Rules
Part of Hotel Email Marketing: A Practical Method
Hotel email marketing compliance rules for the US, UK, Canada, and Australia
Hotel email marketing rules in the US, UK, Canada, and Australia: consent, unsubscribe deadlines, transactional messages, frequency, tracking, and ownership.
What to take away
- CAN-SPAM covers US hotel campaignshonest routing, no deceptive subject lines, a postal address, opt-outs honored within 10 business days.
- UK PECR needs consent to the UK GDPR standard, or the soft opt-in for previous buyers. Rented lists meet neither.
- A booking confirmation stays transactional when the booking is its main purpose. Promotions can change that.
- Canada's CASL and Australia's Spam Act set different unsubscribe deadlines.
- Consent evidence and suppression records belong with the campaign, not the agency that sent it.
A hotel email program answers to more than one rulebook at once. A guest in Ohio, a member in Manchester, and a corporate contact in Toronto may sit in a single send. Sort recipients by jurisdiction and purpose first. For the operating side of that work, see Notes on hotel email marketing from the field.
What CAN-SPAM requires from a hotel campaign
The US rule sits in 16 CFR Part 316. It covers commercial electronic mail. A hotel marketing email needs accurate from, reply-to and routing details, a subject line that does not deceive, clear notice that it is an advertisement unless the guest consented, a valid physical postal address, and a working opt-out.
Process each opt-out within 10 business days. Do not keep sending commercial mail to that address unless the guest opts in again. You may not sell or transfer the address, apart from passing it to a compliance service.
Each email can count as a separate violation, and the maximum civil penalty per email is quoted above $50,000, adjusted for inflation in most years (a typical range, not a fixed figure).
Transactional or relationship messages skip the ad label and the opt-out requirement. They still cannot use false routing or a misleading subject line. A folio, a confirmed booking, or a receipt can qualify. A mid-stay spa offer usually cannot.
A guest who unsubscribes from promotions has not asked you to stop confirming their stay.
What UK PECR adds for previous guests
The ICO's guidance on direct marketing using electronic mail sets out the PECR test. Consent must be freely given, specific, informed, and shown by a clear affirmative action. Pre-ticked boxes do not count.
The soft opt-in has four conditions. You collected the details during a sale or negotiations for a sale. You market only your own similar products and services. You offered a simple way to refuse at collection and in every message. The guest did not refuse at the start.
A bought or rented list cannot meet that test, because you did not collect those details yourself. The ICO has historically quoted a maximum monetary penalty of £500,000 for PECR breaches.
Consent and membership are separate records. That split is one of the common guest loyalty marketing questions worth settling before the next send.
Canada and Australia: the deadlines differ
Canada's Anti-Spam Legislation accepts express consent, or implied consent that runs for 24 months after a purchase and 6 months after an inquiry. Every commercial message needs sender identification, a mailing address, and an unsubscribe honored within 10 business days. Business penalties reach CAD 10 million.
Australia's Spam Act 2003 accepts express or inferred consent. It requires accurate sender identification and expects unsubscribe requests to be actioned within 5 business days. Penalties are set in indexed penalty units, so check the current figure.
How often to send, and whether opens can be tracked
No US rule caps how often a hotel may email a consenting guest. The practical ceiling comes from disengagement, which shows up as complaints and falling opens. One to four sends a month is a common range across hotel programs, though the booking cycle matters more than the calendar.
Open tracking uses a pixel that many mail clients block, so reported opens understate the truth. Treat them as a trend rather than a count. In the UK, non-essential cookies and similar technologies need consent under PECR regulation 6. gov/business-guidance/privacy-security/data-security).
For the planning questions that keep returning around frequency and lists, the hotel marketing questions that keep coming back are a useful check.
Example: a routing sheet for a hotel campaign
Fill one row set per campaign so a reviewer can reproduce the decision.
Routing sheet for a hotel campaign
- Recipient location
- United States, Ohio
- Subscriber type
- Individual guest
- Source
- Booking form, opt-in left unchecked
- Basis
- Consent, timestamped at booking
- Brand covered
- The property only
- Purpose
- Rooms and packages for that property
- Mixed content
- None; booking details sent separately
- Tracking
- Open pixel on, click tracking on
- Vendor
- Email platform under written contract
- Suppression
- Master opt-out list, checked at send
- Complaint route
- Front desk inbox, monitored daily
- Review date
- 1 December, or on any rule change
Who owns consent when an agency sends
The hotel owns the consent record, even when an agency builds and sends the campaign. A contract can divide the work, not the accountability. Ask for exportable evidence, a suppression list you control, and named approval for each send. Keep that evidence usable after the contract ends.
For the testing side of the same program, how to improve hotel email marketing sets out a sequence that holds up.
