GDPR & CAN-SPAM Checklist

Accurate From / subject — no deceptive headers

Subject and From must match the real offer and sender.

Valid physical postal address in the email

Include a real street address for your business.

Clear unsubscribe / opt-out that works within 10 days

One-click or obvious link; honor promptly. List-Unsubscribe helps.

Identify the message as an ad when required

If it’s commercial, disclosure should be clear.

Lawful basis / consent for EU/UK recipients

Document consent or legitimate interest; don’t buy cold EU lists casually.

Told people what you’ll email them about

Purpose limitation — match signup expectations.

Easy way to access/erase data on request

Process DSARs; don’t bury privacy contacts.

Processors (ESP) covered by a DPA

Your ESP should sign a data processing agreement.