The rules that apply to you: consent for a studio win-back
When you market to a lapsed member you are sending a commercial electronic message, so the consent, the sender identity and the unsubscribe are regulated. The tool applies those rules as a gate for each market the studio operates in, United States first: it holds a no-consent row back and stops a member who asked to stop.
This page reads the instruments The Art of Service holds for the United States, the European Union, the United Kingdom and Australia. Each requirement below is our own statement of a clause we hold, checked against the copy we hold and cited to its clause, and each framework is linked so you can read it yourself. Where a provision is not held at clause level, the page names it and does not state its text. The tool applies the gate; it does not advise on the law.
Grounded in the standards we hold: for the United States, the CAN-SPAM Act and FTC Rule, 10 controls, CCPA/CPRA, 57 controls, and the Illinois Biometric Information Privacy Act, 8 controls; for the European Union, the GDPR, 41 controls, and the EU ePrivacy Directive, 15 controls; for the United Kingdom, the UK GDPR, 44 controls, and PECR, 35 controls; and for Australia, the Australian Privacy Principles, 13 controls, the Spam Act 2003, 12 controls, and the Australian Consumer Law, 70 controls. Each obligation on this page is stated in our own words and cited to its clause.
Which rules apply to a studio win-back message?
A win-back email or text to a lapsed member is direct marketing, and direct marketing to a person is regulated in each market. In Australia the Spam Act 2003 governs the message itself (consent, sender identity, unsubscribe) and the Privacy Act 1988 through the Australian Privacy Principles governs the personal information behind it, while the Australian Consumer Law governs a consumer offer. In the United States the CAN-SPAM Act governs the commercial email, the CCPA/CPRA governs the personal information if the studio meets the thresholds, and the Illinois Biometric Information Privacy Act applies if the studio holds a biometric check-in identifier. In the European Union the GDPR governs the personal data and the ePrivacy Directive governs the electronic marketing message; in the United Kingdom the UK GDPR and PECR do the same. The tool applies the consent gate and the sender-identity and unsubscribe requirements, and leaves the rest to the owner and, where it matters, to a professional.
The jurisdiction section: what applies, per framework
The studio that uses this map may run in four markets, so this page names the held framework for each market the buyer operates in, United States first. The United States frameworks attach to a commercial email sent to a US recipient, to the personal information of a California resident and to a biometric identifier held in Illinois; the European Union and United Kingdom frameworks attach to marketing and personal data in those markets; the Australian frameworks attach to a store carrying on business in Australia. The tool applies the same consent gate in every market and stores nothing unless you save a campaign.
United States frameworks
- United States CAN-SPAM Act of 2003 and FTC CAN-SPAM Rule (16 CFR Part 316), United States. A commercial email must not use false or misleading header information (15 U.S.C. 7704(a)(1)) or a deceptive subject line (7704(a)(2)); it must carry a clear and conspicuous advertisement label (7704(a)(5)(A)(i)) and the sender's valid physical postal address (7704(a)(5)(A)(iii)); it must offer a working opt-out (7704(a)(3)) that is honoured within 10 business days (7704(a)(4)); opting out must not cost anything or carry a hurdle (16 CFR 316.5); and addresses must not be harvested (7704(b)). Open the United States CAN-SPAM Act of 2003 and FTC CAN-SPAM Rule (16 CFR Part 316).
- CCPA/CPRA, United States (California). Where it applies to the studio, a consumer must be told at or before collection (1798.100(a)); collection and use must be necessary and proportionate (1798.100(c)); reasonable security must be maintained (1798.100(e)); a verified deletion request must be honoured and passed on (1798.105(c)); inaccurate information must be corrected (1798.106(c)); a verified request must be answered free of charge within 45 days (1798.130(a)(2)); and a consumer who exercises a right must not be discriminated against (1798.125(a)). A request to stop marketing maps onto the opt-out and the do-not-contact list this tool keeps. Open CCPA/CPRA.
- Illinois Biometric Information Privacy Act (BIPA), United States (Illinois). If a studio collects a fingerprint or a face identifier for check-in, it must keep a written, public retention and destruction schedule (section 15(a)), give written notice of what is collected and why (15(b)(1) and (2)), obtain a written release before collecting (15(b)(3)), never profit from the identifier (15(c)), not disclose it except on the four stated grounds (15(d)), and protect it to a reasonable standard (15(e)). This tool never reads a biometric identifier: if the export carries one, the column is kept and ignored, and these obligations sit with the studio. Open the Illinois Biometric Information Privacy Act (BIPA).
European Union frameworks
- GDPR, European Union. A studio established in the Union, and one outside it that markets to people in the Union, must: process personal data lawfully, fairly and transparently and only for specified purposes (Art. 5); rest the marketing on a lawful basis, usually consent (Art. 6); meet the conditions for consent and honour its withdrawal (Art. 7); give the person the collection information (Art. 13); honour access, rectification, erasure, restriction, portability and objection, including a direct-marketing objection (Arts. 15 to 21); implement data protection by design (Art. 25); keep a record of processing (Art. 30); keep the data secure (Art. 32); and notify a personal data breach to the supervisory authority within 72 hours where feasible (Art. 33). Open the GDPR.
- EU ePrivacy Directive (2002/58/EC), European Union. Read with the GDPR, the Directive requires: do not use electronic mail, SMS or automated calling for direct marketing without the recipient's prior consent, with a limited soft opt-in for an existing customer (Art. 13); do not store information on, or gain access to information stored in, a user's terminal equipment, such as a cookie or a tracking pixel, without clear and comprehensive information and consent (Art. 5(3)); keep the confidentiality of communications and traffic data (Arts. 5 and 6); safeguard the security of a public communications service and notify a personal data breach (Art. 4); and respect the controls on calling-line and location data (Arts. 8 and 9). Open the EU ePrivacy Directive.
United Kingdom frameworks
- UK GDPR (UK General Data Protection Regulation), United Kingdom. A studio established in the United Kingdom, and one outside it that markets to people there, must: keep the principles of lawful, fair and transparent processing (Art. 5); have a lawful basis (Art. 6); meet the conditions for consent (Art. 7) and for a child's consent (Art. 8); give the collection information (Art. 13); honour access, rectification, erasure, restriction, portability and objection (Arts. 15 to 21); meet the safeguards for automated decision-making (Arts. 22B and 22C); keep the data secure (Art. 32); notify a personal data breach to the Commissioner within 72 hours where feasible (Art. 33); and appoint a representative in the United Kingdom where the studio is established outside it (Art. 27). Open the UK GDPR.
- UK Privacy and Electronic Communications Regulations 2003 (PECR), United Kingdom. The Regulations require: do not send direct marketing by electronic mail or text to an individual subscriber without prior consent, with a soft opt-in where the contact details were obtained in a sale (Reg. 22(2) and 22(3)); do not conceal the sender's identity and always give a valid opt-out address (Reg. 23); store or access information on a user's terminal equipment, such as a cookie, only with clear information and consent, with the exemptions in Schedule A1 (Reg. 6 and Schedule A1); do not make unsolicited direct marketing calls where the subscriber has objected or the number is on the Telephone Preference Service (Reg. 21(1)); get prior consent for automated marketing calls and show a contactable calling line identity (Regs. 19 and 21(A1)); and safeguard the security of the service (Reg. 5) and notify a personal data breach to the Commissioner within 72 hours where feasible (Reg. 5A). Open the UK PECR 2003.
Australian frameworks
- Australia Spam Act 2003, Australia. Consent is required for every commercial electronic message (s 16(1)); consent may be express or reasonably inferred from an existing relationship, and is not inferred from a published address alone (Schedule 2 clauses 2 and 4); the sender must be identified with accurate contact details valid for at least 30 days (s 17); a functional unsubscribe facility must be included and stay usable (s 18); messages must stop within five business days of an unsubscribe request (Schedule 2 clause 6); harvested-address lists must never be supplied, acquired or used (ss 20 to 22). Open the Australia Spam Act 2003.
- Australian Privacy Principles (APPs), the principles in the Privacy Act 1988, Australia. A privacy policy must be open and transparent (APP 1); a person must be told what is collected and why (APP 5); personal information must be used only for the purpose it was collected for unless an exception applies, and direct marketing has its own limits (APP 6 and APP 7); personal information must be kept secure (APP 11); a person may access and correct their information (APPs 12 and 13). Open the Australian Privacy Principles (APPs).
- Australian Consumer Law (Competition and Consumer Act 2010 Schedule 2), Australia. A win-back offer is a consumer offer, so it must not mislead: conduct must not be misleading or deceptive (s 18), a representation about a price, a benefit or a result must not be false (s 29), conduct must not be unconscionable (s 21), and a standard-form term must not be unfair (Part 2-3). The illustrative ranking this tool shows is labelled as such for this reason. Open the Australian Consumer Law.
How does the tool apply the gate?
Every row is read for consent before any draft is written. A row with an express opt-in is drafted; a row whose consent is reasonably inferred from the membership is drafted and labelled membership-implied; a row with no consent, or a consent that is only a note, is withheld from every draft and listed with the reason. A row that asked to stop is excluded from every draft and kept on a do-not-contact line you can export. Every drafted message carries the studio name, the contact and an unsubscribe instruction, and a draft missing either is refused rather than shown. The tool never sends; you send through the studio's own platform, so the consent record and the sender identity stay with you.
What this tool does not do
It does not advise on the Spam Act, the Privacy Act, CAN-SPAM, the CCPA/CPRA or the BIPA, and it does not decide your lawful basis for holding the list. It applies the consent gate and the sender-identity and unsubscribe requirements as rules, states its assumptions, and leaves the legal judgement to you and, where it matters, to a professional. No outcome is guaranteed and no revenue figure is a promise.
Frequently asked questions
Can the tool email a lapsed member who never opted in?
No. Under the Spam Act 2003 s 16(1) a commercial electronic message may be sent only with the recipient's consent, and Schedule 2 clause 2 allows express consent or consent reasonably inferred from an existing relationship. A row with no clear consent is withheld and listed, and a row that asked to stop is excluded from every draft.
How quickly must an unsubscribe request be honoured?
Under the Spam Act 2003 Schedule 2 clause 6 commercial messages must stop within five business days of an unsubscribe request, and s 18 requires a functional unsubscribe facility that stays usable for at least 30 days. In the United States the CAN-SPAM Act s 7704(a)(4) requires an opt-out to be honoured within 10 business days, and 16 CFR 316.5 forbids a fee or a hurdle.
What must every drafted message carry?
The Spam Act 2003 s 17 requires the sender to be identified and the contact details to be accurate and valid for at least 30 days, and the CAN-SPAM Act s 7704(a)(5)(A)(i) and (iii) require a clear advertisement label and a valid physical postal address. The tool refuses to show a draft that is missing the studio identity or the unsubscribe line.
Does the tool collect or use anything biometric?
No. It never reads a biometric identifier. If a studio export carried a fingerprint or face-check-in identifier, that column is kept and ignored, and the studio's own obligations under the Illinois Biometric Information Privacy Act (for example the written release in section 15(b)(3)) sit with the studio, not with this tool.