Email popups and consent: CAN-SPAM, GDPR and double opt-in for Shopify stores

An email popup collects personal data, and the emails you send afterward are commercial messages. Both are covered by rules that depend on where your customers live. This guide explains the basics for Shopify stores selling in the US, with notes for customers in Canada and the EU, and what that means for how you set up the popup.

This article is general information, not legal advice. Rules change and depend on your situation. Check with a lawyer for your store.

Two different questions

It helps to separate two things that often get mixed up:

• Collecting the email: what you tell visitors, what you store and why.
• Sending marketing emails: whether you have permission to email the person, and what every email must include.

A visitor can give you their email to receive a discount code without agreeing to a newsletter. Treat marketing consent as its own choice.

United States: CAN-SPAM

The CAN-SPAM Act sets the rules for commercial email in the US. It does not require opt-in before you send, but every marketing email has to follow its requirements. According to the Federal Trade Commission, the main ones are:

• No false or misleading header information, such as the sender name or address.
• No deceptive subject lines.
• Identify the message as an ad where that applies.
• Include a valid physical postal address of your business.
• Tell recipients how to opt out of future emails, and make it easy.
• Honor opt-out requests promptly, within 10 business days.
• You stay responsible for these rules even if another company sends the emails for you.

Even where opt-in is not legally required, asking for clear consent in the popup gives you a cleaner list and keeps you ready for customers in places with stricter rules.

Canada: CASL

Canada's anti-spam law (CASL) generally requires consent before you send commercial electronic messages, with some exceptions for implied consent. Each message also needs to identify the sender and include an unsubscribe option. If you sell to Canadian customers, an explicit consent checkbox in the popup is the straightforward approach.

EU and UK: GDPR

If you sell to people in the European Union, the GDPR applies to the personal data you collect from them, and the UK has an equivalent law. For marketing emails, consent is the usual basis, and the GDPR describes valid consent as:

• Freely given: a real choice.
• Specific: for a clear purpose, such as marketing emails.
• Informed: the person knows who you are and what they agree to.
• Unambiguous: a clear action, such as ticking a box.

Silence, inactivity or pre-ticked boxes do not count as consent. The GDPR says so in its recitals, and the Court of Justice of the EU confirmed it for pre-ticked boxes in 2019. You also need to be able to show that a person gave consent, and withdrawing it must be as easy as giving it.

What this means for your popup

• Use a separate, unticked checkbox for marketing emails.
• Say in plain words what they sign up for, for example news and offers by email.
• Link to your privacy policy from the popup.
• Store the consent with the customer, so your email tool only emails people who agreed.
• Include an unsubscribe link and your postal address in every marketing email.

How consent works in Shopify

Shopify keeps an email marketing status on every customer, for example subscribed or not subscribed. Email marketing tools that sync customers from Shopify use that status to decide who can receive campaigns. When a popup saves the visitor as a Shopify customer, it should set the status to subscribed only if the visitor ticked the consent box.

Double opt-in

With double opt-in, a new subscriber receives a confirmation email and is subscribed only after they click the link in it. Shopify can send this confirmation email for you. Until the subscriber confirms, their marketing status stays pending.

Double opt-in has clear trade-offs:

• It confirms that the address exists and belongs to the person who signed up.
• It keeps typos and fake addresses out of your list.
• It gives you a clear record of consent.
• It adds a step, so some people who sign up never confirm.

Some countries and regulators expect or recommend it, so check what applies to your customers before you decide.

Honest urgency: real countdowns only

Popups often add a countdown to make the discount feel urgent. That is fine when the countdown is real. A timer that resets on every visit, or a code that keeps working after it says it expired, is a different story.

• In the EU, the Unfair Commercial Practices Directive lists falsely stating that an offer is available only for a very limited time, to push an immediate decision, among the practices that are always unfair.
• In the US, the Federal Trade Commission's 2022 staff report on dark patterns names fake countdown timers and false urgency as examples of misleading design.

The safe rule is simple: if the popup says the code expires in 30 minutes, the code should stop working after 30 minutes. Unique codes make that easy. See unique discount codes on Shopify.

Tell visitors what you collect

Your store's privacy policy should explain that the popup collects email addresses, why, and which services process them, such as the popup app and your email marketing tool. Shopify provides a privacy policy template you can adapt.

Checklist

• Separate, unticked checkbox for marketing emails, in plain language.
• Link to the privacy policy in the popup.
• Marketing status set to subscribed only when the box is ticked.
• Double opt-in considered for your markets.
• Countdowns that match the real expiry of the code.
• Unsubscribe link and postal address in every marketing email.
• Opt-outs honored promptly.

How Kodra Play handles consent

Kodra Play saves every email as a Shopify customer, with email marketing consent only when the visitor ticks the consent box. Double opt-in is optional, and Shopify sends the confirmation email. The countdown on a winning code is real: the code expires when the countdown ends. The app does not store names or email addresses on its own servers. Details are in the Kodra Play privacy policy, and the email popup best practices cover the rest of the setup.