Legal email marketing: privacy consent and firm controls

What to take away

This article focuses on privacy consent and firm controls for legal email marketing. It explains how to record a recipient's choice, make withdrawal easy, and review messages, replies, and workflows against rules that vary by jurisdiction. The firm's audience and facts determine which requirements apply. Learn more about legal email marketing.

Apply the operating standard

In the UK, the Information Commissioner's Office (ICO) enforces the Privacy and Electronic Communications Regulations (PECR). UK GDPR also applies to personal data used in direct marketing. The ICO's electronic mail marketing rules explain consent, the soft opt-in, business contacts, purchased lists, transparency, and withdrawal.

In the United States, CAN-SPAM requires accurate headers, honest subject lines, a clear opt-out, and a postal address; state privacy laws add notice and rights in some cases. In Canada, CASL requires express or implied consent, identification, and a working unsubscribe mechanism. These rules differ from PECR and from each other, so local counsel is needed.

U.S. lawyer marketing also needs professional-conduct review. ABA Model Rules of Professional Conduct 7.1–7.3 address communications about legal services, advertising, and solicitation, but they are models, not binding rules by themselves. Identify the rules adopted by the jurisdictions that regulate the lawyer, and assess whether the particular message is advertising or solicitation under those rules. For example, California lawyers should check California Rules of Professional Conduct 7.1–7.3; the California Supreme Court adopts those rules, and the State Bar of California administers lawyer discipline.

State privacy-law examples include California’s Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA); Virginia’s Consumer Data Protection Act (VCDPA); and the Colorado Privacy Act. The California Privacy Protection Agency and California Attorney General enforce the CCPA; the Virginia and Colorado Attorneys General have enforcement authority under their respective laws. Applicability depends on each statute’s scope and exceptions and the firm’s activities and data—not merely the recipient’s state.

Make consent specific, provable, and easy to withdraw

Start by matching the consent path to the recipient's jurisdiction and the kind of message. The GDPR consent standard applies where consent is the basis for processing; it is not a universal opt-in rule for every U.S. marketing email.

Under the EU GDPR, consent must be freely given, specific, informed, and unambiguous (Article 4(11)). Article 7 requires the organization to be able to demonstrate consent and let the person withdraw it at any time; withdrawal must be as easy as giving consent. The UK GDPR has comparable consent requirements.

Use an unticked box and a clear affirmative action. GDPR Recital 32 says silence, pre-ticked boxes, and inactivity do not constitute consent. Offer separate choices for distinct purposes or topics when the recipient should be able to choose them independently; do not treat consent to one purpose as consent to another.

Double opt-in is a recommended best practice: after signup, send a confirmation request and add the address to the marketing list only after the recipient confirms. It can strengthen evidence and address accuracy, but it is not universally required and cannot fix a misleading or overly broad signup request.

The UK soft opt-in under PECR is narrow. It can apply when a firm obtained contact details during a sale or negotiations for a sale, markets its own similar products or services, and gave the recipient a chance to refuse marketing both when collecting the details and in each message. Do not treat it as permission to market unrelated services or as a general exception for purchased lists.

For commercial email covered by CAN-SPAM, prior opt-in consent is generally not required, but the message must provide a clear way to opt out, include the sender's valid physical postal address, and honor an opt-out within 10 business days. As a practical best practice, put a working unsubscribe link in every marketing email and process requests promptly rather than waiting for the legal limit.

Under CASL, confirm express consent or document the basis for any valid implied consent before sending. Include identification and a working unsubscribe mechanism in each commercial electronic message, and process an unsubscribe request within 10 days. Keep suppression records so an opt-out is respected across campaigns and vendors.

A legal email marketing checklist can help turn these practices into a firm-specific workflow.

Example notice wording: 'You asked for updates from [Firm] about [topics]. We send about [frequency]. Unsubscribe or change topics at any time.' Adapt the wording to the actual request and applicable rules. A record set can hold source URL, notice version, timestamp, consent scope, form text, and withdrawal date; keep the notice and record together so a reviewer can see what the recipient was asked to accept.

M3AAWG's collection of sender and service-provider practices addresses authentication, communication with mailbox providers, list practices, vetting, complaints, and abuse prevention. These industry resources support operations but do not replace legal or professional review.

Review growth by cohort. A form, event, acquisition source, or partner that produces complaints, weak fit, or unprovable permission should be paused even if it adds many addresses. The healthy unit is a reader relationship the firm can explain and serve.

Test the entire recipient experience quarterly, from signup through preference change and full withdrawal. Include mobile views, replies, forwarded copies, blocked images, old automations, and records returned by each vendor. Track complaint rate by campaign. Use under 0.1 percent as an internal working target and 0.3 percent as a warning line, not as universal legal limits; check the relevant mailbox provider's current guidance.

Assign owners and review cadence

The NIST Privacy Framework starting guide outlines a voluntary process for identifying and managing privacy risk. Use it to assign owners for legal email marketing permission records and withdrawal requests; it is not a permission rule or legal clearance.

The CISA business-system logging guidance explains how event records support security review. For an email program, preserve relevant access, change, failure, and correction records for the firm's marketing systems; logging supports review but does not validate consent or a marketing metric.

Turn each permission and withdrawal practice into an owner, cadence, input, output, acceptance test, and correction path. Observe the work during a normal reporting cycle and during one controlled failure. Keep the result with the metric definition and decision record. A written policy has little value when access changes, source defects, and disputed conclusions leave no trace that another reviewer can follow.

For a firm whose California lawyers send marketing email to California recipients, assign the marketing-operations lead to maintain the audience map and evidence of the notice, approved permission path, and suppression. Designated California counsel should review whether the CCPA applies and assess each campaign under California Rules of Professional Conduct 7.1–7.3 before launch and when the audience, offer, or template changes. Document a quarterly test: verify that a test signup preserves the notice shown and the selected permission path, a sample message has passed sender, claim, advertising, and solicitation review, and a withdrawal is reflected in the suppression list and downstream vendors. Pass only when the evidence for all three checks is retrievable. This control documents the firm’s chosen legal path; it does not assume that the CCPA creates a universal email opt-in requirement.

Set the next review date for legal email marketing best practices and name the changes that would trigger an earlier check, such as a change to the signup notice, audience, or withdrawal process. Record rejected options and the chosen path because the original constraint may later change.

Use the same definitions in the interface, export, meeting note, and correction log.

Common questions

Is double opt-in always required?

Requirements vary, but confirmation can strengthen address accuracy and evidence. It does not cure a misleading request.

Should every email contain several calls to action?

Usually choose one main action and include secondary links only when they serve a distinct reader need.

Can automation replace review?

Automation can enforce approved logic, but changing law, services, sources, audiences, and incidents require human judgment.