was vacated by the Eleventh Circuit on 24 January 2025, which held that the FCC had exceeded its authority³.
• Revoke-all The rule that a "stop" applies to all of a sender's robocalls and robotexts on unrelated subjects was delayed again in January 2026, to 31 January 2027⁴. In 2026 the FCC also proposed letting senders designate an exclusive means of revocation and asked whether seven business days would be a reasonable deadline⁵. Check the final text before relying on either.
• Who interprets On 20 June 2025 the Supreme Court held in McLaughlin Chiropractic v. McKesson that district courts are not bound by the FCC's interpretations of the TCPA in enforcement cases, though they should give them appropriate respect⁶. Expect courts to differ.

The operators' trade body, CTIA, adds expectations of its own: consent for each programme, records of every opt-in, a call to action that names the programme, the sender, any fees and how to opt out, and an immediate response to "STOP"⁷.

Platforms set rules on top of the law, and breaking them can cost the number or the account.

WhatsApp. Businesses must obtain an opt-in that clearly states the business's name; it may be gathered on another channel as long as local law is respected, and Meta recommends asking separately for each category of message, such as order updates or offers¹⁴. Conversations started by the business must use an approved message template, and the business must respect requests to stop or block¹⁵.

Messenger, Instagram and Telegram work mostly from the person's own message; the messaging primer sets out each platform's windows and tags.

The rule that follows from all of them: an email opt-in is not an SMS or WhatsApp opt-in, and a consent given to one brand is not consent for its partners^7, 14.

An illustrative case, not a real company. A travel retailer runs a newsletter in the US, Canada, the UK and France, and wants to add SMS offers and WhatsApp booking updates.

1. Map purposes to channels Booking updates (service), offers (marketing), surveys (marketing in most rules).
2. Email One sign-up form with an unticked box and a confirmation email serves all four countries; it meets CASL, PECR and ePrivacy, and CAN-SPAM's footer rules still apply in the US^{1, 8, 9, 12}.
3. SMS A separate, unticked SMS box with the programme name, frequency, fees and how to stop, as CTIA expects⁷; in the US, written consent under the TCPA².
4. WhatsApp A third choice naming the business, by category: "booking updates" and, separately, "offers"¹⁴; updates go out as approved templates¹⁵.
5. Leaving A STOP reply, an unsubscribe link or a "stop" typed in WhatsApp updates one preference record that every channel reads, within the shortest deadline that applies^1, 2.

• Pre-ticked boxes and bundled consent Consent under the opt-in rules is a clear, separate act^9, 12.
• Using an email opt-in for texts or WhatsApp Consent is per channel and sender^7, 14.
• Bought or rented lists CTIA expects senders to build their own lists⁷; under the opt-in rules a third party's consent rarely covers you.
• Treating sole traders as companies under PECR⁹.
• Slow opt-outs Ten business days is a ceiling, not a target^1, 2.
• Assuming the TCPA rules are settled Check the revoke-all and revocation rules before 2027^4, 5.

A consent checklist to run before the next campaign:

1. Audit the forms: one unticked box per channel and purpose, in every language, naming the business.
2. Store each consent in the CRM or a consent management tool with the fields above.
3. Wire one preference record to email, SMS, WhatsApp and call centres, and test that a STOP reaches all of them.
4. Check every footer and template: sender, address, unsubscribe; WhatsApp templates approved and correctly categorised.
5. Watch deliverability: consent and low complaints go together; see deliverability.
6. Re-permission old lists: where you cannot show how and when consent was collected, ask once more or stop sending.
7. Put the review on the launch checklist, and keep the crisis communications checklist ready for a mistaken send.

See also the email hub and the messaging hub.

• United States: the FTC's CAN-SPAM guide¹; the FCC's 2024 and 2026 orders^2, 5; Venable³, Burr & Forman⁴ and Steptoe⁶ on the 2025–2026 changes; CTIA's messaging principles⁷.
• Canada: the CRTC's CASL questions and answers⁸.
• The UK and the EU: the ICO on email marketing⁹, the charitable soft opt-in¹⁰ and the 2025 Act¹¹; the ePrivacy Directive¹² and Lewis Silkin on the withdrawn regulation¹³.
• Platforms: WhatsApp's opt-in guidance¹⁴ and Business Messaging Policy¹⁵.
• Earlier in this track: advertising standards and self-regulation, data protection for marketers, influencer and endorsement disclosure.