GDPR and CCPA Compliance for Email Marketing: A Complete Checklist

Email marketers face an increasingly complex regulatory landscape. The General Data Protection Regulation (GDPR) governs how you handle data of EU residents, while the California Consumer Privacy Act (CCPA) and its 2023 amendments (CPRA) protect California consumers. Non-compliance penalties can reach €20 million or 4% of annual global revenue under GDPR, and up to $7,500 per violation under CCPA.

Consent is the foundation of compliance. GDPR requires consent to be freely given, specific, informed, and unambiguous. Pre-checked boxes are illegal. You must use an active opt-in mechanism—a checkbox that is unchecked by default, or a double opt-in process. Document when, where, and how each subscriber gave consent. Store this data alongside their profile for audit purposes.

“

Privacy policies must be comprehensive and accessible. Disclose what data you collect, how you use it, who you share it with, and how long you retain it. Under CCPA, you must also inform consumers of their right to opt out of the sale of their personal information. Include a clear "Do Not Sell My Personal Information" link on your website and in your email footer.

Data subject rights require operational processes. Subscribers can request access to their data, correction of inaccurate data, deletion (right to be forgotten), and portability of their data in a machine-readable format. You must respond to these requests within 30 days under GDPR and 45 days under CCPA. Set up an automated system to handle these requests efficiently.

Data handling best practices minimize risk. Encrypt personal data both in transit and at rest. Limit data retention to what is necessary for your stated purpose—delete or anonymize subscriber data after 24 months of inactivity. Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities. Designate a Data Protection Officer if you process large-scale personal data.

“

Email-specific compliance requirements include providing a clear unsubscribe link in every email, honoring opt-out requests within 10 business days, and including your physical mailing address. Under CCPA, you must treat opt-outs as permanent unless the consumer explicitly re-consents. Regular compliance audits every six months will keep your program aligned with evolving regulations.