Privacy Policy Requirements for Email Marketing

What Your Privacy Policy Must Cover

A privacy policy for email marketing isn't a generic legal template — it needs to specifically address how you handle subscriber data.

Required Elements by Regulation

GDPR (EU/EEA Subscribers)

Your privacy policy must include:

1. Identity of the data controller — your business name and contact details
2. Data Protection Officer contact (if you have one)
3. What personal data you collect — email address, name, IP address, tracking data
4. Lawful basis for processing — consent, legitimate interest, or contractual necessity
5. Purpose of processing — "to send marketing emails about our products"
6. Categories of recipients — ESPs, analytics tools, anyone you share data with
7. Data retention period — how long you keep subscriber data
8. Subscriber rights — access, rectification, erasure, portability, objection, restriction
9. How to exercise rights — contact email or process
10. Right to lodge a complaint with a supervisory authority
11. Whether data is transferred outside the EEA and safeguards in place
12. Automated decision-making — if you use algorithms to segment or target

CCPA (California Consumers)

Additional requirements:

1. Categories of personal information collected in the past 12 months
2. Sources of personal information
3. Business purpose for collecting
4. Categories of third parties you share data with
5. Whether you sell personal information and categories sold
6. Consumer rights — know, delete, opt-out of sale, non-discrimination
7. How to submit requests — at least two methods
8. "Do Not Sell My Personal Information" link (if applicable)

CAN-SPAM (United States)

CAN-SPAM doesn't specifically require a privacy policy, but it requires:

• Sender identification in every email
• Functional unsubscribe mechanism
• Physical address

A privacy policy link in your footer is best practice and expected by ESPs.

Practitioner note: Most privacy policies I review during email audits are either years out of date or copy-pasted templates that don't match what the business actually does. If your policy says "we don't share data with third parties" but you use Mailchimp, Google Analytics, and Facebook Custom Audiences — you're sharing data with third parties. Make it accurate.

Email-Specific Disclosures

Your privacy policy should specifically address:

Tracking and Analytics

Disclose that you track:

• Email opens (via tracking pixels)
• Link clicks (via tracking redirects)
• Device and location data from opens
• Engagement patterns used for segmentation

Third-Party Processors

List the categories of services that handle subscriber data:

• Email service provider (e.g., "email delivery platform")
• Analytics tools
• CRM systems
• Advertising platforms (if you use email lists for retargeting)

Data Retention

State how long you keep:

• Active subscriber data
• Unsubscribed email addresses (on suppression lists)
• Engagement history
• Consent records

Practitioner note: The retention question is where most email programs are weakest. They keep everything forever "just in case." GDPR requires a defined retention period with justification. Decide how long you need subscriber data, document it, and enforce it.

Where to Display Your Privacy Policy

1. Email signup forms — link visible before submission
2. Email footer — link in every email
3. Website footer — accessible from every page
4. Preference center — accessible when managing subscriptions

Signup Form Example

<form action="/subscribe" method="post">
  <input type="email" name="email" required>
  <label>
    <input type="checkbox" name="consent" required>
    I agree to receive marketing emails. See our
    <a href="/privacy-policy">Privacy Policy</a>.
  </label>
  <button type="submit">Subscribe</button>
</form>

Versioning and Updates

Maintain a version history:

Privacy Policy v3.2 — Last updated April 1, 2026
Previous versions: v3.1 (January 2026), v3.0 (July 2025)

When you make material changes:

• Notify existing subscribers via email
• Update the effective date
• Archive previous versions
• Document what changed

Common Privacy Policy Mistakes

Mistake	Why It Matters
Generic template without customization	Doesn't reflect your actual data practices
Missing ESP disclosure	You share data with your ESP — disclose it
No retention period stated	GDPR violation
Not updated after ESP migration	Old ESP listed, new one missing
No link in email footer	Missed opportunity, potentially non-compliant
Claims "we don't track" while using open/click tracking	Inaccurate disclosure

If you need a privacy policy review as part of your email compliance audit, get in touch.

Sources

• European Commission: GDPR — Information to Be Provided (Articles 13-14)
• California Attorney General: CCPA Privacy Policy Requirements
• ICO: Privacy Notices Guidance
• FTC: Privacy Policy Best Practices

---

v1.0 · April 2026