Commercial emails identified as advertisements where required
Why it matters
CAN-SPAM §5(a)(5)(B) requires commercial emails be clearly identified as advertisements unless the recipient gave prior affirmative consent to receive commercial email. Sending promotional content to all registered users — without a separate marketing opt-in — and without any This is a promotional email disclosure violates this requirement for every message. GDPR Art. 6 requires a lawful basis for processing; for email marketing to EU users, consent under Art. 6(1)(a) or legitimate interest must be established and documented. ePrivacy Art. 13 adds channel-specific requirements for electronic communications marketing.
Severity rationale
Medium because the violation affects every promotional email sent to non-opted-in users, but it is remediated by either adding an opt-in flow or adding a disclosure — both of which are straightforward changes.
Remediation
Add an advertisement disclosure to any promotional email sent without explicit prior opt-in, or implement a proper marketing opt-in flow to eliminate the ambiguity entirely.
// Quick fix — disclosure in email header when sending without explicit opt-in
<p style={{ fontSize: '11px', color: '#aaa', marginBottom: '16px' }}>
This is a promotional email from YourProduct.
</p>
// Long-term fix — track prior affirmative consent at signup
// <input type="checkbox" name="marketingConsent" />
// 'Send me product updates and offers (optional)'
Once all recipients have given affirmative consent (documented with timestamp and opt-in source), the disclosure label becomes optional — but best practice is to keep it. See the Consent & Opt-In category for the full opt-in implementation.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Email & SMS Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · CAN-SPAM-§5(a)(5)(B) — CAN-SPAM Act §5(a)(5)(B) — Commercial email must be identified as an advertisement
- gdpr · Art. 6 — GDPR Art. 6 — Lawful basis for processing (consent for direct marketing)
- eprivacy · Art. 13 — ePrivacy Directive Art. 13 — Unsolicited communications
Taxons
History
- 2026-04-18·v1.0.0·Initial import from email-sms-compliance·automated