---
claim_type: definition
source: "internal synthesis"
source_type: internal
checked: 2026-09-17
---

# Legal regimes: the rules the basis rests on, quoted from their sources

`SKILL.md` names the regimes and what this skill leaves to you. This file quotes each rule in its primary
source's words, ends it with the people it does not bind, and lists every source it quotes at the end.
No rule here grants a permission to send: when you do not know the reader's regime, ask the ten questions
of `lawful-basis-and-collection.md`, step 2, and apply no rule. This is not legal advice.

## The rules

- **European Union, GDPR: what consent is, and what it has to survive.** Consent is "any freely given,
  specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a
  statement or by a clear affirmative action, signifies agreement to the processing of personal data
  relating to him or her" (Article 4(11)). "Silence, pre-ticked boxes or inactivity should not therefore
  constitute consent", and "when the processing has multiple purposes, consent should be given for all of
  them" (Recital 32). "Where processing is based on consent, the controller shall be able to demonstrate
  that the data subject has consented" (Article 7(1)). A request inside a declaration on other matters
  "shall be presented in a manner which is clearly distinguishable from the other matters, in an
  intelligible and easily accessible form, using clear and plain language" (Article 7(2)). "The data
  subject shall have the right to withdraw his or her consent at any time", and "it shall be as easy to
  withdraw as to give consent" (Article 7(3)). Whether consent is freely given takes "utmost account" of
  "whether, inter alia, the performance of a contract, including the provision of a service, is
  conditional on consent to the processing of personal data that is not necessary for the performance
  of that contract" (Article 7(4)); consent "is presumed not to be freely given if it does not allow
  separate consent to be given to different personal data processing operations despite it being
  appropriate in the individual case" (Recital 43).
  **Who this does not bind:** processing that does not rest on consent, which has its own conditions
  under Article 6; whether direct marketing by email is allowed at all is the ePrivacy question below,
  not this one.
- **European Union, GDPR: the objection, the child, the special categories, purpose and storage.**
  "Where personal data are processed for direct marketing purposes, the data subject shall have the
  right to object at any time to processing of personal data concerning him or her for such marketing,
  which includes profiling to the extent that it is related to such direct marketing", and where they
  object "the personal data shall no longer be processed for such purposes" (Article 21(2) and (3)); the
  right is brought to the person's attention "at the latest at the time of the first communication",
  "clearly and separately from any other information" (Article 21(4)). For information society services
  offered directly to a child on the basis of consent, "the processing of the personal data of a child
  shall be lawful where the child is at least 16 years old"; below that, only with the consent or
  authorization of "the holder of parental responsibility", and "Member States may provide by law for a
  lower age for those purposes provided that such lower age is not below 13 years" (Article 8(1)).
  "Processing of personal data revealing racial or ethnic origin, political opinions, religious or
  philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data
  for the purpose of uniquely identifying a natural person, data concerning health or data concerning a
  natural person's sex life or sexual orientation shall be prohibited" (Article 9(1)), subject to the
  conditions of Article 9(2). Personal data are "collected for specified, explicit and legitimate
  purposes and not further processed in a manner that is incompatible with those purposes" (Article
  5(1)(b)) and "kept in a form which permits identification of data subjects for no longer than is
  necessary for the purposes for which the personal data are processed" (Article 5(1)(e)).
  **Who this does not bind:** the age applies to information society services offered directly to a
  child, and each member state may have set its own between 13 and 16; the conditions under which a
  special category may be processed are Article 9(2)'s and are not surveyed here.
- **European Union, ePrivacy Directive, Article 13: the sending rule.** Electronic mail "for the purposes
  of direct marketing may be allowed only in respect of subscribers or users who have given their prior
  consent" (Article 13(1)). The exception: a person that "obtains from its customers their electronic
  contact details for electronic mail, in the context of the sale of a product or a service" may use them
  "for direct marketing of its own similar products or services provided that customers clearly and
  distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of
  electronic contact details at the time of their collection and on the occasion of each message in case
  the customer has not initially refused such use" (Article 13(2)). Mail that disguises or conceals the
  sender's identity, or has no "valid address to which the recipient may send a request that such
  communications cease", is prohibited in any event (Article 13(4)). Paragraphs 1 and 3 "shall apply to
  subscribers who are natural persons" (Article 13(5)).
  **Who this does not bind:** subscribers who are not natural persons, whose protection each member
  state sets in its own law; the directive runs through national law, so the exception's form and the
  treatment of texts and push are read in the member state's text.
- **United Kingdom, PECR regulation 22 and the ICO.** Unsolicited electronic mail marketing to individual
  subscribers requires that the recipient "has previously notified the sender that he consents for the
  time being to such communications" (regulation 22(2)), unless the sender "obtained the contact details
  of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a
  product or service to that recipient", "the direct marketing is in respect of that person's similar
  products and services only", and "the recipient has been given a simple means of refusing (free of
  charge except for the costs of the transmission of the refusal) the use of his contact details for the
  purposes of such direct marketing, at the time that the details were initially collected, and, where he
  did not initially refuse the use of the details, at the time of each subsequent communication"
  (regulation 22(3)). Since 5 February 2026 a charity has a second soft opt-in for its charitable purposes
  (regulation 22(3A), inserted by the Data (Use and Access) Act 2025). "Electronic mail" is "any text,
  voice, sound or image message sent over a public electronic communications network which can be stored
  in the network or in the recipient's terminal equipment until it is collected by the recipient and
  includes messages sent using a short message service" (regulation 2(1)). The ICO: "You can send
  unsolicited electronic mail marketing to corporate subscribers without consent or a soft opt-in";
  "there is no such thing as a third-party marketing list that is compliant with the soft opt-in";
  "including an opt-out in an order confirmation email is not sufficient"; "PECR treats consent as 'for
  the time being'"; and on withdrawal, "you should act promptly to respect their wishes. You should add
  their contact details to your 'do not contact' or suppression list." For records under the UK GDPR the
  ICO lists what to keep: who consented, when, what they were told at the time, including "version
  numbers and dates matching the date consent was given", how they consented, and whether they have
  withdrawn consent and when. On duration: "if in doubt, we recommend you consider refreshing consent
  every two years, but you may be able to justify a longer period, or need to refresh more regularly."
  The UK GDPR sets the child's age for information society services at 13 (Article 8(1) as it applies in
  the United Kingdom).
  **Who this does not bind:** corporate subscribers, for the consent rule; the two-year refresh is a
  recommendation, not a limit; the charitable soft opt-in binds only charities as regulation 22(5)
  defines them.
- **United States, CAN-SPAM: an opt-out regime for commercial email.** No prior consent is required and
  "the law makes no exception for business-to-business email." Each message carries "a clear and
  conspicuous explanation of how the recipient can opt out"; "you may create a menu to allow a recipient
  to opt out of certain types of messages, but you must include the option to stop all marketing messages
  from you." "Any opt-out mechanism you offer must be able to process opt-out requests for at least 30
  days after you send your message. You must honor a recipient's opt-out request within 10 business
  days. You can't charge a fee, require the recipient to give you any personally identifying information
  beyond an email address, or make the recipient take any step other than sending a reply email or
  visiting a single page on an Internet website as a condition for honoring an opt-out request." "Once
  people have told you they don't want to receive more messages from you, you can't sell or transfer
  their email addresses, even in the form of a mailing list", except to a company hired to help comply.
  "Even if you hire another company to handle your email marketing, you can't contract away your legal
  responsibility to comply with the law."
  **Who this does not bind:** messages whose primary purpose is transactional or relationship, which are
  "exempt from most provisions" (`transactional-messaging`); texts and calls, which the FCC's rules below
  govern; state law, not surveyed here.
- **United States, TCPA rules, 47 CFR 64.1200: consent for texts and calls, and its revocation.** No
  person may "initiate any telephone call (other than a call made for emergency purposes or is made
  with the prior express consent of the called party) using an automatic telephone dialing system or
  an artificial or prerecorded voice" to a wireless number, marketing or not (paragraph (a)(1)). A
  call "that includes or introduces an advertisement or constitutes telemarketing, using an automatic
  telephone dialing system or an artificial or prerecorded voice" to a wireless number requires "the
  prior express written consent of the called party" (paragraph (a)(2)); that consent is "an
  agreement, in writing, bearing the signature of the person called that clearly authorizes the seller
  to deliver or cause to be delivered to the person called advertisements or telemarketing messages",
  naming the telephone number (paragraph (f)(9)). The revocation and confirmation rules speak of
  "calls or text messages" and of "robocalls and robotexts" directly; the sentence that "the term
  'call' includes a text message, including a short message service (SMS) call" is scoped to the
  exemptions of paragraph (a)(9), and the reading of texts as calls under the statute itself is a
  question for counsel. A called party "may revoke prior express consent, including prior express
  written consent, to receive calls or text messages made pursuant to paragraphs (a)(1) through (3)
  and (c)(2) of this section by using any reasonable method to clearly express a desire not to receive
  further calls or text messages from the caller or sender", after which "the caller may not send
  additional robocalls and robotexts"; the words "stop," "quit," "end," "revoke," "opt out," "cancel,"
  or "unsubscribe" in reply to a text "constitutes a reasonable means per se", a reply in other words
  must be treated as revocation "if a reasonable person would understand those words to have conveyed
  a request to revoke consent", and all such requests "must be honored within a reasonable time not to
  exceed ten business days from receipt" (paragraph (a)(10)). A revocation by other means, such as a
  voicemail or an email to an address meant to reach the caller, "creates a rebuttable presumption
  that the consumer has revoked consent" (paragraph (a)(11)). "A one-time text message confirming a
  request to revoke consent" is allowed "as long as the confirmation text merely confirms the text
  recipient's revocation request and does not include any marketing or promotional information, and is
  the only additional message sent"; sent within five minutes it "will be presumed to fall within the
  consumer's prior express consent"; where the person consented to several categories, it "may request
  clarification as to whether the revocation request was meant to encompass all such messages; the
  sender must cease all further texts for which consent is required absent further clarification"
  (paragraph (a)(12)).
  **Who this does not bind:** calls and texts sent without an automatic telephone dialing system or an
  artificial or prerecorded voice as the federal definition reads them, which is a question for counsel
  about your sending setup; messages made by or on behalf of a tax-exempt nonprofit and health care
  messages under the HIPAA definitions, for which paragraph (a)(2) states different consent; the
  exemptions of paragraph (a)(9), not surveyed here; state telemarketing and texting laws, not surveyed
  here. Note what the revocation rule does bind: a service text that rests on the prior express consent
  of paragraph (a)(1) is a text "for which consent is required", and a "stop" reaches it unless the
  person keeps it by the clarification of paragraph (a)(12)
  (`references/preference-center-and-unsubscribe.md`, step 6).
- **United States, FCC Declaratory Ruling and Order FCC 15-72 (released 2015-07-10), paragraphs 103 to
  106, and Report and Order FCC 24-24 (released 2024-02-16), paragraphs 28 and 29: a code the person
  asks for after a stop.** The 2015 ruling found that "a one-time text sent in response to a consumer's
  request for information does not violate the TCPA or the Commission's rules so long as it: (1) is
  requested by the consumer; (2) is a one-time only message sent immediately in response to a specific
  consumer request; and (3) contains only the information requested by the consumer with no other
  marketing or advertising information", and that the consumer's initiating text "clearly constitutes
  consent to an informational reply in fulfillment of the consumer request." The 2024 order applies a
  revocation "only to those robocalls and robotexts for which consent is required under the TCPA" and,
  absent an affirmative response, "no further robocalls or robotexts for which consent is required can
  be made to this consumer"; it does not mention the 2015 ruling. The library's reading of the two
  together: a stop ends the standing consent, and a code the person asks for afterward rests on the new
  request, which is a requested message for that one code. Send the code only when all three conditions
  hold, and change nothing else: the stop state on the number stays, the request restarts no program,
  and the next code needs its own request. Log the request with its time beside the stop entry, so an
  audit can trace the send after the stop to its basis. **Who this does not bind:** the ruling was made
  on the facts of a text the consumer sent to the business, so whether a code requested on a login
  screen counts as the consumer's request in its sense is a question for counsel, not a permission; a
  code that carries anything beyond the code fails condition (3); state law is not surveyed; and a
  provider that blocks the number after a stop refuses the code whatever the basis, which is
  `messaging-channels`' (`references/keywords-and-replies.md`, edge cases).
- **United States, COPPA, 16 CFR part 312.** "Child means an individual under the age of 13." An operator
  must "obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal
  information from children" (section 312.3(b)); "an operator must give the parent the option to consent
  to the collection and use of the child's personal information without consenting to disclosure of his
  or her personal information to third parties, unless such disclosure is integral to the website or
  online service" (section 312.5(a)(2)). Collecting a child's online contact information without consent
  is allowed "to respond directly on a one-time basis to a specific request from the child", where the
  information "is not used to re-contact the child or for any other purpose, is not disclosed, and is
  deleted by the operator from its records promptly after responding" (section 312.5(c)(3)).
  **Who this does not bind:** operators outside the rule's definitions of an operator and of a website or
  online service directed to children, or with actual knowledge, which are questions for counsel about
  your service; the rule is federal and about online collection.
- **United States, California, CCPA as the Attorney General describes it.** The law applies to for-profit
  businesses doing business in California with "a gross annual revenue of over $25 million", or that
  "buy, sell, or share the personal information of 100,000 or more California residents or households",
  or that "derive 50% or more of their annual revenue from selling California residents' personal
  information." A consumer "may request that businesses stop selling or sharing your personal
  information ('opt-out')", and "businesses must wait at least 12 months before asking you to opt back
  in." Businesses that sell personal information must "provide a clear and conspicuous 'Do Not Sell or
  Share My Personal Information' link"; a request "via a user-enabled global privacy control, like the
  GPC" "must be honored by covered businesses as a valid consumer request to stop the sale or sharing."
  A child's personal information known to be "under the age of 16" may be sold only with "affirmative
  authorization ('opt-in')", and "for children under the age of 13, that opt-in must come from the
  child's parent or guardian." A consumer may "direct businesses to only use your sensitive personal
  information (for example, your social security number, financial account information, your precise
  geolocation data, or your genetic data) for limited purposes", may request deletion "subject to certain
  exceptions (such as if the business is legally required to keep the information)", and "businesses
  must respond to your request within 45 calendar days."
  **Who this does not bind:** businesses under the thresholds; consumers outside California; the other
  state privacy laws, not surveyed here; the opt-out is about sale and sharing, not about email consent.
- **Canada, CASL and the CRTC.** "It is prohibited to send or cause or permit to be sent to an electronic
  address a commercial electronic message unless the person to whom the message is sent has consented
  to receiving it, whether the consent is express or implied" (section 6(1)(a)), and the message
  identifies the sender, gives a way to contact them and sets out an unsubscribe mechanism (section
  6(2)). A request for express consent "must, when requesting consent, set out clearly and simply" the
  purposes, "prescribed information that identifies the person seeking consent" and any person on whose
  behalf, and "any other prescribed information" (section 10(1)). Consent is implied only in the cases of
  section 10(9): an existing business or non-business relationship, a conspicuously published address
  with no statement refusing unsolicited messages where the message is relevant to the person's role, an
  address the person disclosed without such a statement where the message is relevant to their role, or
  the circumstances in the regulations. An existing business relationship arises from "the purchase or
  lease of a product, goods, a service, land or an interest or right in land, within the two-year period
  immediately before the day on which the message was sent", a written contract "currently in existence
  or expired within" that period, or "an inquiry or application, within the six-month period immediately
  before the day on which the message was sent" (section 10(10)). The unsubscribe mechanism lets the
  person indicate "the wish to no longer receive any commercial electronic messages, or any specified
  class of such messages", "using the same electronic means by which the message was sent" or, if not
  practicable, another electronic means, and specifies an address or a web page (section 11(1)); that
  address or page "is valid for a minimum of 60 days after the message has been sent" (section 11(2));
  effect is given "without delay, and in any event no later than 10 business days after the indication
  has been sent, without any further action being required on the part of the person who so indicated"
  (section 11(3)). "A person who alleges that they have consent ... has the onus of proving it" (section
  13). The CRTC: "an electronic message that contains a request for express consent is also considered
  to be a CEM under CASL and therefore is not a method through which express consent can be obtained";
  "express consent is not time-limited"; "you cannot use a pre-checked box to request consent"; "there is
  no prescribed period in the legislation setting out how long records should be kept", and "you need to
  retain records demonstrating that consent for as long as you will be contacting them"; records "should
  include information such as the electronic address, the date and the method that consent was received";
  and "if you are sending a commercial email or text message, you need to comply with three main
  requirements."
  **Who this does not bind:** messages outside the definition of a commercial electronic message, and
  messages under the exceptions of section 6(5), 6(6) and 6(8) (`transactional-messaging` for 6(6));
  express consent's contents beyond section 10(1) are in the regulations, not opened here.
- **Mailbox providers, a platform rule.** Yahoo: "Honor unsubscribes within 2 days"; "verify you're only
  sending mail to users who specifically requested it"; "when users subscribe to your mailing list, send
  them an email asking them to click to confirm their opt-in." Google: "Marketing messages and subscribed
  messages must support one-click unsubscribe, and include a clearly visible unsubscribe link in the
  message body"; "don't send messages to people who didn't sign up to get messages from you."
  **Who this does not bind:** mail to other providers; these are rules a company enforces by filtering,
  not statutes, and `deliverability` holds the rest of them.

**Sources for the rules in this file, each opened 2026-09-14.**

- Regulation (EU) 2016/679 (GDPR), Articles 4(11), 5(1), 7, 8, 9, 21, Recitals 32 and 43:
  https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679
- Directive 2002/58/EC (ePrivacy), consolidated text of 2009-12-19, Article 13:
  https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02002L0058-20091219
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 22:
  https://www.legislation.gov.uk/uksi/2003/2426/regulation/22
- The same Regulations, regulation 2 (definitions):
  https://www.legislation.gov.uk/uksi/2003/2426/regulation/2
- UK GDPR, Article 8: https://www.legislation.gov.uk/eur/2016/679/article/8
- ICO, How do we comply with the PECR electronic mail marketing rules?:
  https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/how-do-we-comply-with-the-pecr-electronic-mail-marketing-rules/
- ICO, How should we obtain, record and manage consent?:
  https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/how-should-we-obtain-record-and-manage-consent/
- FTC, CAN-SPAM Act: A Compliance Guide for Business:
  https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
- 47 CFR 64.1200, Delivery restrictions, paragraphs (a)(1), (a)(2), (a)(9), (a)(10) to (a)(12) and (f)(9):
  https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200
- FCC, Declaratory Ruling and Order, FCC 15-72, paragraphs 103 to 106, opened 2026-09-16:
  https://docs.fcc.gov/public/attachments/FCC-15-72A1.pdf
- FCC, Report and Order and Further Notice of Proposed Rulemaking, FCC 24-24, paragraphs 28 and 29,
  opened 2026-09-16: https://docs.fcc.gov/public/attachments/FCC-24-24A1.pdf
- 16 CFR part 312, Children's Online Privacy Protection Rule, sections 312.2, 312.3 and 312.5:
  https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312
- State of California Department of Justice, California Consumer Privacy Act (CCPA):
  https://oag.ca.gov/privacy/ccpa
- Canada's Anti-Spam Legislation (S.C. 2010, c. 23), sections 6, 10, 11 and 13:
  https://laws-lois.justice.gc.ca/eng/acts/E-1.6/page-1.html and
  https://laws-lois.justice.gc.ca/eng/acts/E-1.6/page-2.html
- Electronic Commerce Protection Regulations (SOR/2013-221), section 4 (the referral):
  https://laws-lois.justice.gc.ca/eng/regulations/SOR-2013-221/page-1.html
- CRTC, Guidance on Implied Consent: https://crtc.gc.ca/eng/com500/guide.htm
- CRTC, Frequently Asked Questions about Canada's Anti-Spam Legislation:
  https://crtc.gc.ca/eng/com500/faq500.htm
- Yahoo, Sender Best Practices: https://senders.yahooinc.com/best-practices/
- Google, Email sender guidelines: https://support.google.com/a/answer/81126