Email is still the hardest-working channel in marketing. It returns an average of $36 to $42 for every dollar spent, and retail and e-commerce programs average about $45 (Webtonic, citing Litmus State of Email 2026). Paid search and paid social do not come close. Email reaches people who already raised their hand, on a channel you own rather than rent from an algorithm, which is why it consistently converts better than almost anything else in the mix. That performance depends on one thing: your messages actually reaching the inbox. Lose that, and your highest-converting channel turns into your most expensive blind spot.
If your email program treats consent and data protection as paperwork, you are risking two things at once: a regulatory fine and your sending domain. The fine gets the headlines. The domain damage is what quietly shuts your marketing down.
GDPR is not just a European problem. It applies to any organization that collects or processes personal data of people in the EU, including a US retailer, healthcare company, law firm or manufacturer with EU contacts on its list. And the behaviors GDPR punishes, like emailing people who never opted in, are the same behaviors Gmail, Yahoo and Microsoft now block at the inbox door.
Here is what noncompliance actually costs, and what to do about it.
The financial hit is real, and it is growing
GDPR fines can reach €20 million or 4% of global annual revenue, whichever is higher (Article 83). That is the ceiling. The floor is lower, but it is not zero, and regulators are no longer only chasing Big Tech.
- Billions and counting. As of March 2026, regulators had issued 2,685 recorded fines totaling about €6.11 billion, with an average fine of roughly 2.3 million (CMS Enforcement Tracker).
- The top violation is the one email teams commit most. "Insufficient legal basis for data processing" drives more fines than any other category. In email terms, that means sending marketing to people who never gave valid consent.
- Mid-size companies are on the list. The largest fines of 2026 so far include a €5 million penalty against IQVIA in France and a 963,900 fine against a UK water utility, not just tech giants (GDPR Local).
- Direct marketing is a named target. France's CNIL fined Groupe Canal+ €600,000 in February 2026 for direct marketing and consent violations.The fine is also rarely the whole bill. Add legal fees, mandated remediation, audit costs and the leadership hours spent responding to a regulator. Then add the customers who read the headline and unsubscribe.
No EU contacts? US law still applies
If your list is entirely American, you are not off the hook. Federal and California law put their own price on sloppy email practices.
CAN-SPAM: up to $53,088 per email
The CAN-SPAM Act covers every commercial email sent to US recipients, B2B included. Unlike GDPR, it does not require opt-in consent. It does require you to:
- Use honest "From" lines and subject lines.
- Identify the message as an advertisement.
- Include a valid physical postal address.
- Offer a working opt-out and honor it within 10 business days.
- Monitor any agency or vendor sending on your behalf. You stay liable for their mistakes.
The maximum penalty is $53,088 per non-compliant email (eCFR, 16 CFR 1.98). The FTC confirmed in September 2026 that it will keep that level for 2026 (Federal Register). Penalties are counted per message, not per campaign, so one broken unsubscribe link across a 50,000-person send is 50,000 violations.
California: CCPA/CPRA and the state anti-spam law
The California Consumer Privacy Act, as amended by the CPRA, treats an email address as personal information. For businesses that meet its thresholds, including more than about $26.6 million in annual revenue or data on 100,000+ California consumers, it requires you to:
- Tell people at the point of collection what you collect and why.
- Honor requests to access, delete and correct their data, including in your email platform and CRM.
- Let people opt out of the "sale" or "sharing" of their data. Uploading your list to ad platforms for custom audiences can count as sharing.
- Respect browser opt-out signals such as Global Privacy Control.
Fines run up to $2,663 per violation and $7,988 per intentional violation, and the 30-day cure period is gone (Usercentrics). Because fines stack per consumer, the totals grow fast. General Motors agreed to $12.75 million in May 2026, and California regulators issued over $4 million in fines in the first quarter of 2026 alone, against Disney, Ford and PlayOn Sports (Privacy Law Map). The California Privacy Protection Agency also launched a dedicated Audits Division this year.
California has its own anti-spam statute, too. Business and Professions Code section 17529.5 targets commercial email with misleading headers or subject lines, and it lets recipients sue for up to $1,000 per email. That private right of action is why California spam lawsuits keep appearing even when federal regulators stay quiet.
The takeaway: GDPR, CAN-SPAM and California law ask for different things, but they punish the same habits. Unclear consent, misleading messages and ignored opt-outs create legal exposure in every jurisdiction and the complaints that sink your domain.
The hidden cost: inbox providers are enforcing their own rules
A regulator might take years to reach you. Gmail will reach you on your next send.
Google, Yahoo and Microsoft now hold every sender to a common standard: authenticate your domain, make unsubscribing one click, and keep spam complaints low. The rules were announced in October 2023 and took effect in February 2024. Microsoft began enforcing aligned rules on Outlook and Hotmail in May 2025. In November 2025, Gmail moved to hard enforcement (GMass).
Hard enforcement means your mail is not filtered to spam. It is rejected outright at the server, and it never arrives.
The numbers that matter for anyone sending 5,000 or more emails a day:
- Spam complaints: stay below 0.1%, and never reach 0.3%. That is three complaints per 1,000 emails.
- Authentication: SPF and DKIM must both be in place, plus a DMARC record that aligns with them.
- Unsubscribe: one-click unsubscribe in the header and a visible link in the body. Yahoo expects opt-outs honored within two days.
Notice the overlap. The fastest way to blow past a 0.3% complaint rate is to email people who never asked to hear from you, which is also the fastest way to violate GDPR. Poor consent practices do not just create legal risk. They generate the complaints that get your domain blocked.
Your domain is the asset. Treat it like one.
Your sending domain carries a reputation, and inbox providers score it on every campaign. That reputation is shared. When marketing damages it, the damage does not stay in marketing.
The same domain often sends your invoices, appointment reminders, password resets and sales follow-ups. A blocked domain means:
- Customers miss order confirmations and billing notices.
- Patients miss appointment reminders.
- Sales emails land nowhere, and pipeline stalls without anyone noticing why.
- Leadership's own replies start bouncing.
Rebuilding a burned domain takes months of careful, low-volume sending. Some companies give up and move to a new domain, losing years of sending history. Prevention is far cheaper.
Three things protect the domain:
- Lawful, documented consent. Know how every contact entered your list and be able to prove it. A pre-checked box is not consent. Neither is a list you bought, scraped or "inherited" from a trade show.
- Authentication. SPF, DKIM and DMARC tell inbox providers your mail is really from you. DMARC also stops criminals from spoofing your domain in phishing attacks, which protects your brand as well as your deliverability.
- List hygiene. Remove bounces, suppress unengaged contacts and honor unsubscribes immediately. Every stale address is a complaint or spam trap waiting to happen.
A practical checklist for your email program
If you cannot check every box below, start there.
- Every marketing contact has a recorded opt-in: source, date and what they agreed to.
- Marketing consent is separate from terms of service or purchase checkboxes.
- No purchased, rented or scraped lists are in any active send.
- Double opt-in is in place for EU sign-ups.
- SPF, DKIM and DMARC are configured and passing for every sending domain and platform.
- Every marketing email has a one-click unsubscribe header and a visible unsubscribe link.
- Unsubscribes are processed within 48 hours across every system, including your CRM. That beats Yahoo's two-day rule and CAN-SPAM's 10 business days.
- Spam complaint rates are monitored in Google Postmaster Tools and stay under 0.1%.
- Contacts with no engagement in 6 to 12 months are suppressed or re-permissioned.
- Your privacy notice explains what you collect, why, and how tracking such as open pixels works, and covers CCPA rights for California contacts. Every email includes your physical postal address and an honest subject line.
- Marketing sends from a subdomain, so transactional mail is insulated if a campaign goes wrong.
The bottom line
Privacy compliance and deliverability are the same discipline, whether the rulebook is GDPR, CAN-SPAM or the CCPA. Both reward one thing: emailing people who want to hear from you, from a domain that proves it is yours. Ignore that, and you face a regulator's fine on one side and a silent inbox on the other.
Your email list is only as valuable as your ability to reach it. Protect the domain, and you protect the revenue that runs through it.
Not sure where your program stands? The Marketing Strategy Group reviews consent practices, authentication and list health, then builds a plan to fix the gaps before they cost you. Reach out to schedule an email program audit.
This article is for general information and is not legal advice. Consult qualified counsel about your specific obligations.
Sources
- GDPR Article 83: General conditions for imposing fines
- CMS GDPR Enforcement Tracker Report: Numbers and Figures (May 2026)
- GDPR Local: Top 5 GDPR Fines in 2026
- GMass: Gmail Bulk Sender Guidelines, the 2026 Rules They Actually Enforce
- eCFR, 16 CFR 1.98: FTC civil penalty amounts
- Federal Register: FTC civil penalty inflation adjustments for 2026
- Usercentrics: California Privacy Law in 2026
- Privacy Law Map: CCPA Penalties and Fines 2026
- Webtonic: Is Email Marketing Still Worth It in 2026? (citing Litmus State of Email 2026)