You can’t assume permission. If someone didn’t clearly ask for your marketing email, don’t send it, and if they told you what they want, send only that. This matters more now than it once did. Since February 2024, Gmail and Yahoo have each required bulk senders to keep spam complaint rates below 0.3%, support one-click unsubscribe and authenticate with SPF, DKIM and DMARC. Microsoft announced its own Outlook.com requirements on April 2, 2025, with enforcement beginning May 5, 2025. Every unwanted email that gets reported as spam now does measurable damage to your deliverability.
When you assume permission, you end up sending people information they don’t want. This usually happens in one of two ways. The first is adding the address of someone who never asked to be on your list. The second is sending every email to everyone on your list, no matter how you got their address or what interests they told you about.
What goes wrong when you assume permission
Assuming permission costs you reputation, inbox placement and goodwill, usually in that order.
- You get a bad reputation. People complain about companies that annoy them. When this post was first written that meant a blog post. Today it’s more likely a social media post, a public review or a click on the “Report spam” button.
- Your deliverability drops. That makes it harder to reach the subscribers who do want your email. Gmail and Yahoo measure spam complaints directly. Google asks bulk senders (anyone sending more than 5,000 messages a day to Gmail addresses) to stay below 0.3% and aim for under 0.1%. A handful of annoyed contacts on a small list can push you past that.
- Interested people turn into angry ones fast. Someone who might have bought from you later becomes someone who blocks your domain.
The law and the inbox set different bars, and you need to clear both. In the US, the CAN-SPAM Act is an opt-out law. It doesn’t require prior consent, but it does require an accurate sender, honest subject lines, a physical address and a working unsubscribe that you honor within 10 business days. The FTC’s maximum penalty is $53,088 per violating email. That figure stays the same in 2026 because the FTC is making no inflation adjustment this year and keeps applying its 2025 penalty levels. Mailbox providers and email service providers set a higher bar than the law. AWeber, for example, describes itself as a consent-based service and doesn’t allow purchased lists or lists obtained from third parties on its platform.
Groups email marketers often assume permission from
Most permission mistakes come from four groups of contacts. In each case the person did give you their address, but for a different reason than marketing.
Social media followers and contacts
Connecting with you on a social network isn’t the same as subscribing to your email list. These people agreed to see you on LinkedIn, Facebook or a similar site, and nothing more.
Platforms have also made this harder than it was when this post was first written. LinkedIn changed its export in 2018, so a connection’s email address only appears in your exported contacts if that person allowed it. That setting is off by default. Scraping the missing addresses with third-party tools breaks LinkedIn’s User Agreement and creates a list nobody opted into. Invite your followers to sign up instead.
Customers who made a purchase
Online stores ask for an email address so they can send receipts, shipping updates and other order information. That doesn’t mean the customer wants your promotional emails.
The rules here depend on where your customers live:
| Region and law | Can you email past buyers without asking? | Main conditions |
|---|---|---|
| US, CAN-SPAM Act | Yes, legally | Clear opt-out in every commercial email, honored within 10 business days |
| UK, PECR (the “soft opt-in”) | Sometimes | Address collected during a sale or a negotiation for one, marketing only your own similar products, and a chance to opt out both at checkout and in every message |
| Canada, CASL | For a limited time | Consent is implied for two years after a purchase (six months after an inquiry), and you must be able to prove the relationship |
| EU, GDPR and ePrivacy rules | Sometimes | National soft opt-in rules apply. Otherwise you need consent |
Even where the law allows it, the safest choice is an unticked “Send me offers and news” checkbox at checkout. Buyers who tick it actually want your email, and they’re far less likely to report you.
Support inquiries
If someone emails you a question, they expect a reply. They don’t expect to be added to your list.
Here’s a typical version of this mistake from when this post was first published. Someone looking for a wedding photographer contacted one company to ask about its services. The next day, this was in their inbox:
Adding the person to the list without asking was bad enough. On top of that, the company knew this person was interested in wedding photography and still sent its general promotional email. A better approach is simple: answer the question, then offer a link to sign up for wedding-related updates.
Subscribers who chose preferences
People who sign up through your preference center did so because they want specific information. If you send them email outside the preferences they chose, you’re acting as if they agreed to receive whatever you want to send.
Here’s an example from the same period. A subscriber signed up on the Princess Cruises website and used its preference center to choose cruises to Europe and Australia. A few days later, this arrived:
Alaska wasn’t one of the regions the subscriber had picked. A preference center only builds trust if every send respects it. If you don’t segment by those choices, either drop the preference center or start segmenting.
What to do instead
Ask, listen, and send only what people asked for. In practice:
- Put a signup link or form on your website, in your social profiles and in your email signature.
- Use confirmed (double) opt-in for new signups, so every address is verified and you have a record of consent.
- Ask your followers and regular contacts directly if they’d like to join your list. Don’t add them yourself.
- Use an unticked marketing checkbox at checkout and on contact or support forms.
- Segment your sends by the interests and preferences people gave you.
- Include a visible unsubscribe link and a one-click List-Unsubscribe header, and process opt-outs within two days, which is the window Gmail and Yahoo expect.
- Watch your spam rate in Google Postmaster Tools and Yahoo Sender Hub, and stop mailing contacts who haven’t engaged in a long time.
Guides on resources such as the AWeber blog go into opt-in form design and preference centers in more detail. The rule itself stays short. Whatever you do, never assume.
FAQ
Is it legal to email customers who bought from me without asking first?
In the US, yes, as long as every commercial email follows CAN-SPAM, including a working opt-out. In the UK you can rely on the soft opt-in only for your own similar products, and only if the customer had a chance to opt out at checkout. In Canada, CASL gives you implied consent for two years after the purchase.
Can I add my LinkedIn connections to my email list?
You shouldn’t. Accepting a connection request isn’t consent to marketing email, and LinkedIn only includes a connection’s address in an export if that person allowed it. Send your connections an invitation to subscribe and add only the people who say yes.
Do I need double opt-in?
No law in the US requires it, and Gmail and Yahoo don’t require it either. It’s still the easiest way to prove consent and keep fake and mistyped addresses off your list, which helps keep your spam complaint rate low.
What spam complaint rate gets you in trouble with Gmail and Yahoo?
Both providers name 0.3% as the threshold for bulk senders, and Google recommends staying under 0.1%. Google says senders with a spam rate above 0.3% may have their mail sent to spam and may lose eligibility for mitigation. To become eligible again, you have to meet its sender requirements, including keeping the spam rate below 0.3% for seven consecutive days.
Is a support reply or receipt the same as marketing email?
No. Receipts, order updates and replies to questions are transactional messages, and CAN-SPAM treats them differently from commercial email. They become marketing as soon as you add promotions, so keep the two separate and send promotions only to people who opted in.
Sources
- Email sender guidelines, Google Workspace Admin Help
- Sender best practices, Yahoo Sender Hub
- CAN-SPAM Act: A Compliance Guide for Business, Federal Trade Commission
- Civil Penalty Inflation Adjustments, Federal Register, September 15, 2026
- Outlook’s new requirements for high-volume senders, Microsoft Tech Community
- How do we comply with the PECR electronic mail marketing rules, ICO
- Canada’s anti-spam legislation, Government of Canada
- List compliance, docs.aweber.com