Sample Email Marketing Privacy Policy Template

Last updated on 10 January 2022 by William Blesch (Legal and data protection research writer at TermsFeed)

Sample Email Marketing Privacy Policy Template

As email marketing continues to increase in popularity (a well-planned email marketing campaign can return $38 per $1 spent), it is more important than ever for companies to ensure that they are respecting the privacy of their customers.

The same privacy laws that cover a company's data collection, use, storage, security, sales, sharing, and deletion in regards to websites and overall marketing practices, and which are proliferating worldwide in an effort to protect consumer privacy, also impact a company's email marketing practices.

With that in mind, if you're one of the many marketers or business owners who invest heavily in email marketing, you are legally required to have a Privacy Policy that outlines what you do with your subscribers' personal data.

Neglecting to follow legal requirements can lead to severe penalties.

In this article, we'll go over why a Privacy Policy with relevant email marketing clauses is necessary and give relevant examples along the way.

We'll also provide a sample email marketing Privacy Policy template so that you can get a clear idea about what's necessary to comply with industry guidelines and best practices.

Our Privacy Policy Generator makes it easy to create a Privacy Policy for your business. Just follow these steps:

  1. At Step 1, select the Website option or App option or both.
  2. TermsFeed Privacy Policy Generator: Create Privacy Policy - Step 1

  3. Answer some questions about your website or app.
  4. TermsFeed Privacy Policy Generator: Answer questions about website - Step 2

  5. Answer some questions about your business.
  6. TermsFeed Privacy Policy Generator: Answer questions about business practices  - Step 3

  7. Enter the email address where you'd like the Privacy Policy delivered and click "Generate."

    TermsFeed Privacy Policy Generator: Enter your email address - Step 4

    You'll be able to instantly access and download your new Privacy Policy.

If you press the rewind button and go back in time a bit, you might remember that email marketing wasn't much more than direct mail-lite in the past. By and large, it was just a bunch of, "Hello, so and so, please buy our stuff."

Fast forward to today, and email marketing has become a lot more sophisticated. Of course, it's still all about getting people to buy "stuff," but really, the entire process has become a way for companies to collect more data, refine their marketing campaigns, and increase ROI.

For instance, you can use email to collect information, such as missing demographic data. You can also learn more about your subscribers' devices using web beacons or track your subscriber's online activities when they open emails and click links.

In fact, you can use the email marketing process to collect much of the same kinds of data as your website or app gathers. Because of that, there is an intrinsic danger to your subscriber's privacy.

Why Clauses for Email Marketing Should Be in Your Privacy Policy

Why Clauses for Email Marketing Should Be in Your Privacy Policy

Numerous laws govern what businesses can do with the personal data of their users, and email addresses are considered personal data. Running afoul of these laws can result in significant fines such as the $57 million Google GDPR fine for the inappropriate processing of user data.

At the heart of most data processing laws is consent, and it isn't enough to simply inform subscribers that you ​send emails to consenting recipients.

As previously mentioned, the process of email marketing involves many of the same kinds of personal data collection as other types of marketing practices. Thus, email marketing will likely need to show up repeatedly in your Privacy Policy.

For instance, some of the clauses where you should mention email marketing include the following:

  • What personal information you collect
  • How you collect personal information
  • Why you collect personal information
  • How long you store personal information
  • How you secure personal information
  • Under what circumstances you share personal information
  • With whom you share personal information (if you share)
  • Automatic data collection methods and cookies
  • A separate email marketing clause (for information on unsubscribing and opting-out)

The bottom line for the moment is that your email marketing campaign should have its own section in your Privacy Policy. Transparency is critical, and being as forthcoming about collecting and processing data like email addresses is essential.

You can't presume that just because someone is aware of one of your marketing activities, and has given consent for data collection in connection with it (i.e., "send me that free report"), that their consent encompasses every other email marketing activity in which you engage (i.e., promotional emails).

What Laws Govern Email Marketing Practices?

What Laws Govern Email Marketing Practices?

Different laws govern email marketing in different countries. The most important ones are Europe's General Data Protection Regulation (GDPR), The California Online Privacy Protection Act (CalOPPA), the CAN-SPAM Act of 2003, and Canada's Anti-Spam Legislation (CASL).

Each of these laws regulates the manner in which you:

  • Collect email addresses
  • Store email address
  • Request consent to collect and process email addresses
  • Share email addresses
  • Delete email addresses

Additionally, these laws apply to all the other personal information you collect.


The California Online Privacy Protection Act (CalOPPA) is the first comprehensive law in the United States to require commercial websites and online services to post a Privacy Policy.

CalOPPA requires that any person or company whose website collects personally identifiable information from Californian consumers must feature a conspicuous Privacy Policy stating exactly what information is collected and with whom it is shared. This includes tracking of online visits for marketing purposes.

The law applies to email marketing because it requires:

  • A Privacy Policy, and
  • Transparency about what kinds of personal data your app or website collects

To comply with the law's requirements, it's necessary for you to include a statement within your Privacy Policy that you collect email addresses and whether you share them with third parties or not.

You must also ensure that you provide subscribers with a means of opting out of your email marketing campaigns.

The CAN-SPAM Act of 2003

The CAN-SPAM Act establishes regulations for commercial email, including what information must be included in an email message, the types of messages that are prohibited, and how to unsubscribe from commercial emails.

The CAN-SPAM Act was passed in response to concerns about the increasing amount of spamming and other deceptive marketing practices. The law establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violators.

To be more specific, CAN-SPAM contains seven requirements that marketers must adhere to in order to avoid unsolicited email spamming.

  • Be honest and transparent in your header (including from, to, and routing information)
  • Do not be deceptive in your subject lines
  • Disclose the email as an advertisement
  • Provide your physical postal address in the body
  • Give instructions for opting out
  • Honor opt-out requests within ten business days
  • Ensure processors or third parties comply with CAN-SPAM

Of these CAN-SPAM requirements, only the fifth actually has any bearing on your Privacy Policy. You'll need to provide information about how subscribers can opt-out in your Privacy Policy and your emails themselves.


CASL, or Canada's anti-spam legislation, protects consumers and businesses from misusing digital technology, including spam and other electronic threats. It also aims to help companies stay competitive in a global, digital marketplace.

CASL covers "Commercial Electronic Messages" (CEM), which is a bit broader than simply applying to emails. For example, it also covers instant messages, text messages, and social media messages that are related to commercial activities.

CASL, like the GDPR, touches on consent. You must meet the requirements for implied consent, such as (making a purchase, donation, gift, providing volunteer time or resources, providing an email address, or publishing an email address).

If you do not meet the conditions of implied consent, you must obtain express consent from subscribers. This requires either a written agreement or an oral agreement from the subscriber stating that they consent to receive digital communications from your business.


The GDPR is a privacy and security law passed in the EU. It affects companies outside of the EU, so long as they target or collect data related to people there.

The GDPR protects your customer's personal information from mishandling by businesses collecting private data. Personal Data under the GDPR refers to any piece of information that could be used personally (e.g., name, I.D. numbers, location details), which can identify someone either on its own or when put together with other pieces of data (like their website browsing history or email address).

However, the regulation covers more than just email addresses; it applies to all types of electronic communication.

With that said, email marketers have to understand that they must abide by super strict consent requirements if they're doing business within the E.U.

The GDPR states that any consent given must be "clear, affirmative actions." In other words, your subscribers only consent when they take a positive action, such as clicking an appropriately worded link or ticking a box.

You must also pay particular attention to your data processing efforts since you can only collect email addresses when the following criteria are met:

  • You must have a specific and lawful reason for processing personal information
  • You must only use personal information for the reasons you state within your Privacy Policy
  • You must provide a way for subscribers to update and remove inaccurate or outdated information, and
  • You must delete personal information when you no longer need it

Each of these issues needs to be covered in your Privacy Policy, and you must actively manage any email subscription lists you have.

You also have to remember that the GDPR gives your subscribers the right to object to you processing (using) their personal data. That means even if they've already provided you with consent, such as filling out a form and providing you with their email address, they have the right to withdraw that consent at any time.

You have to let them know they have that right and ensure that you're able to provide them with any data you've collected as well as a means for them to ask you to stop using it.

Data Collection and Email Marketing

Data Collection and Email Marketing

Through successful email campaigns, you can now collect vast amounts of data. For example:

  • Email addresses (and other data like locations, names, date of birth) at sign-up
  • Data collection from inside the email (missing data from sign-up), and
  • Behavior tracking (across your website, in emails, and on the internet)

Privacy experts and regulations such as the GDPR see data collection via email marketing as a double-sided coin. On one side, you may collect more data than you need, which privacy experts warn against, especially if you don't have a legitimate use for it.

On the other hand, if you use personal information correctly, you can send more targeted and precise emails to your customers. This is the goal of legislation like the GDPR.

However, as mentioned several times already, you need to be transparent about it all.

Email Marketing Privacy Policy Examples

Email Marketing Privacy Policy Examples

The following examples demonstrate best practices for email marketing and legal requirements for Privacy Policies.

The Epoch Times

Note how The Epoch Times provides a prominent link to unsubscribe from its mailing list in this example from one of its email newsletters:

Epoch Times email newsletter screenshot with unsubscribe link highlighted

Additionally, see how a method is provided for subscribers to manage their email preferences below:

Epoch Times email newsletter screenshot with email preferences link highlighted

The Epoch Times Privacy Policy lists the following types of personal information the publication collects from users. Note the references to emails within it and the transparency about how the email addresses collected are used:

Epoch Times Data Protection and Privacy Policy: Information collected clause

Fight Aging! is another organization that sends out email newsletters. Note how it lets users know in its Privacy Policy who has access to collected emails and the uses of those email addresses and even email contents can be used:

Fight Aging Privacy Policy: Website Comments, Newsletter Subscriptions and Email and Other Communications clauses

Finally, note how Digital Kickstart lets users know how it shares personal information, in this case, email addresses and more, with third parties. Although it doesn't specifically mention email addresses, you know the company shares them with third parties because it shares personal data given when "registering for an account or service" as seen in the clause below:

Digital Kickstart Privacy Policy: Data Transfers and Privacy Shield Frameworks clause

Now that you've seen some examples in action, let's look at a general overview of the best practices.

Putting Together Your Email Privacy Policy

Putting Together Your Email Privacy Policy

No matter where your company operates, it's likely that one of the major privacy laws in existence covers your email marketing activities. What that means for you is that you'll need to comply with relevant legislation.

With that in mind, we've put together a quick checklist that you can reference at your convenience and that we believe will help you overcome any compliance challenges you may be facing.

By adhering to the following points, you'll help your business stay compliant with:

  • CalOPPA
  • CAN-SPAM Act of 2003
  • CASL
  • GDPR

You'll need to incorporate the following in your email marketing Privacy Policy, taking the above into account:

  • What personal information you collect (i.e., first names, last names, email addresses)
  • How you use personal information (do you use subscriber's email addresses to provide updates on company activities? Do you send daily or weekly promotions?)
  • A statement about whether you share personal information with third parties (i.e., Google Analytics, Infusionsoft)
  • How subscribers can opt out of your emails (i.e., writing to a specific postal or email address or by clicking a link to unsubscribe)
  • A way for subscribers to contact you (whether about unsubscribing or something else)
  • Whether you track email analytics, and if so, which ones


Your Privacy Policy should include information about what data you collect as part of your email marketing campaign. Additionally, you should explain how users can exercise their rights and withdraw consent to receive your emails and how long you will store the data before it is deleted. Failure to include these clauses puts you in violation of laws like GDPR, which come with hefty fines.

Consider mirroring the Privacy Policy of your email client with your own. Your responsibility is to ensure that you and any other individuals who process data on your behalf adhere to the law.

Include their policy and add a link in your own Privacy Policy to give your contacts a better understanding of the data you collect, use and store in your campaign. This will allow them to make informed decisions.

Keeping all of that in mind, remember that just collecting a customer's email address counts as collecting personal information. Doing so means that you're subject to a whole host of legal requirements depending on where you do business.

Finally, you should:

  • Ensure that subscribers have access to your Privacy Policy at all times. This means before, during, and after subscribing to your email list. You can make sure that happens by including links to your Privacy Policy in your sign-up forms, your newsletters, and in the footer of your website.
  • Specifically mention your use of email addresses and how you use them.
  • Provide subscribers with a way to opt-out of your email marketing activities at any time. You should include that information in every email you send as well as within your Privacy Policy.

Remember that you can make use of our email marketing Privacy Policy template or use our Privacy Policy generator to customize your own in a matter of minutes.

William Blesch

William Blesch

Legal and data protection research writer at TermsFeed

This article is not a substitute for professional legal advice. This article does not create an attorney-client relationship, nor is it a solicitation to offer legal advice.