When do I need someone’s permission to email them?

One thing to get out of the way first: asking visitors about cookies is a different question from permission to email someone - same word, different law. Cookies are covered in What are cookies, and why does my site need a banner?; everything below is about email.

A second thing worth separating early: permission to email somebody is not permission to record what they do with the email. Whether you may see which of your emails a person opens and which links they press is its own question, with its own sentence and its own yes. How do people agree to opens and clicks being recorded? covers it, and nobody who gave permission before that sentence existed counts.

A website invitation is separate again. The message that gives an invited person a way into a private site is practical, transactional mail, not marketing. Inviting them does not grant marketing consent, and unsubscribing from marketing does not take away their website login. Manage who can log in to my website covers that access record.

The one rule underneath everything

Buying something is not the same as agreeing to be marketed to. A receipt, a delivery update, an answer to a question they asked you - that’s all fine, always, because it’s part of doing the thing they came to you for. Anything beyond that - “here’s my new collection,” “join my mailing list,” “I’m running another course” - needs its own, separate agreement. Bernard tracks that agreement per person, not as one setting for your whole site, because what each person agreed to is genuinely different from the next.

The three ways someone can end up on your list, and what each allows

• They bought something. Covers their receipt and order updates only, unless they left ticked the ready-made box above the Buy button offering to hear about similar work from your shop - see Add a new product to my shop page. That box is ticked by default and they can untick it; if they leave it, you can email them about similar work only, never anything unrelated.
• They joined something specific - a waiting list (Tell people when my next course opens) or a registration (Sign people up for my event, class or workshop). Covers only the thing they joined for. Waiting for the glazing course means you can tell them it’s opened; it doesn’t mean you can tell them about a different course, or about anything else you sell.
• They ticked a genuine marketing box, like the one on a PDF download form (Trade a PDF for someone’s email address). Covers whatever the box actually said, for as long as they haven’t unsubscribed. This is the only route to a general “hear about everything I do” - and it’s the only one that needs an unticked, deliberately-ticked box.

Importing a list does not usually bring permission with it

There is a fourth way people arrive - you upload a spreadsheet - and it is the one that catches everybody out. A plain import adds contact records only. It records no agreement, so nobody who arrived that way is in any campaign audience, however long the list is and wherever it came from. The import screen says this before you choose the file, and the result says it again: “12 added, 3 already existed, 1 skipped; none of these can be emailed yet.”

That is not a setting you can switch off. The one carve-out is moving from ActiveCampaign: permission you confirmed there travels with the import, at the lowest authority and behind rails - a short waiting period before it counts, a cap on how many people the first campaign after an import can reach, and sending pauses the moment anyone marks that first campaign as spam. When can I email the people I just imported? is the full timetable. Anyone on a list you didn’t confirm, or brought in any other way, still has no permission until they give one.

Beyond that carve-out, the way back is to ask them: put a form on your site (Trade a PDF for someone’s email address is the usual shape) and invite the people you already know to join it. When one of them fills it in and clicks the confirmation email, their contact page changes to “Said yes”, and only then do they appear in a count.

Two more things worth knowing. A tick on the form is not the finish line - the confirmation click is, and until it happens the contact page says “Said yes on a form on 12 May 2026, but has not confirmed yet” (Remind people who didn’t confirm their signup covers the nudge). And if someone has unsubscribed, bounced or been blocked, that beats any agreement underneath it; see How does unsubscribing from my emails work?.

The pre-ticked-box question everyone asks

It looks like an inconsistency, so it’s worth spelling out: a pre-ticked box at checkout is lawful, and an identical pre-ticked box on a form is not. The difference isn’t the tickbox - it’s what’s already true about the person filling it in. At checkout, they’re already buying from you, and the law lets a past buyer be offered similar-product marketing with a real chance to say no. On a form, nothing has happened yet, so the only lawful yes is one they actively gave. Same widget, opposite rule, because the reason each is allowed is different.

What this means day to day

You don’t need to remember any of this in detail - that’s the point of keeping it per person rather than as one site-wide switch. Ask Bernard who you’re allowed to email and about what, and it answers from what’s actually recorded, rather than assuming everyone on the list is fair game. If nothing was ever agreed, it says so, plainly, rather than guessing yes.

For a one-off send, Who will receive my email campaign? shows how those permissions become the live audience count you approve. If somebody later leaves, How does unsubscribing from my emails work? explains why they stay out until they give a fresh recorded yes.

Bernard also checks the address itself

Separately from permission, bernard looks at every address as it arrives, from a form, a purchase, a course enrolment, the add-contact form or a spreadsheet. It checks the address is shaped like a real one, and that its domain accepts email at all. A spreadsheet import reports how many looked wrong; a single contact carries the note on their own page.

This is only ever a flag, never a block. The contact is created either way and bernard still tries the address, because a domain can be briefly unreachable and losing a real subscriber to a slow answer is worse than a typo getting through. It also has nothing to do with permission: a perfectly-spelled address with no yes behind it still cannot be emailed, and a misspelled address with a confirmed yes still counts as permission. If it turns out not to exist, the first campaign bounces and bernard retires it (Who is on my do-not-email list, and why?).