Common startup email marketing questions, answered

When is an email address really a marketing contact?

An email address is a marketing contact only when the sender has a defensible basis for promotional use and can explain what the person expected. A receipt, support request, security alert, or research exchange does not establish marketing permission on its own.

Sort contacts by destination, recipient type, relationship, and purpose before selecting a campaign. Keep account service, billing, research participation, and promotional subscriptions as separate use cases. A California-specific targeting perspective and this permission-first overview can help teams keep those decisions distinct.

What should a usable permission record show?

A useful record shows how and when an address was collected, what the person was told, which organization was named, and how preferences have changed. Keep those details connected so the team can explain why someone entered a particular audience, rather than treating a stored address as blanket approval.

The ICO bought-list guidance says consent should identify the organization and method, meet the applicable standard, and be recorded. Treat this as UK guidance, not a worldwide rule. Promotional promises should also align with substantiated claims, not an unrelated service interaction.

Which rules matter when recipients live in different places?

The starting requirements vary with the recipient's location and type. US commercial email generally follows an opt-out model, Canada requires express or implied consent, and UK PECR distinguishes individual subscribers from corporate subscribers. These are starting points for routing decisions, not permission to ignore the details of a campaign.

Use the comparison to route each audience to the relevant current regulator guidance. For US campaigns, consult the federal CAN-SPAM Act, which the Federal Trade Commission enforces. For Canadian recipients, the law is Canada's Anti-Spam Legislation, known as CASL, and the Canadian Radio-television and Telecommunications Commission (CRTC) leads enforcement. In the UK, the Privacy and Electronic Communications Regulations (PECR) apply, enforced by the Information Commissioner's Office.

CASL separates express consent from implied consent. Implied consent can rest on an existing business relationship, for example a purchase within the previous two years or an inquiry within the previous six months, and each message must identify the sender and carry a working unsubscribe mechanism. Confirm the details with the CRTC's guidance before relying on either basis. Do not assume a rule carries across borders or that one organization's permission covers another sender; record the basis for each segment.

Can an imported address be used at all?

Only if the source and permission can be checked. Before using an upload, review the collection wording, named organization, channel, date, method, recipient category, objections, and suppression history. A supplier's assurance is not a substitute for evidence that the sender can inspect and retain.

If any part of that history is missing, pause the import rather than treating possession of the address as approval. Ask whether the person expected messages from this sender for this purpose, and whether later objections or preference changes are reflected. Keep this review separate from decisions about service messages and research contact.

What do sender-authentication settings actually establish?

SPF, DKIM, and DMARC help receiving systems assess sender authorization and domain alignment. They do not establish that a recipient agreed to receive marketing, so technical authentication cannot replace permission evidence or make an otherwise ineligible contact suitable for a campaign.

Give a qualified technical owner responsibility for configuration and monitoring, and maintain an inventory of sending domains and providers. Provider instructions can support the work, but the startup still needs oversight of its own setup and audience choices. Authentication settings and permission records answer different questions and should remain distinct.

What must happen after someone opts out?

A commercial marketing message needs a working way to unsubscribe, and the request must be honoured without a fee or a demand for more than an email address.

Under CAN-SPAM the deadline is 10 business days from the request, and the opt-out mechanism must keep working for at least 30 days after the message is sent. CASL also allows 10 business days for an unsubscribe request. Do not treat 10 days as a target, because sending after the person has asked to stop is the risk. Update the preferences used for later campaigns, including when a provider handles the sending.

Keep promotional material out of messages that are only transactional, such as receipts or security alerts, and do not make account or service access depend on marketing acceptance. If a campaign includes a creator recommendation, the FTC endorsement guidance is a separate issue from processing an unsubscribe.

Which campaign signals deserve attention?

Do not use opens alone to judge a campaign. Privacy protections and automated loading can distort that measure, while attribution can miss cross-device or offline decisions. Read delivery health, complaints, unsubscribes, clicks, meaningful site or product actions, business outcomes, and cost against the objective set before sending.

Before a test or survey, define the outcome that matters, the audience and message involved, and how results will be recorded. Use acquisition benchmarks alongside marketing metrics to frame campaign outcomes without letting a single measure stand in for the whole result.

How often should a startup send?

No law in the United States, Canada or the UK sets a maximum sending frequency, but consent covers what the person agreed to. If the sign-up promised a monthly newsletter, weekly promotions go beyond it. State the expected cadence at sign-up, then watch complaints and unsubscribes after every change.

Gmail's sender guidelines ask senders to keep reported spam rates below 0.10% and never reach 0.30%. The stricter requirements, including one-click unsubscribe processed within two days, apply to senders above about 5,000 messages a day to personal Gmail accounts. Check Google's current guidelines before a large send.

What do email providers handle, and what stays with the startup?

An email service provider delivers the messages and usually supplies the unsubscribe link, bounce handling and DKIM signing keys. It does not decide who may be emailed. The FTC's CAN-SPAM guide says a company cannot contract away its legal responsibility by hiring another firm to send its email.

So the startup stays accountable for the audience, the content and honoring opt-outs. Review the provider's acceptable-use policy and whether suppressions sync across tools. For UK or EU recipients, put a data-processing agreement in place with the provider.

What records should remain after a send?

Retain enough evidence to explain who was eligible, which permission or rule applied, and how each person's choice changed. A clear record connects the campaign with its audience and lets the team review decisions later, instead of relying on memory or a provider's summary.

Double opt-in can strengthen address confirmation, but it does not settle the purpose, named sender, market, recipient type, collection wording, or later withdrawal. Use the market research checklist to reinforce the practice of defining evidence before activity begins, and keep personal information connected to its source.

What is the first thing to do?

Start by sorting contacts by destination, recipient type, and relationship, then check the applicable rule and supporting evidence before sending. Assign owners for authentication, withdrawal requests, and measurement; a provider can help with these tasks, but the startup remains responsible for its audience decisions.