Sending legally mandated email

Sometimes you’re legally required to email a large group of people, such as a data breach notification, a product recall, or a court-ordered class action notice. These sends often include contacts who have unsubscribed, bounced, or haven’t heard from you in over a year, which makes them some of the riskiest emails you can send. In Loops, a notice that needs to reach unsubscribed contacts is sent as a critical notice. This guide covers how to plan and deliver one to a large audience. It’s based on the M3AAWG Best Practices for Sending Legally Mandated Emails to Large Audiences (version 2.0, September 2026). It isn’t legal advice. Check with your legal counsel about what your mandate actually requires.

​

Is your email legally mandated?

M3AAWG describes legally mandated email as an exception to the rule. It’s a bulk message you’re legally required to send, even to addresses that have opted out, been suppressed, or haven’t been emailed in more than a year. It isn’t for standard marketing or transactional email. Depending on your jurisdiction, examples include:

• Personal data breach notifications, under laws like GDPR Articles 33–34, the HIPAA Breach Notification Rule, or U.S. state breach-notification statutes
• Court-ordered class action notices, such as those under FRCP Rule 23
• Product recalls
• Health and safety notices

Not every important email is legally mandated. M3AAWG separates high-risk communications, like terms and conditions updates, from legally mandated messages, like class action notices. A high-risk communication can still be sent as a critical notice, but it may not need to reach your entire audience. Before planning a send to everyone, ask your legal team:

• Does the mandate require email, or does it allow other notification methods?
• Who has to be notified? Only impacted people, or every contact you have?
• Do you need proof of send for auditing? What does that proof need to include?
• Could the notice be added to an email you already send instead?

​

Consider other ways to notify people

Email isn’t always the most effective way to deliver a notice. Addresses on file may be inaccurate or abandoned, mailbox providers may filter the message as bulk mail, and recipients may ignore an email they weren’t expecting. M3AAWG recommends raising other notification methods with courts or regulators early in your planning, unless the mandate specifically requires email. Options include:

• A public page on your website with the date, the notice itself, who is affected, and other details. This is useful even if your site has no logged-in users.
• Push notifications in your app
• Postal mail
• Social media posts
• Traditional media, such as newspaper, radio, and television
• SMS and messaging apps commonly used where your recipients live

Some contacts can’t be reached by email at all. Loops suppresses addresses that hard bounced or reported spam, and suppressed contacts won’t receive any email, including critical notices. M3AAWG suggests postal or newspaper notices for these people.

​

Contact us before you send

Loops manages the sending infrastructure behind your account, including IP addresses and reverse DNS. For large legally mandated sends, we also handle contacting mailbox provider postmasters ahead of time so they know what to expect. We can only do this if we hear from you first. Contact us at least 3 weeks before your send and include:

• A copy of the notice, or a link to it
• Contact details where recipients can get more information
• How many contacts you plan to send to
• The dates and times you plan to send, or a date range if sending over several days
• Whether you need proof of send for auditing
• Whether the notice needs to reach unsubscribed contacts, so we can set up a critical notice

​

Send from your existing domain

Send the notice from your existing Loops sending domain. We generally recommend against setting up a new subdomain or domain just for a mandated send. A new subdomain has no sending history. Pairing a cold domain with a large audience that includes unsubscribed and inactive contacts makes it far more likely your notice is filtered or rejected. In Loops, a different domain also means a separate team, so your audience and settings aren’t shared. M3AAWG recommends sending from a clearly identifiable subdomain of your brand, so recipients recognize that the notice comes from you. Your Loops sending domain usually already is one, like mail.example.com. Avoid new domains, lookalike domains, or variations on your normal sending domain. If you think you need a dedicated subdomain for notices, talk to us first.

​

Make sure the sender is accurate

Recipients need to trust that the notice is real, especially if they haven’t heard from you in a while.

• Send from the responsible organization. The notice should come from a domain owned by the organization that’s legally required to send it.
• Authenticate your domain. SPF, DKIM, and DMARC must be in place. The records from your domain setup cover all three. See DMARC and DKIM setup for more.
• Use a descriptive From name. Set the Name in your sending settings to something like Acme: Notification, distinct from the name you use for marketing.
• Use a monitored Reply address. Recipients may reply with questions, so make sure someone will read them.

​

Plan the send

• Send in phases. Start with the most engaged contacts, so problems don’t affect the people who most need the notice. M3AAWG suggests this order: impacted users, active users, subscribed users, then unsubscribed users. Use filters and segments to build each batch.
• Pause your marketing email. Consider pausing campaigns during the notification period to avoid volume spikes that can trigger spam filters.
• Brief your team. Make sure support, social, and anyone else talking to customers has the same information.

​

Keep the message focused

Follow the critical notice best practices: use Plain mode, write a clear subject line, and leave out any marketing content. Keep links to the ones that are required, or include none at all. You can turn off link tracking for the whole email or for individual links. Court-mandated notices often carry their own requirements, such as plain language, screen reader compatibility, or translations. Follow them exactly.

​

Read more