{"data":{"records":[{"id":"us-canspam-optout","dataset":"messaging","jurisdiction":"US-Federal","instrument":"CAN-SPAM, 15 U.S.C. 7704(a)(4); 16 C.F.R. 316","status":"in-force","summary":"Must honor opt-out within 10 business days; opt-out mechanism must remain operable at least 30 days after send; may not require any info beyond email address or more than a single web page/reply.","source_url":"https://www.law.cornell.edu/uscode/text/15/7704","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-canspam-optout","channel":"email","topic":"opt-out-mechanism","instrument":"CAN-SPAM, 15 U.S.C. 7704(a)(4); 16 C.F.R. 316","in_force_date":"2004-01-01","requirement":"Must honor opt-out within 10 business days; opt-out mechanism must remain operable at least 30 days after send; may not require any info beyond email address or more than a single web page/reply.","consent_model":"opt-out","b2b_treatment":"No B2B exemption; FTC states CAN-SPAM makes no exception for business-to-business email","penalty_max":"$53,088 per email (per-message)","penalty_currency":"USD","private_right":false,"enforced":"true; DOJ/FTC v. Verkada Inc. settlement announced 30 Aug 2024 — $2.95M civil penalty (FTC's largest-ever CAN-SPAM penalty) for 30M+ commercial emails over three years","source_type":"statute","notes":"Penalty is inflation-adjusted; $53,088 effective 2025-01-17 per 16 C.F.R. 1.98. Experian paid $650K in a separate matter for disguising marketing as transactional."}},{"id":"us-canspam-address","dataset":"messaging","jurisdiction":"US-Federal","instrument":"CAN-SPAM, 15 U.S.C. 7704(a)(5)","status":"in-force","summary":"Every commercial email must contain a valid physical postal address of the sender and clear identification that the message is an advertisement.","source_url":"https://www.law.cornell.edu/uscode/text/15/7704","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-canspam-address","channel":"email","topic":"identification","instrument":"CAN-SPAM, 15 U.S.C. 7704(a)(5)","in_force_date":"2004-01-01","requirement":"Every commercial email must contain a valid physical postal address of the sender and clear identification that the message is an advertisement.","consent_model":"opt-out","b2b_treatment":"No B2B exemption","penalty_max":"$53,088 per email","penalty_currency":"USD","private_right":false,"enforced":true,"source_type":"statute","notes":"Registered PO Box acceptable."}},{"id":"us-canspam-header","dataset":"messaging","jurisdiction":"US-Federal","instrument":"CAN-SPAM, 15 U.S.C. 7704(a)(1)-(2)","status":"in-force","summary":"Header/transmission info must not be materially false or misleading; subject line must not be deceptive. Applies to all messages including transactional.","source_url":"https://www.law.cornell.edu/uscode/text/15/7704","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-canspam-header","channel":"email","topic":"identification","instrument":"CAN-SPAM, 15 U.S.C. 7704(a)(1)-(2)","in_force_date":"2004-01-01","requirement":"Header/transmission info must not be materially false or misleading; subject line must not be deceptive. Applies to all messages including transactional.","consent_model":"none-required","b2b_treatment":"No B2B exemption","penalty_max":"$53,088 per email; criminal up to 5 yrs / $6M under 18 U.S.C. 1037","penalty_currency":"USD","private_right":false,"enforced":true,"source_type":"statute","notes":"Deceptive-header ban applies even to non-commercial email."}},{"id":"us-canspam-adult","dataset":"messaging","jurisdiction":"US-Federal","instrument":"CAN-SPAM, 15 U.S.C. 7704(d); 16 C.F.R. 316.4","status":"in-force","summary":"Sexually-oriented commercial email must include the mark 'SEXUALLY-EXPLICIT:' in the subject line and no explicit content viewable in the initially opened message.","source_url":"https://www.federalregister.gov/documents/2017/06/28/2017-13471/can-spam-rule","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-canspam-adult","channel":"email","topic":"subject-line","instrument":"CAN-SPAM, 15 U.S.C. 7704(d); 16 C.F.R. 316.4","in_force_date":"2004-05-19","requirement":"Sexually-oriented commercial email must include the mark 'SEXUALLY-EXPLICIT:' in the subject line and no explicit content viewable in the initially opened message.","consent_model":"opt-out","b2b_treatment":"No B2B exemption","penalty_max":"$53,088 per email","penalty_currency":"USD","private_right":false,"enforced":true,"source_type":"regulation","notes":"Adult Labeling Rule originally 316.1, renumbered 316.4 in 2008."}},{"id":"us-canspam-noprivate","dataset":"messaging","jurisdiction":"US-Federal","instrument":"CAN-SPAM, 15 U.S.C. 7706","status":"in-force","summary":"Enforcement limited to FTC, other federal agencies, state AGs, and ISPs/providers of internet access service. No individual private right of action.","source_url":"https://www.law.cornell.edu/uscode/text/15/7704","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-canspam-noprivate","channel":"email","topic":"record-keeping","instrument":"CAN-SPAM, 15 U.S.C. 7706","in_force_date":"2004-01-01","requirement":"Enforcement limited to FTC, other federal agencies, state AGs, and ISPs/providers of internet access service. No individual private right of action.","consent_model":"none-required","b2b_treatment":"n/a","penalty_max":"n/a","penalty_currency":"USD","private_right":false,"enforced":true,"source_type":"statute","notes":"Contrast TCPA, which has an individual private right. This is the single biggest risk-profile difference in US email vs calls/texts."}},{"id":"us-tcpa-pewc-cell","dataset":"messaging","jurisdiction":"US-Federal","instrument":"TCPA, 47 U.S.C. 227(b)(1)(A); 47 C.F.R. 64.1200(a)(2)","status":"unknown","summary":"Marketing calls/texts to a cell phone using an ATDS or artificial/prerecorded voice require prior express WRITTEN consent (signed writing identifying the specific seller; pre-checked boxes insufficient).","source_url":"https://www.law.cornell.edu/cfr/text/47/64.1200","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-tcpa-pewc-cell","channel":"sms","topic":"consent-basis","instrument":"TCPA, 47 U.S.C. 227(b)(1)(A); 47 C.F.R. 64.1200(a)(2)","in_force_date":"1991; PEWC since 2013-10-16","requirement":"Marketing calls/texts to a cell phone using an ATDS or artificial/prerecorded voice require prior express WRITTEN consent (signed writing identifying the specific seller; pre-checked boxes insufficient).","consent_model":"opt-in","b2b_treatment":"No general B2B exemption; applies to any cell number","penalty_max":"$500 per message; $1,500 if willful (private); FCC forfeitures higher","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"regulation","notes":"Non-telemarketing (informational) calls need only prior express consent, not written."}},{"id":"us-tcpa-atds-duguid","dataset":"messaging","jurisdiction":"US-Federal","instrument":"TCPA, 47 U.S.C. 227(a)(1); Facebook v. Duguid, 141 S.Ct. 1163 (2021)","status":"in-force","summary":"ATDS is narrowly defined: equipment must have capacity to store or produce numbers using a random or sequential number generator. Many modern list-based dialers fall outside this.","source_url":"https://www.law.cornell.edu/cfr/text/47/64.1200","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-tcpa-atds-duguid","channel":"voice","topic":"consent-basis","instrument":"TCPA, 47 U.S.C. 227(a)(1); Facebook v. Duguid, 141 S.Ct. 1163 (2021)","in_force_date":"2021-04-01","requirement":"ATDS is narrowly defined: equipment must have capacity to store or produce numbers using a random or sequential number generator. Many modern list-based dialers fall outside this.","consent_model":"opt-in","b2b_treatment":"n/a","penalty_max":"$500-$1,500 per call","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"court-opinion","notes":"Duguid narrowed federal ATDS liability; state mini-TCPAs (e.g. FTSA pre-2023) adopted broader definitions to capture list-based dialers. Prerecorded/artificial-voice liability is independent of ATDS status."}},{"id":"us-tcpa-hours","dataset":"messaging","jurisdiction":"US-Federal","instrument":"TCPA, 47 C.F.R. 64.1200(c)(1)","status":"unknown","summary":"Telephone solicitations prohibited before 8:00 a.m. or after 9:00 p.m. local time at the called party's location.","source_url":"https://www.law.cornell.edu/cfr/text/47/64.1200","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-tcpa-hours","channel":"voice","topic":"timing-window","instrument":"TCPA, 47 C.F.R. 64.1200(c)(1)","in_force_date":"1992","requirement":"Telephone solicitations prohibited before 8:00 a.m. or after 9:00 p.m. local time at the called party's location.","consent_model":"opt-out","b2b_treatment":"Applies to residential subscribers; tied to 'telephone solicitation'","penalty_max":"$500-$1,500 per call","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"regulation","notes":"Window does not apply to calls with prior express permission or EBR (those fall outside 'telephone solicitation'). A wave of 2024-25 'quiet hours' text suits litigates whether texts outside 8am-9pm violate this."}},{"id":"us-tcpa-dnc","dataset":"messaging","jurisdiction":"US-Federal","instrument":"TCPA, 47 C.F.R. 64.1200(c)(2); 16 C.F.R. 310.4(b); 15 U.S.C. 6155","status":"unknown","summary":"May not call numbers on the National DNC Registry; telemarketer must pay the annual access fee and scrub. Registration is permanent (no expiry). EBR exemption: 18 months from purchase/transaction, 3 months from inquiry.","source_url":"https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-tcpa-dnc","channel":"voice","topic":"do-not-call","instrument":"TCPA, 47 C.F.R. 64.1200(c)(2); 16 C.F.R. 310.4(b); 15 U.S.C. 6155","in_force_date":"2003","requirement":"May not call numbers on the National DNC Registry; telemarketer must pay the annual access fee and scrub. Registration is permanent (no expiry). EBR exemption: 18 months from purchase/transaction, 3 months from inquiry.","consent_model":"opt-out","b2b_treatment":"National DNC applies to residential/wireless subscribers, not generally business lines","penalty_max":"$500-$1,500 per call (private via 227(c)(5)); FTC TSR up to $53,088","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"regulation","notes":"227(c) DNC private right requires more than one violation in 12 months; statutory damages start at up to $500 (not automatically $500)."}},{"id":"us-tcpa-internal-dnc","dataset":"messaging","jurisdiction":"US-Federal","instrument":"TCPA, 47 C.F.R. 64.1200(d)","status":"unknown","summary":"Callers must maintain an internal/entity-specific do-not-call list and honor company-specific opt-out requests before making any telephone solicitation.","source_url":"https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-tcpa-internal-dnc","channel":"voice","topic":"do-not-call","instrument":"TCPA, 47 C.F.R. 64.1200(d)","in_force_date":"2003","requirement":"Callers must maintain an internal/entity-specific do-not-call list and honor company-specific opt-out requests before making any telephone solicitation.","consent_model":"opt-out","b2b_treatment":"n/a","penalty_max":"$500-$1,500 per call","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"regulation","notes":"Internal DNC list obligations are distinct from the federal registry."}},{"id":"us-tcpa-ebr","dataset":"messaging","jurisdiction":"US-Federal","instrument":"TCPA, 47 C.F.R. 64.1200(f)(5)","status":"unknown","summary":"Established Business Relationship exempts a call from 'telephone solicitation': 18 months from a purchase/transaction OR 3 months from an inquiry/application, unless the subscriber has made a company-specific DNC request.","source_url":"https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-tcpa-ebr","channel":"voice","topic":"b2b-exemption","instrument":"TCPA, 47 C.F.R. 64.1200(f)(5)","in_force_date":"2003","requirement":"Established Business Relationship exempts a call from 'telephone solicitation': 18 months from a purchase/transaction OR 3 months from an inquiry/application, unless the subscriber has made a company-specific DNC request.","consent_model":"opt-out","b2b_treatment":"n/a","penalty_max":"n/a","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"regulation","notes":"EBR does NOT override the prior-express-written-consent requirement for ATDS/prerecorded marketing to cell phones."}},{"id":"us-tcpa-revocation","dataset":"messaging","jurisdiction":"US-Federal","instrument":"FCC 24-24; 47 C.F.R. 64.1200(a)(9)-(11)","status":"in-force","summary":"Consumers may revoke consent by any reasonable means; keywords STOP/QUIT/END/REVOKE/OPT OUT/CANCEL/UNSUBSCRIBE are per se reasonable. Must honor within 10 business days. One confirmatory opt-out text allowed if sent within 5 minutes and contains no marketing.","source_url":"https://docs.fcc.gov/public/attachments/FCC-24-24A1.pdf","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-tcpa-revocation","channel":"sms","topic":"opt-out-mechanism","instrument":"FCC 24-24; 47 C.F.R. 64.1200(a)(9)-(11)","in_force_date":"2025-04-11 (core); 2024-04-04 (confirm text)","requirement":"Consumers may revoke consent by any reasonable means; keywords STOP/QUIT/END/REVOKE/OPT OUT/CANCEL/UNSUBSCRIBE are per se reasonable. Must honor within 10 business days. One confirmatory opt-out text allowed if sent within 5 minutes and contains no marketing.","consent_model":"opt-out","b2b_treatment":"n/a","penalty_max":"$500-$1,500 per message","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"regulation","notes":"The 'revoke-all' rule at 64.1200(a)(10) is delayed by waiver to 2027-01-31 pending the 2025 FNPRM. Confirmatory-text rule effective 2024-04-04."}},{"id":"us-tcpa-privateright","dataset":"messaging","jurisdiction":"US-Federal","instrument":"TCPA, 47 U.S.C. 227(b)(3), 227(c)(5)","status":"unknown","summary":"Individuals may sue directly: actual loss or $500 statutory per violation (per message/call), trebled to $1,500 for willful/knowing. No cap; each message is a separate violation. No proof of injury required.","source_url":"https://www.law.cornell.edu/uscode/text/47/227","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-tcpa-privateright","channel":"voice","topic":"record-keeping","instrument":"TCPA, 47 U.S.C. 227(b)(3), 227(c)(5)","in_force_date":"1991","requirement":"Individuals may sue directly: actual loss or $500 statutory per violation (per message/call), trebled to $1,500 for willful/knowing. No cap; each message is a separate violation. No proof of injury required.","consent_model":"n/a","b2b_treatment":"n/a","penalty_max":"$1,500 per message (willful)","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"statute","notes":"For 227(b) claims damages are mandatory at $500/violation; for 227(c) DNC claims damages are discretionary up to $500. This private right + per-message statutory damages drives US class-action risk. Contrast CAN-SPAM (no private right)."}},{"id":"us-jfpa-fax","dataset":"messaging","jurisdiction":"US-Federal","instrument":"Junk Fax Prevention Act 2005, 47 U.S.C. 227(b)(1)(C); 47 C.F.R. 64.1200(a)(4)","status":"in-force","summary":"Unsolicited fax ads prohibited unless (i) sender has an EBR, (ii) the fax number was obtained voluntarily within the EBR or from a public source, AND (iii) the fax carries a compliant opt-out notice (clear/conspicuous, first page, cost-free mechanism, honored any time any day).","source_url":"https://www.govinfo.gov/content/pkg/PLAW-109publ21/html/PLAW-109publ21.htm","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-jfpa-fax","channel":"fax","topic":"consent-basis","instrument":"Junk Fax Prevention Act 2005, 47 U.S.C. 227(b)(1)(C); 47 C.F.R. 64.1200(a)(4)","in_force_date":"2005-07-09","requirement":"Unsolicited fax ads prohibited unless (i) sender has an EBR, (ii) the fax number was obtained voluntarily within the EBR or from a public source, AND (iii) the fax carries a compliant opt-out notice (clear/conspicuous, first page, cost-free mechanism, honored any time any day).","consent_model":"opt-out","b2b_treatment":"Fax EBR covers both business and residential subscribers; no fixed 18/3-month limit for the fax EBR","penalty_max":"$500 per fax; $1,500 willful","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"statute","notes":"McLaughlin Chiropractic v. McKesson (US Sup. Ct. 2025) held district courts are not bound by FCC Hobbs-Act interpretations, reopening online-fax and Amerifactors-based litigation."}},{"id":"us-fcc-ai-voice","dataset":"messaging","jurisdiction":"US-Federal","instrument":"FCC Declaratory Ruling FCC 24-17, CG Docket 23-362","status":"in-force","summary":"AI-generated / voice-cloned voices are 'artificial or prerecorded voice' under the TCPA; robocalls using them require prior express (written, if marketing) consent. Effective immediately.","source_url":"https://docs.fcc.gov/public/attachments/FCC-24-17A1.pdf","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-fcc-ai-voice","channel":"voice","topic":"consent-basis","instrument":"FCC Declaratory Ruling FCC 24-17, CG Docket 23-362","in_force_date":"2024-02-08","requirement":"AI-generated / voice-cloned voices are 'artificial or prerecorded voice' under the TCPA; robocalls using them require prior express (written, if marketing) consent. Effective immediately.","consent_model":"opt-in","b2b_treatment":"n/a","penalty_max":"$500-$1,500 per call (private); FCC forfeiture (proposed $6M against the NH deepfake robocall operator)","penalty_currency":"USD","private_right":true,"enforced":"true; New Hampshire AI-Biden robocall / Lingo Telecom action 2024","source_type":"regulation","notes":"Ruling does not make AI voices 'illegal per se' — it subjects them to existing TCPA consent/disclosure/opt-out rules. FCC has a pending NPRM (FCC 24-84, Aug 2024) on AI-call disclosure; not yet finalised."}},{"id":"us-fl-ftsa","dataset":"messaging","jurisdiction":"US-Florida","instrument":"FTSA, Fla. Stat. 501.059 (HB 761, 2023)","status":"in-force","summary":"Prior express written consent required for unsolicited telephonic sales calls/texts using an automated system for the 'selection AND dialing' of numbers. 2023 amendment narrowed the autodialer test (and→both required) and requires the recipient to text STOP and allow a 15-day cure before suing.","source_url":"https://www.flsenate.gov/Laws/Statutes/2023/501.059","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-fl-ftsa","channel":"sms","topic":"consent-basis","instrument":"FTSA, Fla. Stat. 501.059 (HB 761, 2023)","in_force_date":"2021-07-01; amended 2023-05-25","requirement":"Prior express written consent required for unsolicited telephonic sales calls/texts using an automated system for the 'selection AND dialing' of numbers. 2023 amendment narrowed the autodialer test (and→both required) and requires the recipient to text STOP and allow a 15-day cure before suing.","consent_model":"opt-in","b2b_treatment":"Consumer-focused; EBR and express-request exemptions","penalty_max":"$500 per call/text; $1,500 willful","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"statute","notes":"CONTESTED history: the 2021 version triggered mass litigation; the 2023 amendment applies retroactively to uncertified putative class actions. Florida also maintains its own state DNC list. Post-2023 much litigation shifted back to the federal TCPA."}},{"id":"us-fl-ftsa-hours","dataset":"messaging","jurisdiction":"US-Florida","instrument":"FTSA, Fla. Stat. 501.059(4)","status":"in-force","summary":"No telephonic sales calls before 8:00 a.m. or after 8:00 p.m. local time (stricter evening cutoff than federal 9 p.m.); no more than 3 calls on the same subject within a 24-hour period.","source_url":"https://www.flsenate.gov/Laws/Statutes/2023/501.059","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-fl-ftsa-hours","channel":"voice","topic":"timing-window","instrument":"FTSA, Fla. Stat. 501.059(4)","in_force_date":"2021-07-01","requirement":"No telephonic sales calls before 8:00 a.m. or after 8:00 p.m. local time (stricter evening cutoff than federal 9 p.m.); no more than 3 calls on the same subject within a 24-hour period.","consent_model":"opt-out","b2b_treatment":"n/a","penalty_max":"$500-$1,500 per call","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"statute","notes":"Florida's 8pm cutoff is one hour stricter than the federal 9pm window; a March 2025 wave of time-of-day text suits was filed under it."}},{"id":"us-ok-otsa","dataset":"messaging","jurisdiction":"US-Oklahoma","instrument":"Oklahoma Telephone Solicitation Act, Okla. Stat. tit. 15 §§ 775C.1-775C.6","status":"in-force","summary":"Prior express written consent required for commercial telephonic sales calls using an automated selection/dialing system or recorded message. Private right of action; rebuttable presumption that a call to an OK area code reaches an OK resident.","source_url":"https://law.justia.com/codes/oklahoma/title-15/section-15-775c-2/","source_status":"blocked","not_live_law":false,"detail":{"rule_id":"us-ok-otsa","channel":"sms","topic":"consent-basis","instrument":"Oklahoma Telephone Solicitation Act, Okla. Stat. tit. 15 §§ 775C.1-775C.6","in_force_date":"2022-11-01","requirement":"Prior express written consent required for commercial telephonic sales calls using an automated selection/dialing system or recorded message. Private right of action; rebuttable presumption that a call to an OK area code reaches an OK resident.","consent_model":"opt-in","b2b_treatment":"Consumer-focused","penalty_max":"$500 per violation; $1,500 willful","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"statute","notes":"Modeled on the pre-2023 FTSA; broad autodialer definition ('selection or dialing')."}},{"id":"us-ok-otsa-hours","dataset":"messaging","jurisdiction":"US-Oklahoma","instrument":"OTSA, Okla. Stat. tit. 15 § 775C.4","status":"in-force","summary":"No commercial telephonic sales calls before 8:00 a.m. or after 8:00 p.m. in the called party's time zone; no more than 3 calls per 24 hours on the same subject regardless of the number used.","source_url":"https://law.justia.com/codes/oklahoma/title-15/section-15-775c-4/","source_status":"blocked","not_live_law":false,"detail":{"rule_id":"us-ok-otsa-hours","channel":"voice","topic":"timing-window","instrument":"OTSA, Okla. Stat. tit. 15 § 775C.4","in_force_date":"2022-11-01","requirement":"No commercial telephonic sales calls before 8:00 a.m. or after 8:00 p.m. in the called party's time zone; no more than 3 calls per 24 hours on the same subject regardless of the number used.","consent_model":"opt-out","b2b_treatment":"n/a","penalty_max":"$500-$1,500 per call","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"statute","notes":"8pm evening cutoff stricter than federal."}},{"id":"us-wa-cema","dataset":"messaging","jurisdiction":"US-Washington","instrument":"Washington CEMA, RCW 19.190.020, .040, .060","status":"unknown","summary":"Unlawful to send a commercial email/text to a WA resident with a falsified transmission path or a false/misleading subject line. Statutory damages $500 per message to the recipient ($1,000 to an interactive computer service).","source_url":"https://app.leg.wa.gov/rcw/default.aspx?cite=19.190&full=true","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-wa-cema","channel":"email","topic":"identification","instrument":"Washington CEMA, RCW 19.190.020, .040, .060","in_force_date":"1998","requirement":"Unlawful to send a commercial email/text to a WA resident with a falsified transmission path or a false/misleading subject line. Statutory damages $500 per message to the recipient ($1,000 to an interactive computer service).","consent_model":"opt-out","b2b_treatment":"Applies to messages to WA residents","penalty_max":"$500 per message (recipient) — dropping to $100 on 2026-06-11","penalty_currency":"USD","private_right":true,"enforced":"true; Brown v. Old Navy (Wash. Sup. Ct. 2025) held the subject-line ban reaches any false/misleading subject","source_type":"statute","notes":"IN FLUX: HB 2274, signed by Gov. Ferguson 23 Mar 2026 (Ch. 135, 2026 Laws), reduces RCW 19.190.040 damages from $500 to $100 per violation and adds an 'actual knowledge or knowledge fairly implied' scienter element to RCW 19.190.020, effective 11 June 2026, non-retroactive (House 86–11, Senate 43–5). Per-message damages + Consumer Protection Act linkage make WA a plaintiff hotspot."}},{"id":"us-wa-mini-tcpa","dataset":"messaging","jurisdiction":"US-Washington","instrument":"RCW 80.36.400 (HB 1051, 2023)","status":"unknown","summary":"Bans commercial solicitation via automatic dialing/announcing device to WA numbers on the federal DNC Registry; extends liability to those who 'assist in the transmission.' Private right: actual damages or $1,000 per violation, whichever greater.","source_url":"https://lawfilesext.leg.wa.gov/biennium/2023-24/htm/Bills/Session%20Laws/House/1051-S.SL.htm","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-wa-mini-tcpa","channel":"voice","topic":"do-not-call","instrument":"RCW 80.36.400 (HB 1051, 2023)","in_force_date":"2023","requirement":"Bans commercial solicitation via automatic dialing/announcing device to WA numbers on the federal DNC Registry; extends liability to those who 'assist in the transmission.' Private right: actual damages or $1,000 per violation, whichever greater.","consent_model":"opt-out","b2b_treatment":"n/a","penalty_max":"$1,000 per violation","penalty_currency":"USD","private_right":true,"enforced":true,"source_type":"statute","notes":"WA's $1,000/violation floor exceeds the federal $500 floor. This 2023-24 biennium law is the operative recent WA telemarketing amendment (no separate 2024-25 telemarketing statute located)."}},{"id":"us-ca-bot","dataset":"messaging","jurisdiction":"US-California","instrument":"California B.O.T. Act, SB 1001, Cal. Bus. & Prof. Code 17940-17942","status":"in-force","summary":"Unlawful to use a bot to communicate with a person in California to incentivize a sale/transaction (or influence a vote) with intent to mislead about its artificial identity, without a clear/conspicuous disclosure that it is a bot.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1001","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-ca-bot","channel":"in-app","topic":"identification","instrument":"California B.O.T. Act, SB 1001, Cal. Bus. & Prof. Code 17940-17942","in_force_date":"2019-07-01","requirement":"Unlawful to use a bot to communicate with a person in California to incentivize a sale/transaction (or influence a vote) with intent to mislead about its artificial identity, without a clear/conspicuous disclosure that it is a bot.","consent_model":"none-required","b2b_treatment":"n/a","penalty_max":"Enforced via Unfair Competition Law; equitable remedies/fines","penalty_currency":"USD","private_right":false,"enforced":true,"source_type":"statute","notes":"Requires intent to mislead + commercial/electoral purpose. No private right; AG/UCL enforcement."}},{"id":"us-ca-ab2905","dataset":"messaging","jurisdiction":"US-California","instrument":"California AB 2905 (2024)","status":"in-force","summary":"Outbound autodialed calls using an AI-generated/artificial voice must disclose the use of the artificial voice.","source_url":"https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2905","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-ca-ab2905","channel":"voice","topic":"identification","instrument":"California AB 2905 (2024)","in_force_date":"2025-01-01","requirement":"Outbound autodialed calls using an AI-generated/artificial voice must disclose the use of the artificial voice.","consent_model":"opt-out","b2b_treatment":"n/a","penalty_max":"per California telemarketing law","penalty_currency":"USD","private_right":false,"enforced":false,"source_type":"statute","notes":"FLAGGED: AB 2905 specifics cited secondhand; verify exact text/effective date against California Legislative Information primary source."}},{"id":"us-ut-ai","dataset":"messaging","jurisdiction":"US-Utah","instrument":"Utah AI Policy Act, SB 149 (amended by SB 226/SB 332, 2025)","status":"in-force","summary":"After the 2025 amendments, for ordinary consumer interactions a supplier must disclose use of generative AI only upon a clear and unambiguous request by the person. Division of Consumer Protection may impose $2,500 per violation.","source_url":"https://le.utah.gov/~2024/bills/static/SB0149.html","source_status":"verified","not_live_law":false,"detail":{"rule_id":"us-ut-ai","channel":"voice","topic":"identification","instrument":"Utah AI Policy Act, SB 149 (amended by SB 226/SB 332, 2025)","in_force_date":"2024-05-01; amended 2025-05-07","requirement":"After the 2025 amendments, for ordinary consumer interactions a supplier must disclose use of generative AI only upon a clear and unambiguous request by the person. Division of Consumer Protection may impose $2,500 per violation.","consent_model":"none-required","b2b_treatment":"n/a","penalty_max":"$2,500 per violation","penalty_currency":"USD","private_right":false,"enforced":true,"source_type":"statute","notes":"2025 amendments scaled back the upfront-disclosure duty to a respond-when-asked model."}},{"id":"eu-eprivacy-13-1","dataset":"messaging","jurisdiction":"EU","instrument":"ePrivacy Directive 2002/58/EC Art. 13(1) (as amended by 2009/136/EC)","status":"unknown","summary":"Automated calling systems, fax and email for direct marketing may only be used in respect of subscribers/users who have given PRIOR consent (opt-in).","source_url":"https://www.legislation.gov.uk/eudr/2002/58/article/13/data.html","source_status":"verified","not_live_law":false,"detail":{"rule_id":"eu-eprivacy-13-1","channel":"email","topic":"consent-basis","instrument":"ePrivacy Directive 2002/58/EC Art. 13(1) (as amended by 2009/136/EC)","in_force_date":"2003; amended 2011","requirement":"Automated calling systems, fax and email for direct marketing may only be used in respect of subscribers/users who have given PRIOR consent (opt-in).","consent_model":"opt-in","b2b_treatment":"Art. 13(5) leaves B2B/legal-person protection to national law — hence sharp divergence","penalty_max":"Set by national law (GDPR Art. 83: up to €20M or 4%)","penalty_currency":"EUR","private_right":"varies by member state","enforced":true,"source_type":"directive","notes":"A Directive, not directly effective — implemented differently by each member state. The consent standard is GDPR-grade."}},{"id":"eu-eprivacy-13-2","dataset":"messaging","jurisdiction":"EU","instrument":"ePrivacy Directive 2002/58/EC Art. 13(2) (soft opt-in)","status":"unknown","summary":"May email own existing customers without fresh consent if: (1) contact details obtained in the context of a sale of a product/service; (2) marketing own SIMILAR products/services only; (3) opportunity to object given free and easily at collection and in every message.","source_url":"https://www.legislation.gov.uk/eudr/2002/58/article/13/data.html","source_status":"verified","not_live_law":false,"detail":{"rule_id":"eu-eprivacy-13-2","channel":"email","topic":"b2b-exemption","instrument":"ePrivacy Directive 2002/58/EC Art. 13(2) (soft opt-in)","in_force_date":"2003","requirement":"May email own existing customers without fresh consent if: (1) contact details obtained in the context of a sale of a product/service; (2) marketing own SIMILAR products/services only; (3) opportunity to object given free and easily at collection and in every message.","consent_model":"soft-opt-in","b2b_treatment":"National variation","penalty_max":"National law","penalty_currency":"EUR","private_right":"varies","enforced":true,"source_type":"directive","notes":"CJEU C-654/23 (Inteligo Media, 13 Nov 2025): soft opt-in is itself the lawful basis (lex specialis to GDPR); no separate Art. 6 GDPR basis needed; 'free' accounts linked to paid services can count as a 'sale.' Narrowly construed."}},{"id":"eu-gdpr-legitimate-interest","dataset":"messaging","jurisdiction":"EU","instrument":"GDPR Art. 6(1)(f), Recital 47; Art. 21","status":"in-force","summary":"Processing of personal data for direct marketing may rest on legitimate interest (Recital 47), but the ePrivacy opt-in still governs the act of sending electronic marketing. Data subject has an unconditional right to object (Art. 21) to direct-marketing processing.","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","source_status":"verified","not_live_law":false,"detail":{"rule_id":"eu-gdpr-legitimate-interest","channel":"email","topic":"consent-basis","instrument":"GDPR Art. 6(1)(f), Recital 47; Art. 21","in_force_date":"2018-05-25","requirement":"Processing of personal data for direct marketing may rest on legitimate interest (Recital 47), but the ePrivacy opt-in still governs the act of sending electronic marketing. Data subject has an unconditional right to object (Art. 21) to direct-marketing processing.","consent_model":"opt-in (ePrivacy governs the send)","b2b_treatment":"n/a","penalty_max":"€20M or 4% global turnover","penalty_currency":"EUR","private_right":"true (Art. 79/82)","enforced":true,"source_type":"regulation","notes":"Common trap: legitimate interest lets you process/collect contact data but does NOT override ePrivacy consent for the electronic message itself."}},{"id":"de-uwg-7-email","dataset":"messaging","jurisdiction":"Germany","instrument":"UWG § 7(2) No. 3","status":"unknown","summary":"Email advertising without prior express consent is an 'unreasonable nuisance' — unlawful. Applies EQUALLY to B2B; a publicly available business address does not authorize sending. Double opt-in is the practical standard.","source_url":"https://www.gesetze-im-internet.de/uwg_2004/__7.html","source_status":"verified","not_live_law":false,"detail":{"rule_id":"de-uwg-7-email","channel":"email","topic":"consent-basis","instrument":"UWG § 7(2) No. 3","in_force_date":"2004 (rev. 2021)","requirement":"Email advertising without prior express consent is an 'unreasonable nuisance' — unlawful. Applies EQUALLY to B2B; a publicly available business address does not authorize sending. Double opt-in is the practical standard.","consent_model":"opt-in","b2b_treatment":"STRICT: B2B email requires consent just like B2C (opposite of CAN-SPAM). No general B2B carve-out.","penalty_max":"Up to €300,000 per administrative offence (UWG §20); competitor Abmahnung + costs; GDPR exposure €20M/4%","penalty_currency":"EUR","private_right":"true (competitors/associations sue under unfair-competition law)","enforced":true,"source_type":"statute","notes":"Enforced mainly by competitor cease-and-desist litigation, not just a regulator. One of the strictest regimes in Europe."}},{"id":"de-uwg-7-3-softoptin","dataset":"messaging","jurisdiction":"Germany","instrument":"UWG § 7(3)","status":"unknown","summary":"Narrow existing-customer exception: may email about own similar products if address obtained during a sale, customer informed at collection and given opt-out in every message, and has not objected.","source_url":"https://www.gesetze-im-internet.de/uwg_2004/__7.html","source_status":"verified","not_live_law":false,"detail":{"rule_id":"de-uwg-7-3-softoptin","channel":"email","topic":"b2b-exemption","instrument":"UWG § 7(3)","in_force_date":"2004","requirement":"Narrow existing-customer exception: may email about own similar products if address obtained during a sale, customer informed at collection and given opt-out in every message, and has not objected.","consent_model":"soft-opt-in","b2b_treatment":"Applies to true customer relationships only; not prospects, sign-ups, or purchased lists","penalty_max":"€300,000 / GDPR exposure","penalty_currency":"EUR","private_right":true,"enforced":true,"source_type":"statute","notes":"BGH VI ZR 721/15 (14 Mar 2017): consent must be specific to the goods/services marketed."}},{"id":"de-uwg-7-calls","dataset":"messaging","jurisdiction":"Germany","instrument":"UWG § 7(2) No. 2","status":"unknown","summary":"Telephone advertising to consumers requires prior EXPRESS consent; to businesses requires at least 'presumed consent' (mutmaßliche Einwilligung) — a high, documented evidentiary bar.","source_url":"https://www.gesetze-im-internet.de/uwg_2004/__7.html","source_status":"verified","not_live_law":false,"detail":{"rule_id":"de-uwg-7-calls","channel":"voice","topic":"consent-basis","instrument":"UWG § 7(2) No. 2","in_force_date":"2004","requirement":"Telephone advertising to consumers requires prior EXPRESS consent; to businesses requires at least 'presumed consent' (mutmaßliche Einwilligung) — a high, documented evidentiary bar.","consent_model":"opt-in (B2C); presumed-consent (B2B)","b2b_treatment":"B2B calls permitted only on demonstrable presumed consent; B2C need express consent","penalty_max":"Bundesnetzagentur fines up to €300,000","penalty_currency":"EUR","private_right":true,"enforced":true,"source_type":"statute","notes":"B2B phone is the one channel where Germany is relatively more permissive than for email."}},{"id":"fr-b2b-optout","dataset":"messaging","jurisdiction":"France","instrument":"Code des postes et des communications électroniques art. L34-5; LCEN art. 22; CNIL guidance","status":"unknown","summary":"B2B email to a professional at their work address is permitted WITHOUT prior consent (opt-out regime) if the message relates to the person's profession/role, sender is identified, person was informed at collection, and every message carries a working opt-out.","source_url":"https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032398445","source_status":"blocked","not_live_law":false,"detail":{"rule_id":"fr-b2b-optout","channel":"email","topic":"b2b-exemption","instrument":"Code des postes et des communications électroniques art. L34-5; LCEN art. 22; CNIL guidance","in_force_date":"2004","requirement":"B2B email to a professional at their work address is permitted WITHOUT prior consent (opt-out regime) if the message relates to the person's profession/role, sender is identified, person was informed at collection, and every message carries a working opt-out.","consent_model":"opt-out (B2B); opt-in (B2C)","b2b_treatment":"DIVERGENT: France allows B2B cold email under legitimate interest/opt-out — opposite of Germany.","penalty_max":"CNIL up to €20M or 4%","penalty_currency":"EUR","private_right":true,"enforced":"true; EDF €600,000 (Nov 2022); HUBSIDE.STORE €525,000 (Dec 2022)","source_type":"statute","notes":"Personal addresses (Gmail/Hotmail) and B2C need opt-in. CNIL (April 2026) requires separate consent for email tracking pixels regardless of the opt-out send basis."}},{"id":"nl-b2b-optout","dataset":"messaging","jurisdiction":"Netherlands","instrument":"Telecommunicatiewet art. 11.7","status":"unknown","summary":"B2B email to legal entities permitted on an OPT-OUT basis (sender must identify itself and provide a working opt-out each message). Email to natural persons/sole traders needs opt-in/soft opt-in.","source_url":"https://wetten.overheid.nl/BWBR0009950/","source_status":"verified","not_live_law":false,"detail":{"rule_id":"nl-b2b-optout","channel":"email","topic":"b2b-exemption","instrument":"Telecommunicatiewet art. 11.7","in_force_date":"2004 (rev. 2021)","requirement":"B2B email to legal entities permitted on an OPT-OUT basis (sender must identify itself and provide a working opt-out each message). Email to natural persons/sole traders needs opt-in/soft opt-in.","consent_model":"opt-out (legal entities); opt-in (individuals)","b2b_treatment":"DIVERGENT: NL used the ePrivacy legal-person exemption to allow B2B opt-out email.","penalty_max":"ACM fines (GDPR-linked)","penalty_currency":"EUR","private_right":"varies","enforced":true,"source_type":"statute","notes":"Consumer telemarketing moved to an opt-in regime effective 2021-07-01 (Bel-me-niet register replaced)."}},{"id":"ie-b2b-optout","dataset":"messaging","jurisdiction":"Ireland","instrument":"S.I. No. 336/2011 reg. 13","status":"unknown","summary":"Marketing email to a corporate subscriber permitted on an OPT-OUT basis (no prior consent); individual subscribers require consent or soft opt-in.","source_url":"https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print","source_status":"verified","not_live_law":false,"detail":{"rule_id":"ie-b2b-optout","channel":"email","topic":"b2b-exemption","instrument":"S.I. No. 336/2011 reg. 13","in_force_date":"2011","requirement":"Marketing email to a corporate subscriber permitted on an OPT-OUT basis (no prior consent); individual subscribers require consent or soft opt-in.","consent_model":"opt-out (corporate); opt-in/soft-opt-in (individual)","b2b_treatment":"DIVERGENT: corporate subscribers get lighter opt-out treatment.","penalty_max":"Fines per SI 336/2011; DPC enforcement","penalty_currency":"EUR","private_right":"varies","enforced":true,"source_type":"statute","notes":"Regulated by the Data Protection Commission."}},{"id":"es-lssi-optin","dataset":"messaging","jurisdiction":"Spain","instrument":"LSSI, Ley 34/2002 art. 21","status":"unknown","summary":"Commercial email/SMS prohibited unless previously requested or expressly authorised by the recipient. Soft opt-in only for a prior contractual relationship regarding similar products.","source_url":"https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758","source_status":"verified","not_live_law":false,"detail":{"rule_id":"es-lssi-optin","channel":"email","topic":"consent-basis","instrument":"LSSI, Ley 34/2002 art. 21","in_force_date":"2002","requirement":"Commercial email/SMS prohibited unless previously requested or expressly authorised by the recipient. Soft opt-in only for a prior contractual relationship regarding similar products.","consent_model":"opt-in","b2b_treatment":"STRICT: opt-in applies to B2B essentially like B2C.","penalty_max":"AEPD/LSSI fines (up to €150,000 for serious LSSI breaches); GDPR up to €20M/4%","penalty_currency":"EUR","private_right":"false (regulator-enforced)","enforced":true,"source_type":"statute","notes":"Regulated by AEPD."}},{"id":"it-optin","dataset":"messaging","jurisdiction":"Italy","instrument":"Codice Privacy d.lgs. 196/2003 art. 130; Codice comunicazioni elettroniche","status":"unknown","summary":"Prior consent (opt-in) required for commercial email/SMS/automated calls regardless of B2B/B2C status. Soft opt-in for own similar products to existing customers.","source_url":"https://www.garanteprivacy.it/","source_status":"verified","not_live_law":false,"detail":{"rule_id":"it-optin","channel":"email","topic":"consent-basis","instrument":"Codice Privacy d.lgs. 196/2003 art. 130; Codice comunicazioni elettroniche","in_force_date":"2004","requirement":"Prior consent (opt-in) required for commercial email/SMS/automated calls regardless of B2B/B2C status. Soft opt-in for own similar products to existing customers.","consent_model":"opt-in","b2b_treatment":"STRICT: no B2B carve-out.","penalty_max":"Garante fines; GDPR up to €20M/4%","penalty_currency":"EUR","private_right":"false (regulator-enforced)","enforced":true,"source_type":"statute","notes":"Regulated by the Garante per la protezione dei dati personali."}},{"id":"uk-pecr-22-email","dataset":"messaging","jurisdiction":"UK","instrument":"PECR 2003 reg. 22","status":"in-force","summary":"Unsolicited marketing by electronic mail (email, SMS, in-app, DM, voicemail) to individual subscribers requires prior consent (GDPR-grade: freely given, specific, informed, unambiguous; no pre-ticked boxes).","source_url":"https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/","source_status":"verified","not_live_law":false,"detail":{"rule_id":"uk-pecr-22-email","channel":"email","topic":"consent-basis","instrument":"PECR 2003 reg. 22","in_force_date":"2003-12-11","requirement":"Unsolicited marketing by electronic mail (email, SMS, in-app, DM, voicemail) to individual subscribers requires prior consent (GDPR-grade: freely given, specific, informed, unambiguous; no pre-ticked boxes).","consent_model":"opt-in","b2b_treatment":"Reg. 22 consent rule does NOT apply to corporate subscribers (companies/LLPs); individual subscribers include sole traders and unincorporated partnerships.","penalty_max":"£17.5M or 4% global turnover (post-DUAA 2025, effective 2026-02-05)","penalty_currency":"GBP","private_right":"false (ICO-enforced; individuals may claim damages under DPA for GDPR breaches)","enforced":true,"source_type":"regulation","notes":"DUAA 2025 raised the max fine from £500,000 to GDPR levels via Commencement Order No. 6 on 5 February 2026."}},{"id":"uk-pecr-22-softoptin","dataset":"messaging","jurisdiction":"UK","instrument":"PECR 2003 reg. 22(3); reg. 22(3A) (DUAA 2025)","status":"unknown","summary":"Soft opt-in: may email/text without consent if details obtained in the course of a sale/negotiation, marketing own similar products, and opt-out offered at collection and in every message. DUAA 2025 added reg. 22(3A) charity soft opt-in.","source_url":"https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/","source_status":"verified","not_live_law":false,"detail":{"rule_id":"uk-pecr-22-softoptin","channel":"email","topic":"b2b-exemption","instrument":"PECR 2003 reg. 22(3); reg. 22(3A) (DUAA 2025)","in_force_date":"2003; 22(3A) 2025","requirement":"Soft opt-in: may email/text without consent if details obtained in the course of a sale/negotiation, marketing own similar products, and opt-out offered at collection and in every message. DUAA 2025 added reg. 22(3A) charity soft opt-in.","consent_model":"soft-opt-in","b2b_treatment":"Corporate subscribers: no consent needed at all; soft opt-in relevant for sole traders/partnerships/individuals.","penalty_max":"£17.5M or 4%","penalty_currency":"GBP","private_right":false,"enforced":true,"source_type":"regulation","notes":"You can email a corporate body's generic address without consent; named individuals at companies may be individual subscribers — higher risk."}},{"id":"uk-pecr-21-calls","dataset":"messaging","jurisdiction":"UK","instrument":"PECR 2003 reg. 21","status":"unknown","summary":"May not make unsolicited marketing calls to a subscriber who has notified the caller they object or is registered with the Telephone Preference Service (TPS), unless prior consent.","source_url":"https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/","source_status":"verified","not_live_law":false,"detail":{"rule_id":"uk-pecr-21-calls","channel":"voice","topic":"do-not-call","instrument":"PECR 2003 reg. 21","in_force_date":"2003","requirement":"May not make unsolicited marketing calls to a subscriber who has notified the caller they object or is registered with the Telephone Preference Service (TPS), unless prior consent.","consent_model":"opt-out (TPS)","b2b_treatment":"Corporate TPS (CTPS) exists for corporate subscribers","penalty_max":"£17.5M or 4%","penalty_currency":"GBP","private_right":false,"enforced":"true; Poxell Ltd £150,000 (2,647,805 calls); Skean Homes Ltd £100,000 (614,342 calls) — both Jan 2024","source_type":"regulation","notes":"TPS registration must be screened before calling."}},{"id":"uk-pecr-21A-ban","dataset":"messaging","jurisdiction":"UK","instrument":"PECR 2003 reg. 21A/21B","status":"unknown","summary":"Outright ban on unsolicited direct-marketing calls relating to claims management services (reg. 21A) and pensions (reg. 21B) unless the subscriber consented and has an existing relationship.","source_url":"https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/","source_status":"verified","not_live_law":false,"detail":{"rule_id":"uk-pecr-21A-ban","channel":"voice","topic":"consent-basis","instrument":"PECR 2003 reg. 21A/21B","in_force_date":"2018-09 (claims mgmt); 2019-01 (pensions)","requirement":"Outright ban on unsolicited direct-marketing calls relating to claims management services (reg. 21A) and pensions (reg. 21B) unless the subscriber consented and has an existing relationship.","consent_model":"opt-in","b2b_treatment":"n/a","penalty_max":"£17.5M or 4%","penalty_currency":"GBP","private_right":false,"enforced":true,"source_type":"regulation","notes":"Pensions cold-calling ban since Jan 2019; claims-management ban since Sep 2018."}},{"id":"uk-pecr-22-email-enf","dataset":"messaging","jurisdiction":"UK","instrument":"PECR 2003 reg. 22","status":"in-force","summary":"Unsolicited marketing email/SMS to individuals requires consent or soft opt-in; ICO enforces against high-volume non-consented sends.","source_url":"https://ico.org.uk/action-weve-taken/enforcement/","source_status":"verified","not_live_law":false,"detail":{"rule_id":"uk-pecr-22-email-enf","channel":"email","topic":"opt-out-mechanism","instrument":"PECR 2003 reg. 22","in_force_date":"2003-12-11","requirement":"Unsolicited marketing email/SMS to individuals requires consent or soft opt-in; ICO enforces against high-volume non-consented sends.","consent_model":"opt-in / soft-opt-in","b2b_treatment":"Corporate subscribers exempt","penalty_max":"£17.5M or 4%","penalty_currency":"GBP","private_right":false,"enforced":"true; HelloFresh £140,000 (12 Jan 2024) for 79M spam emails + 1M spam texts; LADH Ltd £50,000 for 31,329 marketing SMS","source_type":"regulator","notes":"ICO removes individual penalty notices from its live site after a retention period; figures corroborated via multiple legal round-ups quoting the notices."}},{"id":"uk-pecr-fines-duaa","dataset":"messaging","jurisdiction":"UK","instrument":"Data (Use and Access) Act 2025; PECR","status":"unknown","summary":"Max PECR monetary penalty raised from £500,000 to £17.5M or 4% of global turnover (GDPR level). PECR breach notification tightened to 72 hours. New ICO compulsion powers.","source_url":"https://www.legislation.gov.uk/ukpga/2025/18/contents","source_status":"verified","not_live_law":false,"detail":{"rule_id":"uk-pecr-fines-duaa","channel":"email","topic":"record-keeping","instrument":"Data (Use and Access) Act 2025; PECR","in_force_date":"Royal Assent 2025-06-19; PECR fine change 2026-02-05","requirement":"Max PECR monetary penalty raised from £500,000 to £17.5M or 4% of global turnover (GDPR level). PECR breach notification tightened to 72 hours. New ICO compulsion powers.","consent_model":"n/a","b2b_treatment":"n/a","penalty_max":"£17.5M or 4%","penalty_currency":"GBP","private_right":false,"enforced":true,"source_type":"statute","notes":"Since March 2022 the ICO issued 49 PECR monetary penalty notices totalling £4,630,000 (avg ~£95,000) under the old £500,000 cap — none approached even that cap, so the new ceiling's immediate impact depends on the ICO exercising it."}},{"id":"ca-casl-6-consent","dataset":"messaging","jurisdiction":"Canada","instrument":"CASL s.6","status":"in-force","summary":"May not send a commercial electronic message unless the recipient has given express OR implied consent, the message identifies the sender with contact info valid ≥60 days, and includes a functioning unsubscribe mechanism.","source_url":"https://laws-lois.justice.gc.ca/eng/acts/E-1.6/","source_status":"verified","not_live_law":false,"detail":{"rule_id":"ca-casl-6-consent","channel":"email","topic":"consent-basis","instrument":"CASL s.6","in_force_date":"2014-07-01","requirement":"May not send a commercial electronic message unless the recipient has given express OR implied consent, the message identifies the sender with contact info valid ≥60 days, and includes a functioning unsubscribe mechanism.","consent_model":"opt-in (express or implied)","b2b_treatment":"Applies to B2B; work emails NOT exempt. Narrow exemption for intra/inter-organisation messages about the org's activities (s.6 regs).","penalty_max":"AMP up to CAD $1M (individual) / $10M (organisation)","penalty_currency":"CAD","private_right":"false (s.47 suspended)","enforced":true,"source_type":"statute","notes":"Express consent never expires until withdrawn. One of the strictest global regimes."}},{"id":"ca-casl-implied","dataset":"messaging","jurisdiction":"Canada","instrument":"CASL s.10(9)-(10)","status":"in-force","summary":"Implied consent from an existing business relationship: 24 months from a purchase/contract/acceptance; 6 months from an inquiry/application. Conspicuous-publication and disclosure-of-address rules give implied consent where the address is published without a 'no CEMs' statement and the message is relevant to the role.","source_url":"https://laws-lois.justice.gc.ca/eng/acts/E-1.6/","source_status":"verified","not_live_law":false,"detail":{"rule_id":"ca-casl-implied","channel":"email","topic":"consent-basis","instrument":"CASL s.10(9)-(10)","in_force_date":"2014-07-01","requirement":"Implied consent from an existing business relationship: 24 months from a purchase/contract/acceptance; 6 months from an inquiry/application. Conspicuous-publication and disclosure-of-address rules give implied consent where the address is published without a 'no CEMs' statement and the message is relevant to the role.","consent_model":"opt-in (implied, time-limited)","b2b_treatment":"Conspicuous-publication rule useful for B2B where role-relevant","penalty_max":"AMP $1M/$10M","penalty_currency":"CAD","private_right":false,"enforced":true,"source_type":"statute","notes":"Implied consent EXPIRES; must convert to express before window closes. Conspicuous-publication requires role relevance."}},{"id":"ca-casl-unsub","dataset":"messaging","jurisdiction":"Canada","instrument":"CASL s.11(3)","status":"in-force","summary":"Unsubscribe request must be given effect within 10 business days; unsubscribe mechanism must remain functional for at least 60 days after the message is sent, at no cost.","source_url":"https://laws-lois.justice.gc.ca/eng/acts/E-1.6/","source_status":"verified","not_live_law":false,"detail":{"rule_id":"ca-casl-unsub","channel":"email","topic":"opt-out-mechanism","instrument":"CASL s.11(3)","in_force_date":"2014-07-01","requirement":"Unsubscribe request must be given effect within 10 business days; unsubscribe mechanism must remain functional for at least 60 days after the message is sent, at no cost.","consent_model":"opt-in","b2b_treatment":"Applies to all CEMs","penalty_max":"AMP $1M/$10M","penalty_currency":"CAD","private_right":false,"enforced":true,"source_type":"statute","notes":"10 business days like CAN-SPAM, but on top of an opt-IN base regime."}},{"id":"ca-casl-records","dataset":"messaging","jurisdiction":"Canada","instrument":"CASL s.6; CRTC guidance","status":"in-force","summary":"Sender bears the burden of proving consent; CRTC expects records of consent (when/how obtained) to be kept for as long as the sender will be contacting the person.","source_url":"https://crtc.gc.ca/eng/com500/guide.htm","source_status":"verified","not_live_law":false,"detail":{"rule_id":"ca-casl-records","channel":"email","topic":"record-keeping","instrument":"CASL s.6; CRTC guidance","in_force_date":"2014-07-01","requirement":"Sender bears the burden of proving consent; CRTC expects records of consent (when/how obtained) to be kept for as long as the sender will be contacting the person.","consent_model":"opt-in","b2b_treatment":"n/a","penalty_max":"AMP $1M/$10M","penalty_currency":"CAD","private_right":false,"enforced":true,"source_type":"regulator","notes":"CASL sets no fixed retention period; the widely-cited '3 years' reflects CASL's limitation period (three years from the regulator's discovery of a violation), not a statutory records rule. Onus of proving consent is on the sender."}},{"id":"ca-casl-privateright","dataset":"messaging","jurisdiction":"Canada","instrument":"CASL ss.47-51, 55; Order in Council P.C. 2017-0580","status":"unknown","summary":"The private right of action (statutory damages up to CAD $200/contravention, max $1M/day) was scheduled for 2017-07-01 but was INDEFINITELY SUSPENDED by Order in Council on 2017-06-02 and has never been proclaimed.","source_url":"https://gazette.gc.ca/rp-pr/p2/2017/2017-06-14/html/si-tr31-eng.html","source_status":"verified","not_live_law":false,"detail":{"rule_id":"ca-casl-privateright","channel":"email","topic":"record-keeping","instrument":"CASL ss.47-51, 55; Order in Council P.C. 2017-0580","in_force_date":"never in force","requirement":"The private right of action (statutory damages up to CAD $200/contravention, max $1M/day) was scheduled for 2017-07-01 but was INDEFINITELY SUSPENDED by Order in Council on 2017-06-02 and has never been proclaimed.","consent_model":"n/a","b2b_treatment":"n/a","penalty_max":"$200/contravention; $1M/day (if ever in force)","penalty_currency":"CAD","private_right":false,"enforced":false,"source_type":"gazette","notes":"CONTESTED/SUSPENDED: never brought into force. Only regulator (CRTC) enforcement via AMPs applies."}},{"id":"ca-crtc-enforcement","dataset":"messaging","jurisdiction":"Canada","instrument":"CASL; CRTC enforcement","status":"in-force","summary":"CRTC has issued AMPs and undertakings against named senders (e.g. Compu-Finder CAD $1.1M notice 2015; Kellogg Canada; Rogers Media undertaking; nCrowd).","source_url":"https://crtc.gc.ca/eng/com500/info.htm","source_status":"verified","not_live_law":false,"detail":{"rule_id":"ca-crtc-enforcement","channel":"email","topic":"record-keeping","instrument":"CASL; CRTC enforcement","in_force_date":"2014-07-01","requirement":"CRTC has issued AMPs and undertakings against named senders (e.g. Compu-Finder CAD $1.1M notice 2015; Kellogg Canada; Rogers Media undertaking; nCrowd).","consent_model":"opt-in","b2b_treatment":"n/a","penalty_max":"$10M (org) per violation of s.6","penalty_currency":"CAD","private_right":false,"enforced":"true; Compu-Finder 2015","source_type":"regulator","notes":"Compu-Finder's $1.1M penalty was the first major CASL AMP."}},{"id":"au-spam-16-consent","dataset":"messaging","jurisdiction":"Australia","instrument":"Spam Act 2003 s.16","status":"in-force","summary":"Must not send a commercial electronic message with an Australian link without the recipient's consent (express or inferred). Inferred consent is narrow.","source_url":"https://www.legislation.gov.au/Details/C2004A01214","source_status":"verified","not_live_law":false,"detail":{"rule_id":"au-spam-16-consent","channel":"email","topic":"consent-basis","instrument":"Spam Act 2003 s.16","in_force_date":"2004-04-10","requirement":"Must not send a commercial electronic message with an Australian link without the recipient's consent (express or inferred). Inferred consent is narrow.","consent_model":"opt-in (express or inferred)","b2b_treatment":"Inferred consent for conspicuously published business addresses only where the message is relevant to the person's role/function.","penalty_max":"Up to 10,000 penalty units/day (body corporate repeat offender) = AUD $3.3M at $330/unit","penalty_currency":"AUD","private_right":"false (ACMA-enforced)","enforced":"true; ACMA v Tabcorp $4,003,270 (one of the highest of its kind); Commonwealth Bank; DoorDash","source_type":"statute","notes":"Penalty unit = AUD $330 from 7 Nov 2024 (was $313). Strict-liability breaches."}},{"id":"au-spam-17-id","dataset":"messaging","jurisdiction":"Australia","instrument":"Spam Act 2003 s.17","status":"in-force","summary":"Commercial electronic messages must clearly identify the sender and include accurate contact details that remain valid for at least 30 days after sending.","source_url":"https://www.legislation.gov.au/Details/C2004A01214","source_status":"verified","not_live_law":false,"detail":{"rule_id":"au-spam-17-id","channel":"email","topic":"identification","instrument":"Spam Act 2003 s.17","in_force_date":"2004-04-10","requirement":"Commercial electronic messages must clearly identify the sender and include accurate contact details that remain valid for at least 30 days after sending.","consent_model":"opt-in","b2b_treatment":"Applies to all CEMs","penalty_max":"Up to 10,000 penalty units/day","penalty_currency":"AUD","private_right":false,"enforced":true,"source_type":"statute","notes":"Sender-identification obligation applies even to some otherwise-exempt (designated) messages."}},{"id":"au-spam-18-unsub","dataset":"messaging","jurisdiction":"Australia","instrument":"Spam Act 2003 s.18","status":"in-force","summary":"Must include a functional unsubscribe facility; unsubscribe requests must be actioned within 5 business days. Cannot require login or extra personal info to unsubscribe.","source_url":"https://www.legislation.gov.au/Details/C2004A01214","source_status":"verified","not_live_law":false,"detail":{"rule_id":"au-spam-18-unsub","channel":"email","topic":"opt-out-mechanism","instrument":"Spam Act 2003 s.18","in_force_date":"2004-04-10","requirement":"Must include a functional unsubscribe facility; unsubscribe requests must be actioned within 5 business days. Cannot require login or extra personal info to unsubscribe.","consent_model":"opt-in","b2b_treatment":"Applies to all CEMs","penalty_max":"Up to 10,000 penalty units/day","penalty_currency":"AUD","private_right":false,"enforced":"true; ACMA v Woolworths $1,003,800 infringement notice (2 Jul 2020, ACMA's largest ever at the time, for 5M+ s.16 breaches); Optus $504,000","source_type":"statute","notes":"5-business-day rule is strict liability; the clock starts on receipt of the request."}}],"total":50,"coverage":{"corpus_total":56,"matched":50,"jurisdictions_in_corpus":["Australia","Canada","EU","France","Germany","Ireland","Italy","Netherlands","Spain","UK","US-California","US-Federal","US-Florida","US-Maryland","US-Oklahoma","US-Utah","US-Washington"],"by_status":{"in-force":27,"unknown":23},"source_health":{"verified":47,"blocked":3},"dead_rules_included":0},"as_of":"2026-07-28","interpretation":"Reference data, not legal advice. Every row cites a primary source — legislative text, a regulator document, or a court opinion — and records whether that URL resolved when the corpus was built; \"blocked\" means the host refuses automated checkers, not that the citation is bad. Rows marked not_live_law were vacated, superseded, or never took effect, and are included deliberately: a rule wrongly believed to be in force is the most expensive error in this area. Verify against the cited source before relying on any row."},"_meta":{"request_id":"req_7c7229f9248443809768e29569f4524f","product":"legal/messaging","version":"1.0.0","receipt_id":null,"cost":{"quoted":0,"charged":0,"currency":"USD","display":"0.000000"},"cache":{"hit":true,"age_s":25524},"provenance":{"sourcing_class":"B","upstream":["internal:legal-corpus@2026-07"],"fetched_at":"2026-10-13T10:43:26.744Z","license":"proprietary"},"freshness":{"as_of":"2026-07-28","staleness_s":25524},"confidence":1}}