A Letter Worth Reading

On writing business newsletters people open

Grow · 4 min read

Building a list with consent

A list of people who asked to hear from you is worth more than any list you could buy. Here is how consent works in the US, Australia, the UK and the EU, and how to earn it.

The best mailing lists are built one yes at a time.

The short version

  • Consent means a person has said yes to getting your emails.
  • Australia, the UK and the EU want consent before you send. The US mainly wants an easy way out.
  • Use a clear sign-up form, confirm each address, and keep a record.
  • Never buy a list. It breaks the rules in many places, and it never works well.

A list is a set of yeses

We think of a mailing list as a stack of small yeses. Each one is a person who said, "Yes, I'd like to hear from you."

That is what makes a list worth having. A person who asked for your letter is far more likely to read it. A stranger is more likely to delete it, or mark it as spam.

Here is the whole journey, from sign-up to goodbye.

Five steps in the life of a subscriber: signs up, confirms by clicking a link, gets a welcome saying what to expect, reads regular issues with an unsubscribe link, and one day leaves easily.
The life of a subscriber, from sign-up to goodbye.

This page covers the first three steps. The last step, leaving, has its own page.

In the EU, consent under the main privacy law must be specific, freely given, plainly worded and clear.[1] A form with a box that is ticked for you does not count.[1]

In plain words, the person has to choose. They have to know what they are choosing. And nobody can choose for them.

The rules differ by country

Which rules apply depends on where you and your readers are. Here is a short guide. It is not legal advice, so check the rules for your own case.

Three boxes. United States: no opt-in needed under CAN-SPAM, but every email needs an opt-out. Australia: consent first, express consent is best, inferred only in narrow cases. UK and EU: specific consent first, with a small exception for past customers who were offered an opt-out.
Consent rules in brief. The US asks for a way out; Australia, the UK and the EU ask for permission first.

United States. The CAN-SPAM Act does not require people to opt in. It requires an easy way to opt out.[2] We still advise asking first. It makes for a better list.

Australia. Under the Spam Act, you must have consent before you send marketing email.[3] There are two types: express and inferred.[3] Express consent means the person knows and accepts that you will email them. The regulator, ACMA, calls it best practice.[3]

ACMA's Avoid sending spam page, explaining the two types of consent under Australia's Spam Act: express and inferred.
Australia's regulator, ACMA, explains express and inferred consent. Screenshot: Australian Communications and Media Authority, captured 2026-10-18.

Inferred consent is narrow. It usually needs an ongoing relationship, such as a membership, and mail closely tied to it.[3] A single purchase is not enough on its own.[3]

United Kingdom. You must not send marketing email to individuals without specific consent.[4] There is a small exception for your own past customers, called the soft opt-in.[4] It only works if you offered a clear way to opt out. You must offer it when you take their details, and in every message.[4]

The UK ICO guide to electronic mail marketing. Its summary says you must not send marketing emails or texts to individuals without specific consent, with a limited exception for previous customers called the soft opt-in.
The UK ICO sums up the email marketing rule, with its soft opt-in exception. Screenshot: UK Information Commissioner's Office, captured 2026-10-18.

The UK regulator, the ICO, notes this guidance is under review after a recent change in the law.[4] Check its page for updates.

European Union. EU rules set up an opt-in system. Marketing emails can only go to people who agreed first.[5]

A sign-up form that earns trust

A good form does three things. It says what people will get. It asks for very little. And it leaves the choice to them.

A sign-up form for a monthly garden letter. It says one email a month, asks only for an email address, and has a box that starts empty. Below: send a confirm link and keep a record of who signed up, when and how.
A good form says what people will get, asks for little, and leaves the choice to them.
  • Say what and how often. "One email a month with planting tips and shop news" is clear.
  • Ask only for what you need. An email address is usually enough.
  • Leave the box empty. The ICO advises opt-in boxes wherever possible.[6] A box ticked for the reader is not a real choice.

Express consent can come from a form, a ticked box, a phone call or a chat in person.[3] If someone signs up at your counter, write it down then and there.

One thing you can't do: send an email to ask for consent. In Australia, that email is itself a marketing message.[3]

Confirm each address

A confirmed opt-in, also called double opt-in, adds one step. After someone signs up, you send an email asking them to confirm. They click a link, and only then are they on the list.

This checks that the address really belongs to them.[2] It also stops someone signing up a friend as a joke, or to cause harm.[2]

Both Gmail and Yahoo ask for this. Gmail says to make sure people opt in and to confirm each address.[7] Yahoo says to send an email asking new subscribers to confirm.[8]

Gmail's sender guidelines under Make it easy to subscribe: make sure recipients opt in, confirm each recipient's email address, and periodically check they want to stay subscribed.
Gmail's advice on sign-ups: opt in, confirm the address, check in now and then. Screenshot: Google, Email sender guidelines, captured 2026-10-18.

Keep a record

Write down who signed up, when and how. ACMA asks for exactly that.[3] In Australia, it is up to you to prove consent.[3] The ICO also asks for clear records.[6]

Most email tools keep this for you. Check that yours records the date and the form used.

Never buy a list

A bought list is a list of people who never said yes to you. In Australia, you are still responsible for consent for every address you use.[3] Lists made with address-harvesting software, which scrapes addresses from the web, are banned outright.[3]

In the UK, a bought list can only be used if everyone on it agreed to hear from you in particular.[6] General consent to "partners" is not enough.[6] The soft opt-in does not cover bought lists either.[4]

In the US, harvesting addresses can even lead to criminal penalties in some cases.[9]

Besides, a bought list doesn't read your letter. It ignores it, or reports it as spam.

What to do next

Look at your sign-up form today. Does it say what and how often? Is the box empty? Is each address confirmed? Fix what's missing.

Then make sure every issue has a working way out. Read Unsubscribes and the law.

Sources

  1. General Data Protection Regulation, Wikipedia (accessed 2026-10-18)
  2. Opt-in email, Wikipedia (accessed 2026-10-18)
  3. Avoid sending spam, Australian Communications and Media Authority (accessed 2026-10-18)
  4. Electronic mail marketing, UK Information Commissioner's Office (accessed 2026-10-18)
  5. ePrivacy Directive, Wikipedia (accessed 2026-10-18)
  6. Using marketing lists, UK Information Commissioner's Office (accessed 2026-10-18)
  7. Email sender guidelines, Google (Gmail Help) (accessed 2026-10-18)
  8. Sender Best Practices, Yahoo (accessed 2026-10-18)
  9. CAN-SPAM Act: A Compliance Guide for Business, US Federal Trade Commission (accessed 2026-10-18)