# CAN-SPAM, GDPR and CCPA by subscriber region

*Marketing Cloud Engagement Foundations Study Guide · Marketing Concepts · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-foundations/marketing-concepts/can-spam-gdpr-and-ccpa-by-subscriber-region*

Which privacy law applies to which part of the subscriber base (CAN-SPAM in the US, the GDPR for EU individuals, the CCPA in California and other state laws), what each asks of email marketers, and why legal review and the platform's privacy tools go together.

- Certification: Salesforce Marketing Cloud Engagement Foundations
- Exam section: Marketing Concepts
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-foundations

**Official exam objective:**

> Recall the regional nature of privacy laws with respect to the subscriber base in order to uphold privacy standards in the context of marketing.

## What the exam expects

- Match a group of subscribers to the law that protects them: CAN-SPAM (US commercial email), the GDPR (EU individuals) or the CCPA (California residents).
- State the CAN-SPAM requirements for commercial email and how transactional email differs.
- Recognise valid GDPR consent and the proof an organisation must keep.
- Name the GDPR principle a data practice breaks, including data minimization and privacy by default.
- List what consumers generally want under the newer US state laws, and when to involve the legal team.
- Key terms: **commercial email** (primary purpose is commercial advertisement or promotion); **transactional email** (facilitates or updates an agreed transaction); **processing** (anything done to or with personal data); **data minimization** (collect only what the purpose needs); **privacy by default** (the most privacy-friendly setting is the default).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| CAN-SPAM scope | US federal law on commercial email, effective January 1, 2004 | [Commercial Email Regulation Considerations](https://help.salesforce.com/s/articleView?id=sales.emailadmin_considerations_email_regs.htm&type=5&language=en_US) |
| GDPR scope | EU individuals' data, even with no EU presence; effective May 25, 2018 | [Commercial Email Regulation Considerations](https://help.salesforce.com/s/articleView?id=sales.emailadmin_considerations_email_regs.htm&type=5&language=en_US) |
| CCPA | California, 2020 | [Get to Know Consumer Privacy](https://trailhead.salesforce.com/content/learn/modules/marketing-and-consumer-privacy/get-to-know-consumer-privacy) |
| Unsure classification | Choose commercial and include an unsubscribe link | [Send Classifications](https://help.salesforce.com/s/articleView?id=mktg.mc_es_send_classifications.htm&type=5&language=en_US) |
| Advertisement label | Required unless you have express opt-in consent | [CAN-SPAM Requirements](https://help.salesforce.com/s/articleView?id=mktg.mc_es_can_spam_requirements.htm&type=5&language=en_US) |
| Transactional sends | Not required to honour opt-outs | [CAN-SPAM Requirements](https://help.salesforce.com/s/articleView?id=mktg.mc_es_can_spam_requirements.htm&type=5&language=en_US) |
| Proof of consent | Organisations must be able to prove valid consent | [Get to Know EU Privacy Law](https://trailhead.salesforce.com/content/learn/modules/european-union-privacy-law-basics/get-to-know-eu-privacy-law) |
| Privacy by default | Least processing; shortest retention | [Key Principles of the GDPR](https://trailhead.salesforce.com/content/learn/modules/european-union-privacy-law-basics/learn-key-principles-of-the-gdpr) |

## Check yourself

- When did the GDPR take effect?
- Why can a transactional send reach a subscriber who unsubscribed?
- Which three states besides California does Trailhead name as adding or proposing privacy laws?
- Why does a pseudonymised email list still fall under the GDPR?

## Sources

- [Commercial Email Regulation Considerations](https://help.salesforce.com/s/articleView?id=sales.emailadmin_considerations_email_regs.htm&type=5&language=en_US)
- [Get to Know Consumer Privacy (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/marketing-and-consumer-privacy/get-to-know-consumer-privacy)
- [Get to Know EU Privacy Law (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/european-union-privacy-law-basics/get-to-know-eu-privacy-law)
- [Learn Key Principles of the GDPR (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/european-union-privacy-law-basics/learn-key-principles-of-the-gdpr)
- [CAN-SPAM Requirements](https://help.salesforce.com/s/articleView?id=mktg.mc_es_can_spam_requirements.htm&type=5&language=en_US)
- [Send Classifications for Email Studio](https://help.salesforce.com/s/articleView?id=mktg.mc_es_send_classifications.htm&type=5&language=en_US)
- [Legal Email Compliance Guidelines (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/mr-email-marketing-strategies/mr-ems-follow-legal-compliance-guidelines)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Foundations pack (USD $19): https://www.certifyforce.com/practice-exams