How do laws treat mixed-content emails (e.g., receipt + promo)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
The receipt email that slides in a "you might also like" promo at the bottom: every marketer has considered it. The law has opinions about it.
Under CAN-SPAM (US): It's the "primary purpose" test. If a reasonable recipient would look at the email and conclude its main purpose is commercial, it's a commercial email. Full stop, with all CAN-SPAM requirements attached (physical address, unsubscribe mechanism). The FTC looks at the subject line, the visual hierarchy, and the ratio of promotional to transactional content. A receipt with a tiny promo banner at the bottom is probably still transactional. A receipt with a big promotional section above the fold is probably commercial.
The safest practical rule under CAN-SPAM: if the promo takes up more than roughly 20-25% of the visual real estate, treat the whole thing as commercial and include opt-out.
Under GDPR (EU): Even if the transactional content is the clear primary purpose, the promotional portion requires its own lawful basis. Transactional emails can be sent under "contractual necessity" (fulfilling the purchase). The promo requires consent (or legitimate interest with a documented balancing test). In practice, this means mixing promo into transactional emails is legally awkward for EU recipients. You either need consent for the promo portion or a solid legitimate interest argument.
The simplest approach, honestly: keep them separate. A pure receipt, then a separate follow-up email for recommendations or promotions. Cleaner legally, and often better conversion too. The receipt gets opened (people want to see the order confirmation), the promo can be optimized for engagement without the functional information cluttering it. Our SOS line can review GDPR questions specific to your use case. For CAN-SPAM compliance, the FTC's guidance on the primary purpose test is publicly available.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.