Is user consent universal?

Short answer: no. Consent you collected in one country does not automatically cover you in another. The rules depend on where your subscriber lives, not where your business is based.

Here's how the three big frameworks compare:

• GDPR (European Union): Consent must be freely given, specific, informed, and unambiguous. A pre-ticked checkbox doesn't cut it. You need a clear affirmative action from the subscriber, and you need to be able to prove it.
• CAN-SPAM (United States): This one is notably more relaxed. It allows implied consent based on an existing business relationship. Technically you can email someone who bought from you without a separate opt-in, as long as you offer an easy way to stop.
• CASL (Canada): Often called the strictest of the three. Express consent is the default, and you need detailed records showing exactly when, where, and how someone agreed. Implied consent exists but has a time limit (typically two years from a transaction).

The fact that these frameworks don't line up is what catches senders off guard. You can be fully CAN-SPAM compliant and still be violating GDPR. You can have solid GDPR records and still fall short of CASL's documentation requirements.

The practical way to handle a global list is to apply the strictest standard across the board. GDPR is usually that benchmark. A properly documented GDPR-compliant opt-in will satisfy most other frameworks. The one exception worth watching is CASL's specificity rules, which sometimes need a small tweak to your signup language or record-keeping to meet the letter of the law.

If you're collecting consent in multiple countries, it's worth reviewing your signup forms and the data you store about each opt-in. Knowing what valid consent actually looks like in each region is the starting point. And if you're unsure whether your current forms hold up, that's exactly the kind of thing worth talking through with someone who's seen it go wrong. Our SOS hotline is free and we're happy to take a look.