Most countries have legislation in place to protect individuals’ privacy and regulate how organizations can send email communications. As the sender, it is your legal responsibility to:
- Ensure your messages comply with your own country’s privacy legislation.
- Ensure your messages comply with the privacy laws of each recipient’s country.
OneSignal provides tools to help you manage compliance, but you must implement them appropriately based on your target audience and applicable laws.
Consent requirements for marketing emails
Many countries mandate explicit consent (opt-in) before sending marketing emails. These include:
- European Union (under the GDPR)
- United Kingdom
- Canada (under CASL)
- Australia
- New Zealand
- Singapore
- Hong Kong
The United States differs by allowing either opt-in or opt-out, depending on the context and applicable state or federal law. The CAN-SPAM Act permits sending marketing emails without prior consent, as long as recipients are allowed to unsubscribe.
Double opt-in requirements
Some countries, like Germany, recommend or require a double opt-in process. This involves:
- The user submitting a form requesting marketing emails.
- A follow-up confirmation email with a link the user must click to complete the subscription.
This additional step provides proof of consent and helps reduce spam complaints.
How to get opt-in consent
At minimum, you should collect clear opt-in consent before sending marketing messages. This can be done using:
- A checkbox on your signup form (unchecked by default) labeled clearly for marketing consent.
- A pop-up or banner that explains what communications users will receive.
If it has been a long time since you’ve emailed your list, consider sending a re-consent email campaign to revalidate their interest and compliance.
Unsubscribe and opt-out requirements
Every marketing email you send must include a visible and functional “unsubscribe” link. This allows recipients to opt out of future communications.
Timelines for honoring unsubscribe requests vary:
- United States (CAN-SPAM): Opt-out requests must be honored within 10 business days.
- GDPR and similar laws: Opt-out must be honored immediately or without undue delay.
Best practices for opt-out links
- Place the link in a visible location, typically at the bottom of the email.
- Clearly label it as an unsubscribe or subscription management option.
- Do not require users to log in or take additional steps to opt out.
Open-tracking pixel consent
In April 2026, France’s CNIL and Italy’s Garante published their new email tracking pixel guidance. We wrote a blog post about this with more details: Email tracking pixel guidance from France and Italy.
If you are implementing these changes into your email collection process, these are the steps you can take within OneSignal to comply with the new guidance.
Tag users based on open-tracking consent
In your email collection process where you ask for open-tracking consent, you can capture that user’s preference with a Data Tag. For example, you can tag users who have not given consent as open_tracking_consent: false and users who have given consent as open_tracking_consent: true.
This allows you to build segments based on this tracking preference tag. Recipients without the appropriate tracking consent can be sent email using your secondary subdomain with tracking disabled.
Recipients should also have an easy way to change their preference later. For example, you could include an “Email tracking preferences” link near your unsubscribe link that directs recipients to a preference page you control. When a recipient changes their preference, update the corresponding tag in OneSignal so future emails can be sent using the appropriate tracking configuration.
Use country filter
Along with the open_tracking_consent tag, you can create segments with the country filter to identify recipients in France or Italy and use that data to create separate OneSignal segments.
Create a secondary subdomain without tracking
Now that you have your users tagged and segmented, you can create a secondary sending subdomain without the CNAME tracking record. Emails sent using this subdomain will not log open or click events. This allows you to continue sending emails with tracking from your existing subdomain while using the secondary subdomain for recipients or campaigns where you do not want tracking enabled.
For example:
email.example.com → tracking enabled
email-notracking.example.com → tracking disabled
This approach allows you to separate tracked and non-tracked email without turning off tracking across your entire email program.
Omitting the tracking CNAME disables open and click tracking for every email sent through that sender. You will not see open or click data in analytics.
Email content compliance
Certain regulations also govern the content of your marketing emails:
- Header and sender info: You must use accurate “From,” “Reply-To,” and routing information.
- Subject line: Must not be misleading or deceptive.
- Physical address: Include your organization’s physical mailing address in every message.
These rules are strictly enforced under the CAN-SPAM Act, and similar guidelines exist in other jurisdictions.
Managing subscription preferences in OneSignal
OneSignal supports tools to help you comply with email legislation:
