--- title: "Does AI-written marketing email still need consent?" description: "AI-written marketing email still needs consent. The rules in the US, EU, UK and Canada, Gmail and Yahoo bulk sender rules, and where AI agents go wrong." url: https://www.unitpost.com/blog/agents/ai-marketing-email-consent section: Blog updated: 2026-11-02 --- # Does AI-written marketing email still need consent? Yes. Consent rules care about who receives a marketing email, not who or what wrote it. The EU and UK need prior consent, with a narrow exception for existing customers; Canada needs express or implied consent; the US doesn't require opt-in but does require a working opt-out and a postal address. Gmail and Yahoo add one-click unsubscribe and a spam rate under 0.3% for bulk senders. ## Does AI-written marketing email still need consent? > AI-written marketing email still needs consent. The rules in the US, EU, UK and Canada, Gmail and Yahoo bulk sender rules, and where AI agents go wrong. An agent can write a campaign in a minute and send it in another. The speed is new; the rules aren't. Every consent law below asks who receives the email and whether they agreed, and none of them asks whether a person or a model wrote it. ### What does each law require? - United States (CAN-SPAM). No opt-in is required in general. Each message needs accurate headers, a subject that doesn't mislead, identification as an ad, a valid physical postal address and a clear way to opt out, and an opt-out must be honored within 10 business days. The FTC lists penalties of up to $53,088 per email (FTC compliance guide (https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)). - European Union (ePrivacy Directive, Article 13). Marketing email to individuals needs their prior consent. The exception: a business that got a customer's address in a sale may market its own similar products, if the customer could object when the address was collected and can object in every message (Directive 2002/58/EC (https://publications.europa.eu/resource/celex/02002L0058-20091219)). - United Kingdom (PECR, regulation 22). The same rule: prior consent, with a "soft opt-in" for your own similar products sold or negotiated with that person, and a refusal offered at collection and in every message. Since 5 February 2026 charities have a soft opt-in of their own (PECR regulation 22 (https://www.legislation.gov.uk/uksi/2003/2426/regulation/22)). - Canada (CASL). Consent is required. Express consent lasts until it's withdrawn; implied consent covers cases such as an existing business relationship, for up to two years (six months after an inquiry). Each message identifies the sender with a mailing address and a contact method, and an unsubscribe must be actioned within 10 business days (Government of Canada (https://ised-isde.canada.ca/site/canada-anti-spam-legislation/en/getting-consent-send-email)). > **NOTE:** This is a summary of the rules as published, not legal advice. Your list, your country and your recipients' countries decide which apply. ### What do Gmail and Yahoo add? The mailbox providers enforce their own rules, whatever the law allows: - Gmail counts you as a bulk sender once you send close to 5,000 messages a day to personal Gmail accounts, and the status is permanent. Bulk senders need SPF, DKIM, DMARC and an aligned From; marketing mail needs one-click unsubscribe (RFC 8058), and a mailto link in the body doesn't count; the spam rate must stay under 0.3% (Gmail sender guidelines (https://support.google.com/mail/answer/81126)). - Yahoo publishes no volume threshold. It asks for the same authentication, a one-click List-Unsubscribe header on marketing mail, unsubscribes honored within 2 days, and a spam rate under 0.3% (Yahoo sender best practices (https://senders.yahooinc.com/best-practices/)). Mail an unconsented list and complaints come fast: a few people per thousand clicking "Report spam" is all 0.3% takes. ### Where do AI agents go wrong? Not in the writing. In three steps around it: - Building the list. "Find 200 CTOs at fintech startups and email them" is cold outreach, whatever the model's copy says. The people never agreed, so in the EU, UK and Canada there's no consent to rely on, and in the US the complaint rate does the damage instead. - Reusing a list for something new. A customer who agreed to product updates didn't agree to a partner's offer. Keep separate topics, and have the agent send only to the topic the mail is about. - Skipping the opt-out. An agent that sends marketing through a transactional endpoint, one message at a time, can leave out the unsubscribe link and header that a campaign would add. ### How does Unitpost enforce this? - The rules are in the terms. The Acceptable Use Policy prohibits cold outreach (unsolicited sales, prospecting or partnership email, B2B included) and scraped, bought or rented lists on every plan, and the MCP server's instructions tell agents the same. - Every marketing email carries an unsubscribe. A send in the marketing category always gets the footer link and the `List-Unsubscribe` and `List-Unsubscribe-Post` headers, and a template save that drops the unsubscribe link is refused. - One-to-many marketing goes through campaigns. A marketing send to more than one recipient on the transactional API is refused with `422`, because each recipient needs their own unsubscribe link. - Topics. Contacts opt out of one topic, such as product updates, and keep receipts and other topics. An agent can still draft, segment and schedule the campaign. The part that stays with a person is deciding who agreed to hear from you, and an approval step before anything one-to-many goes out (how (/blog/agents/ai-agent-approval-before-send)). ## FAQ ### Can an AI agent find leads and email them? Finding addresses is where consent breaks: people whose addresses an agent collected from the web never agreed to hear from you. In the EU, UK and Canada that mail needs consent you don't have, and on Unitpost cold outreach and scraped or bought lists are prohibited on every plan, B2B included. ### Does CAN-SPAM require opt-in? Not in general. It requires accurate headers, an honest subject line, a valid postal address, a clear way to opt out, and opt-outs honored within 10 business days. Each violating email can cost up to $53,088. ### Is a customer's email address enough to send them marketing? Sometimes. The EU and UK allow marketing your own similar products to existing customers whose details you got in a sale, if you offered an opt-out when you collected them and in every message. Canada implies consent from an existing business relationship for up to two years. Outside those, ask. ### Does the AI need to be disclosed in the email? The consent rules above don't ask. They ask who sent it: the sender has to be identified, the From and headers must be accurate, and the subject must not mislead, whoever drafted the text. ## Related - [Which API key permissions does an AI agent need?](https://www.unitpost.com/blog/agents/api-key-permissions-for-ai-agents): The smallest API key for each AI agent job, from sending receipts to running campaigns, what no key can ever do, and the 403 a missing permission returns. - [Gmail, Yahoo and Microsoft bulk sender requirements](https://www.unitpost.com/blog/deliverability/bulk-sender-requirements-gmail-yahoo-microsoft): What Gmail, Yahoo and Outlook.com require from bulk senders: SPF, DKIM, aligned DMARC, one-click unsubscribe and a spam rate under 0.3%. - [Can an AI agent have its own email address?](https://www.unitpost.com/blog/agents/can-ai-agents-have-email-address): Three ways to give an AI agent an email address: a person's mailbox, an inbox-per-agent product, or your own domain with inbound routing and a send API.