Email consent under CAN-SPAM, CASL and Australia's Spam Act, and why ACR defaults to opt-in
Three laws side by side
A recovery email to a shopper who left checkout is a marketing message under all three of these laws as we read them. They agree on unsubscribing and on saying who you are. They split on whether you need permission first.
| US: CAN-SPAM Act | Canada: CASL | Australia: Spam Act 2003 | |
|---|---|---|---|
| Consent before sending | No prior consent requirement in 15 U.S.C. 7704; the law regulates each message and requires honoring opt-outs | Required, express or implied, before a commercial electronic message is sent (s. 6(1)) | Required: the account holder must have consented (s. 16) |
| Implied consent | Not part of the model | Includes an existing business relationship: a purchase in the past two years, or an inquiry or application in the past six months (s. 10(9) and (10)) | Consent can be inferred from conduct and from business and other relationships (Schedule 2, clause 2) |
| Unsubscribe | A working return address or internet-based opt-out in each message; stop within 10 business days of a request | An unsubscribe mechanism in each message; give effect within 10 business days (s. 6(2)(c), s. 11(3)) | A functional unsubscribe facility in each message; a withdrawal takes effect at the end of 5 business days (s. 18, Schedule 2, clause 6) |
| Saying who you are | A valid physical postal address, and clear identification as an advertisement unless the recipient gave prior affirmative consent | Information that identifies the sender and lets the recipient readily contact them (s. 6(2)(a) and (b)) | Clearly and accurately identifies who authorised the message, with accurate contact details (s. 17) |
Two details matter for recovery emails. Under CASL section 13, whoever claims to have consent has the onus of proving it. And whether an abandoned checkout counts as an “inquiry” for implied consent is a reading some stores may take, but the Act does not say so.
Why ACR's email consent default is opt-in
Each campaign’s Email consent setting has two choices: only shoppers who opted in to email, which is the default, or any shopper who has not unsubscribed. Geo permissions limit calls and texts by country, but they do not limit email, so one campaign can email shoppers in all three countries.
Opt-in is the only choice that meets the stricter consent rules for every one of those shoppers, and it leaves a record to point to if consent is ever questioned. That is why it is the default. Shopify checkout email marketing consent counts, and so does consent sent through a Custom API event, a CSV import or recorded by a person on the lead page.
What the default costs
Fewer abandoned-checkout emails go out. Plenty of Shopify shoppers never tick the email marketing box, and under opt-in those shoppers get no recovery email at all. If they gave SMS consent, they may still get texts, and calls if call consent is on record. We have no figures to share on how big that gap is for a typical store; your own checkout’s opt-in rate is the number to look at.
This is a business and legal decision
The stricter default is deliberate. Changing it is a choice about risk that your store should make with whoever advises it on email law.
When “any shopper who has not unsubscribed” fits
The other setting suits a store whose shoppers are in the US, where CAN-SPAM sets no prior-consent requirement, and that has decided to rely on that after review. Anyone who unsubscribed is still skipped, because an opt-out always wins in ACR.
Every ACR email carries a footer that says the shopper is getting it because they started a checkout at your store, with an unsubscribe link and a one-click unsubscribe header. It adds your postal address when your brand profile has one, so fill that in. One gap to cover yourself: for shoppers who never opted in, CAN-SPAM also asks for clear identification that the message is an advertisement, and the footer does not add that label. Put it in your email copy.
Unsubscribing suppresses the address for email only; texts and calls follow their own consent. What else counts as an opt-out is covered in our post on STOP requests, and the email page explains how recovery emails are written and sent.
This comparison reflects the three statutes and ACR’s settings as of 7 November 2026. It is written to explain the product, and it does not replace legal advice for your store.
Sources
More in Consent and compliance, or back to all posts.
Read next
- Consent and compliance
Calling hours, consent and opt-outs: the defaults ACR ships with
Every new campaign starts with the careful choice switched on. Here is what each default does, and what stays your store's responsibility.
November 7, 2026Read the post
- Consent and compliance
AI voice calls and the TCPA: what consent a recovery call needs
The FCC treats AI-generated voices as artificial voices under the TCPA. What that means for calling shoppers who left checkout, and why ACR never reads a text opt-in as permission to call.
November 7, 2026Read the post