How Small Businesses Should Approach Email Marketing

What to take away

Small business email marketing questions often mix strategy, law, and deliverability. This article is general planning guidance, not legal advice. Rules vary by jurisdiction, including US CAN-SPAM, Canada's CASL, and UK PECR. Confirm the current rule that applies to the sender, recipient, and message.

Can a business email every customer?

The UK Information Commissioner's Office explains in its electronic-mail compliance guidance that direct-marketing email to individuals generally needs specific consent unless the limited soft opt-in applies. It also addresses bought-in lists, business contacts, opt-outs, and recordkeeping.

Not automatically. Determine message purpose, location, consent or other permitted basis, signup promise, and unsubscribe status. A purchase does not create unlimited marketing permission in every jurisdiction.

Can a business buy a list?

It should not. Purchased and scraped addresses create provenance, permission, complaint, security, and deliverability risk. The seller's claim about legality cannot supply the business with missing evidence or recipient expectation.

Signup wording example: 'Send me the monthly local offers email. I can unsubscribe at any time.' Use an unchecked box, link the privacy notice, and record the date, source, and exact wording.

How often should emails be sent?

Set an expectation at signup and choose a cadence the audience finds useful. A practical starting point: one monthly promotion plus one weekly or biweekly newsletter. A restaurant might send a weekly specials note and a monthly offer.

If complaints rise or content runs thin, reduce to monthly and test. Compare like cohorts and monitor complaints, unsubscribes, conversions, and service capacity rather than copying a universal frequency.

What are SPF, DKIM, and DMARC?

They are related domain-authentication controls used to verify and govern email identity. Configuration affects legitimate systems, so work with the domain, provider, and qualified technical owner; test before stronger DMARC enforcement.

Minimal setup sequence:

Does every email need unsubscribe?

Canada's regulator provides a CASL compliance guide covering consent, sender identification, contact information, proof, and a functioning unsubscribe mechanism. It says unsubscribe requests must be acted on within 10 business days and explains that some implied-consent periods are time-limited.

Marketing and subscription messages generally need an easy opt-out under relevant rules and mailbox-provider requirements. Transactional classifications are narrower than simply emailing an existing customer.

Are open rates reliable?

Treat them as directional. Privacy features, caching, and image blocking can separate a recorded open from human attention. Use clicks, replies, conversions, revenue, retention, and customer feedback with delivery measures.

Should inactive subscribers be deleted?

Review permission, recency, customer status, source, risk, and retention before deciding. Reduce unwanted volume, but preserve suppression information needed to prevent accidental resubscription through another system.

Is automation safe for a small list?

Yes, when the trigger, audience, consent, delay, exclusion, exit, frequency, failure handling, and owner are documented and tested. Complexity should follow a useful customer decision, not software capability. Documented automation rules belong in a small business marketing strategy checklist so triggers and exits stay testable.

Tools such as Mailchimp, Constant Contact, Brevo, and MailerLite offer automation and list management. Provider choice should follow list size, needed integrations, deliverability controls, and owner access.

Typical budget: free tiers often cover a few hundred contacts; paid small-list plans commonly run about $10 to $40 per month, and cost rises with contacts, send volume, and features. Check current provider pricing.

Who should own the account?

The business should control the sending domain, provider account, billing, data, integrations, exports, and recovery. Give staff and agencies minimum roles and remove access immediately when work ends. Keep a documented recovery test and current backup administrator.

Question-to-decision record

Resolve the question with a decision record

The GAO evaluation design guide connects evaluation questions with evidence needs and design choices. The W3C Privacy Principles statement gives web-system designers shared privacy concepts and warns against shifting privacy work to individuals.

Common questions

Is a business card permission to send newsletters?

Not automatically. Document the context, message purpose, jurisdiction, recipient expectation, applicable basis, and available opt-out before adding the address.

Should an inactive address be re-engaged?

Only when permission, recency, source, prior promise, customer status, deliverability risk, and current law support a limited and useful contact.

Can an agency own the email account?

The agency may operate it, but the business should retain domain and account ownership, billing visibility, data exports, recovery, suppression, and an executable offboarding process.