Stay Compliant: Email Legal Guidelines for Nonprofits

Does CAN-SPAM cover your nonprofit’s fundraising email, or only businesses? Can you share your email list with a partner charity? And what about your supporters in Canada, the UK or Europe?

Search “can nonprofits share email lists” and you mostly get software companies and advice columns, so it’s hard to tell which email legal guidelines apply to your nonprofit. Meanwhile, the newsletter still has to go out on Thursday.

It may sound like a lot of red tape, but email compliance is manageable. Here’s what we’ll do: go through the email legal guidelines in the US, Canada, the EU and the UK, and say what we’d do about each. We’re not lawyers, so take this as general guidance, not legal advice.

Do email legal guidelines apply to nonprofits?

Sometimes. No single law or regulation covers every nonprofit email, and each one switches on for a different reason: where you are, where your supporters live, and what the email says.

The US and Canadian email compliance laws are about commercial email, but nonprofits aren’t always exempt, especially when an email sells something or promotes a sponsor’s product. The UK’s regulator, the ICO, goes further and counts “the promotion of aims and ideals” as direct marketing.

So email compliance starts with working out which email legal guidelines reach you. Ask:

• Where is your nonprofit based, and where do your supporters live?
• Are you a registered charity in Canada, or a charity in the UK? Both countries have rules just for charities.

In the US, the CAN-SPAM Act covers email that promotes something commercial

Congress passed CAN-SPAM in 2003, and the Federal Trade Commission enforces it. It covers email whose primary purpose is “the commercial advertisement or promotion of a commercial product or service” (the Act’s definition), and the FTC has said that includes a nonprofit’s email with that purpose. So watch any newsletter that sells merchandise or promotes a sponsor’s product.

A nonprofit’s plain donation appeal or mission update is less clear: the Act, the FTC’s regulations, its guide and its 2008 explanation of the rules don’t say whether a donation appeal counts as commercial. So we recommend the cautious course: treat every email to your list as covered, and follow what the FTC’s CAN-SPAM guide and the Act ask for:

• Accurate “From,” “To” and “Reply-To” details, and a subject line that matches the email.
• Clear notice that it’s an ad or a solicitation, unless the person agreed in advance to get it.
• Your physical address: a street address or a PO box registered with the US Postal Service.
• A way to opt out that works for at least 30 days after you send, with an opt-out-of-all choice if you offer a menu of lists.
• Opt-outs honored within 10 business days, free, with no extra details asked and nothing more than a reply email or a visit to one web page.
• No selling or transferring someone’s address after they opt out.

If an email marketing service sends for you, the FTC says you still “can’t contract away your legal responsibility to comply with the law.”

In Canada, CASL has rules written for registered charities

CASL, Canada’s Anti-Spam Legislation, took effect in 2014. It covers commercial electronic messages (email, texts and direct messages) that encourage participation in a commercial activity “whether or not there is an expectation of profit”, in the Canadian government’s words, and unlike CAN-SPAM it asks for consent first. Registered charities get two rules that make life much easier:

1. Fundraising messages are exempt. CASL’s consent, identification and unsubscribe rules don’t apply to a message sent by or for a registered charity whose primary purpose is raising funds for the charity (section 3(g) of the Electronic Commerce Protection Regulations).
2. Donors and volunteers give you implied consent for two years. Under CASL sections 10(9) and 10(13), a registered charity has it for two years after someone donates, volunteers, or attends a meeting it organized. For an ongoing gift, the two years start when it ends (section 10(14)).

Both are for registered charities under the Income Tax Act, not every nonprofit; a club, association or voluntary organization (as the regulations define one) gets implied consent from its members instead. And the CRTC’s CASL FAQ says a newsletter that advertises a sponsor and encourages readers to take part in a commercial activity with that sponsor may not qualify for the exemption.

For other commercial messages to supporters in Canada, you need consent, and whoever claims it has “the onus of proving it.” Each message needs your name, a mailing address, and a phone number, email address or web address, plus a free unsubscribe that works for at least 60 days and is honored within 10 business days.

In the EU, marketing email to individuals usually needs consent that meets the GDPR’s standard

The rule is in the ePrivacy Directive, Article 13, as each EU country has written it into its own law: direct marketing email to individuals needs their prior consent, with a narrow exception for a seller’s own customers. That consent has to meet the GDPR’s standard: “freely given, specific, informed and unambiguous.”

The GDPR, which has applied since 25 May 2018, reaches an organization outside the EU that offers goods or services to people in the EU, whatever their citizenship, or monitors their behavior there (Article 3).

The texts we read don’t settle whether asking for donations counts as offering services, or whether a charity’s appeal is direct marketing, and national laws differ. So we recommend asking supporters in the EU for consent first, checking the rules where they live, and stopping when anyone objects, which the GDPR lets them do at any time (Article 21).

In the UK, charities have had their own soft opt-in since February 2026

Since 5 February 2026, a UK charity can email people without asking for consent first, under a “soft opt-in” that the Data (Use and Access) Act 2025 added to regulation 22 of PECR, the Privacy and Electronic Communications Regulations. It has three conditions:

1. The email’s sole purpose is to further one or more of your charitable purposes.
2. You got the person’s contact details while they were expressing an interest in those purposes, or offering or providing support for them.
3. You gave them a simple, free way to refuse when you collected the details, and you give them one again in every message.

It’s only for charities as UK charity law defines them, not every nonprofit. The ICO’s guidance adds that it covers only contact details you got directly from the person on or after 5 February 2026, and that you can’t use it to promote other organizations, “including other charities.”

If your nonprofit isn’t a charity, or the soft opt-in doesn’t cover someone, we’d plan on asking for consent. Regulation 22 covers marketing email to individuals, and the ICO says the older soft opt-in, the one for people who bought something from you, can’t be used for not-for-profits’ “campaigning or fundraising, even to existing supporters.”

Do your research on other states and countries (California’s CCPA generally doesn’t apply)

These are a few of the laws, regulations and guidelines on email compliance around the world, and our explanations are summaries, so check the rules wherever your nonprofit’s supporters live. One you can usually set aside is California’s CCPA: the California Attorney General says “The CCPA generally does not apply to nonprofit organizations or government agencies,” with two exceptions in the law.

Can nonprofits share email lists?

Sometimes, but less freely than you might hope. In the US, the rule CAN-SPAM spells out is about opt-outs: once someone opts out of email the Act covers, you can’t sell or transfer their address, “even in the form of a mailing list,” says the FTC’s guide, except to a company you’ve hired to help you comply. Elsewhere, the way we read the laws, consent belongs to the relationship between a supporter and the organization they gave it to, so it doesn’t travel with a shared email list.

• US: beyond the opt-out rule, neither the Act’s requirements nor the FTC’s guide limits sharing. That doesn’t settle it: state law, contracts and your own privacy policy may, and we haven’t researched those.
• Canada: consent comes from the sender’s own relationship with the person, so a list from another organization doesn’t bring consent to you unless the original request covered you.
• EU: handing over a list needs its own lawful basis under the GDPR, and people have to be told the “recipients or categories of recipients” of their data (Article 13).
• UK: the ICO says “There is no such thing as a third-party marketing list that is ‘soft opt-in compliant’.”

Our recommendation: before you share or accept an email list, check what each person agreed to, and never include anyone who opted out. If you can’t tell what they agreed to, don’t share it.

Best practices on email compliance for nonprofits

The commercial email regulations won’t always apply to your nonprofit, but most of the email legal guidelines above double as best practices for email compliance. We recommend these guidelines for every email you send your supporters, from a fundraising appeal to a newsletter.

Use an opt-in protocol

Nonprofit emails work best when the people reading them chose to get them. Ask supporters to opt in with a box they tick themselves, and keep a record of when and how each person signed up. The CRTC’s FAQ says “You cannot use a pre-checked box to request consent from a consumer as it assumes consent,” and a GDPR recital says pre-ticked boxes aren’t consent either.

Even better, use double opt-in, where people confirm their address before joining your email list. No law above requires it, but it’s one of our tips for avoiding spam traps.

Provide an unsubscribe option

There may come a time when supporters no longer want your emails. It’s sad to see them go, but letting them unsubscribe matters, for email legal guidelines and for their trust. Put a clearly visible unsubscribe link in the footer of every marketing email.

The link can also open a page where people choose what they get: they may not want your newsletter but still want to hear about donation opportunities. Just include the opt-out-of-all choice we covered above.

Is an unsubscribe link a legal requirement? CAN-SPAM and CASL require a way to opt out in the email they cover, and a footer link is the easy way to give one (a reply address also counts under CAN-SPAM, and an email address under CASL). The UK charity soft opt-in needs a way to refuse in every message, and Google’s email sender guidelines and Yahoo’s sender best practices ask bulk senders for one-click unsubscribe in marketing email.

Write subject lines that reflect the email content

Never mislead supporters in your subject lines; it’s one of the easiest guidelines here to follow. If your subject line says “October Happenings at Our Nonprofit” but the email is a call for donations, it harms your nonprofit’s integrity and makes supporters less likely to trust you (and open your emails).

State why they’re receiving your email

It’s easy to forget which email lists you’ve joined, and your supporters may not remember signing up for yours. So remind them with a line in the footer, as simple as, “You are receiving this email because you subscribed to our newsletter.” No law or guideline above asks for it, but it reminds people they chose to hear from you.

Clearly identify yourself

If your supporters have opted in, they want to hear from you! Don’t leave them wondering who sent the email: name your nonprofit early in the message. And to follow the email legal guidelines above, put your physical address in the footer, plus a phone number, email address or web address for supporters in Canada.

Link your privacy policy

When supporters give you personal details, from an email address to card details on a donation form, they want to know those details are safe. A privacy policy link in the footer of marketing emails tells them you take that seriously. It’s our recommendation rather than a rule we found in the laws above.

How do transactional emails fit into email compliance?

Your nonprofit’s WordPress site sends emails on its own, too: donation receipts, form confirmations, password resets. The email legal guidelines and best practices above are mostly about marketing email, and whether one of these counts as transactional email in the legal sense depends on what it’s for and what it says. Here’s how transactional and marketing email differ.

Under CAN-SPAM, a purely transactional email, such as one confirming “a commercial transaction that the recipient has previously agreed to enter into,” is exempt from most of the Act, though its routing information still has to be accurate. Is a donation receipt one of those? The Act, the FTC’s regulations and guide, CASL and the CRTC’s FAQ don’t say.

Whichever way that question goes, one email compliance habit holds: keep promotions out of your receipts and confirmations. Under the FTC’s regulations, a promotion in a transactional email can make it commercial, for example when the subject line points to it or the transactional content doesn’t come first. And in the UK, the ICO says “if you add advertising or marketing material the message becomes direct marketing.”

Make sure your receipts and confirmations arrive

These are also the emails that most need to arrive. Email sent straight from a web server is often unauthenticated, blocked or filtered to spam, and you usually hear about it from the donor whose receipt never came.

That’s the problem we built SendWP for, and it’s what we’d suggest for your receipts and confirmations. SendWP is a paid transactional email service for WordPress: once it’s connected, the email your WordPress site sends goes out through SendWP instead of your web host, and it helps you set up domain authentication. If you take donations with GiveWP, here’s how to connect GiveWP to SendWP.

One thing to know if you do: SendWP puts a one-click unsubscribe link at the bottom of every email it sends, donation receipts included, and a donor who clicks it on a receipt stops getting their receipts. If a donor tells you their receipts stopped, ask whether they clicked it. If they did, they can contact SendWP from that same email address, name your site’s domain, and we’ll resubscribe them.

Follow email legal guidelines for great supporter relationships

Email compliance can feel like red tape for a small nonprofit, but email guidelines aren’t just rules. Instead, they’re a clear path to building and maintaining strong relationships with your supporters. Give them clarity, security and the freedom to choose what they get from you, and donors and volunteers find it easier to trust you.

You can now work out which email legal guidelines reach your list in the US, Canada, the EU and the UK, use the charity rules if they’re yours, and take the cautious course where the sources don’t settle a question. We’re not lawyers, so when a complaint, a regulator’s letter or a big list swap is on the table, get a lawyer’s read.

And for the receipts and confirmations your WordPress site sends, we’d suggest SendWP. It’s a paid service, and SendWP has a nonprofit discount: apply for it here.