Email marketing done properly: consent, deliverability, segmentation and automation

Your newsletter list has grown over the years from trade show business cards, past customers and a spreadsheet someone once brought in. You send, few people open, fewer click. Then a recipient asks where you got their address, and one morning your email platform suspends your account.

This guide is about setting email marketing up properly from the start: how to collect and record consent under UK and EU rules, how to reach the inbox, how to segment your list, which automated flows earn their keep and what to measure instead of open rates.

A permission-based list is the only foundation

Email is one of the few channels you control rather than rent from an algorithm. That advantage only holds if the list is made up of people who want to hear from you. A list built without permission gets punished twice: once by regulators, and much faster by mailbox providers. Gmail reacts to spam complaints long before any regulator writes to you.

Don't buy or rent lists. The people on them never agreed to hear from you, the data is full of abandoned addresses and spam traps, and the first send pushes your complaint rate through the roof. Your email platform's terms almost certainly prohibit it anyway.

A good sign-up form is short and honest. It says what you will send and how often, it doesn't pre-tick the box, and it doesn't make consent a condition of getting a discount or completing a purchase. A coffee roaster, say, might put an unticked box at checkout reading: one email a week with new roasts and brewing tips. People know what they're signing up for, so they have no reason to complain later.

A business card dropped in a bowl at a trade show is not consent. Collect sign-ups on a tablet form that records the name, address, what they agreed to and when; it beats mailing everyone you met after the event.

The rules: UK, EU and beyond

UK: PECR and the soft opt-in

In the UK, marketing email is governed by the Privacy and Electronic Communications Regulations (PECR) alongside UK GDPR. For individual subscribers, which PECR takes to include sole traders and some partnerships, you need consent unless you can rely on the soft opt-in.

The ICO's guidance sets out the soft opt-in conditions, and all of them must be met:

• you obtained the contact details yourself, in the course of a sale or negotiations for a sale;
• you are only marketing your own similar products or services;
• you gave the person a simple way to opt out when you collected the details;
• and you offer that opt-out again in every message.

The ICO notes that simply browsing a website doesn't count as negotiating a sale, while completing an enquiry form about a specific product can. Charities, which were long excluded from the commercial soft opt-in, gained their own version for charitable purposes in February 2026.

For corporate subscribers, such as limited companies, PECR's consent rules don't apply, though you must still identify yourself and give a valid contact address. That doesn't make B2B a free-for-all: an email to [email protected] is still personal data under UK GDPR, and anyone can object to direct marketing at any time, an objection you must always honour.

EU: GDPR consent and national ePrivacy rules

Across the EU, marketing email rests on national rules implementing the ePrivacy Directive, read together with the GDPR. Where you rely on consent, it must be freely given, specific, informed and unambiguous. Pre-ticked boxes don't count, which the Court of Justice confirmed in its 2019 Planet49 ruling. You must be able to prove consent, and withdrawing it must be as easy as giving it.

Most member states have an existing-customer exception similar to the UK soft opt-in, but the details vary, especially for B2B. Germany is the strictest case: under § 7 UWG, marketing email generally needs prior express consent even for business recipients, and double opt-in is the established way to prove it. If you sell into several EU markets, the safest operating standard is documented consent with double opt-in everywhere.

North America: CAN-SPAM and CASL

The US CAN-SPAM Act works on an opt-out basis. According to the FTC's compliance guide, you must not use misleading headers or subject lines, must identify the message as an advert, include a valid physical postal address, provide a working opt-out and honour opt-outs within 10 business days. Canada's CASL, by contrast, is consent-based and much closer to the European model.

Deliverability: getting into the inbox

A delivered status in your platform's report doesn't mean the message reached the inbox; the spam folder counts as delivered too. Inbox placement rests on three things: authentication, list quality and how recipients react.

Authentication

Authenticate your sending platform with your own domain through SPF, DKIM and DMARC rather than sending from the platform's shared domain. Since February 2024, Gmail has required senders of 5,000 or more messages a day to use all three, support one-click unsubscribe and keep the spam complaint rate below 0.3%. Google expects unsubscribes to be processed within two days and recommends keeping complaints under 0.1%; Yahoo applies similar rules to bulk senders. We cover the set-up in our guide to domains, hosting and business email.

Sending marketing from a separate subdomain, such as news.yourcompany.com, protects order confirmations and password resets from any reputation problem. And don't send tens of thousands of messages on day one from a new domain or IP: warm up over a few weeks, starting with your most engaged subscribers.

List hygiene

• Remove hard bounces after the first failure.
• Set a limit for subscribers who haven't clicked in a long time, say six or twelve months. Send a re-engagement email first, then stop mailing those who don't respond.
• Catch role addresses such as info@ and typo domains such as gmial.com at the point of sign-up.
• Don't hide the unsubscribe link. Someone who can't leave will press the spam button, and a complaint costs you far more than an unsubscribe.

Segmentation: stop sending everyone the same email

One newsletter to one list is easy, but most of the list will find it irrelevant, and irrelevance is the shortest path to complaints. You don't need a sophisticated data stack to segment; start with the few fields you already have.

• Behaviour: clicked in the last 90 days, subscribed but never bought, lapsed customers.
• Purchases: which category, how often, typical basket size.
• Stated interests: topics chosen at sign-up or in a preference centre.
• Role and sector in B2B: procurement wants specifications, the technical lead wants comparisons.
• Language and country: for a business selling abroad this is essential, both for the copy and for the consent rules that apply.

A manufacturer selling both trade and consumer products, for example, can split its list with a single question on the sign-up form: is this for your business or your home? That one field saves half of every send from being irrelevant.

Build a preference centre so that subscribers can choose only offers or only articles, or receive fewer emails, rather than leaving altogether. It is the cheapest way to keep someone who is about to go.

Automated flows: set them up once, let them work every day

Campaigns follow your calendar; automated flows follow your customer's behaviour. For most businesses, the emails that pull their weight are a handful of simple flows triggered at the right moment. Decide the consent basis for each flow up front: a few may count as service messages, but most are marketing.

Don't stop the welcome flow at one email. The first sets expectations, the second answers the most common question, the third invites the next step. With basket reminders, show restraint: one reminder a few hours later and, if needed, a second the next day is plenty. Discounting every abandoned basket teaches customers to abandon baskets on purpose.

In the UK, a basket reminder can fall within the soft opt-in if the customer entered their email during checkout and was offered an opt-out there; in Germany it needs consent. Because these flows rely on on-site behaviour, they also have to respect your cookie consent.

Subject lines and content

In the inbox, readers see three things: the sender name, the subject line and the preview text. The sender name should be familiar; your brand, or a person's name alongside the brand, works well. The subject line should describe the content honestly. A misleading subject lifts opens once and complaints for good.

• Keep subject lines short enough not to be cut off on mobile, with the key word first.
• Write the preview text yourself; left empty, the inbox shows your first line or a view-in-browser link.
• Give each email one main purpose. Five calls to action usually means none gets clicked.
• Don't rely on images alone, since some clients block them by default. The message should make sense without them, and every image needs alt text.
• Personalise beyond the first name. A suggestion based on last month's purchase is more personal than a greeting.

Frequency is part of the content. If the form promised two newsletters a month, don't send three offers a week. Going quiet for months and then sending a big campaign is the quickest way to collect complaints from people who have forgotten you. Choose send times from your own data; what works for someone else's list may not work for yours.

Designed template or plain text? A clean template tends to suit offers and product news; plain text that reads as if a person wrote it often works better for B2B follow-ups. Test both on your own list.

Measurement: why open rates can't be trusted

Open rates are measured by an invisible pixel loading when the email is viewed. Apple's Mail Privacy Protection, now the Protect Mail Activity setting in Apple Mail, downloads remote content in the background whether or not the person opens the message. Recipients with it switched on appear as opens in your report even if they never read a word. If many of your subscribers use iPhones, your open rate is measuring Apple's relay servers, not your readers.

So don't make decisions on opens. Judge subject line tests on clicks, and base re-engagement on clicks too, otherwise you'll keep mailing people who never read anything. There is a compliance angle as well: UK and EU regulators treat tracking pixels in emails under the same storage-and-access rules as cookies, so individual-level open tracking generally needs consent. Check this with your adviser.

• Click-through rate: the most reliable signal of interest.
• Conversions and revenue: orders or enquiries from email; tag links with UTM parameters and track campaigns in Google Analytics 4.
• Revenue per subscriber: shows the value of the list, not just its size.
• Unsubscribe and complaint rates: check after every send; a sudden rise points to a content or segment problem.
• List health: compare new subscribers with unsubscribes and bounces combined.

Choosing a tool

Whether you look at Mailchimp, Klaviyo, Brevo, MailerLite or HubSpot, start from your business, not the feature list. A café chain and a B2B software company do not need the same thing.

• Consent records: does the tool store when, where and how each person subscribed, and support double opt-in?
• E-commerce integration: if you run Shopify, WooCommerce or another platform, do orders, baskets and products sync in real time?
• Automation and segmentation: can you build the flows above without writing code?
• Authentication: does it support DKIM on your own domain and the one-click unsubscribe header?
• Data: where is subscriber data stored, is there a data processing agreement, and can you export everything if you leave?
• Pricing model: by contacts or by sends? A clean list keeps costs down too.

Keep the marketing tool and the service that sends order confirmations separate. They do different jobs, and separating them is usually safer.

Where to start

1. Audit your current list: for each address, check when and how you got consent or which exception applies. Stop mailing anyone you can't account for.
2. Fix your sign-up form: unticked box, a plain description of what you send, a link to your privacy notice and, for EU audiences, double opt-in.
3. Authenticate your platform with your own domain, switch on one-click unsubscribe and set up Gmail Postmaster Tools.
4. Build a three-email welcome flow, then add a basket reminder or post-purchase flow.
5. Segment by at least one meaningful field and add a preference centre.
6. Report on clicks, conversions and revenue per subscriber; treat open rates as a rough trend at best.

At AYTE Digital we treat email marketing as part of the same system as your website, analytics and shop: we set up sign-up forms and consent flows, configure authentication and design automations and reporting around your own data. The legal review stays with your adviser, and we work alongside them.