By Alpit Patel and the aibrevo team · October 13, 2026 · 8 min read
GoHighLevel CAN-SPAM Setup: Unsubscribe, Address and GDPR
For GoHighLevel CAN-SPAM compliance, keep an unsubscribe link in every marketing email (Business Profile, General tab, Include Unsubscribe Link, or the unsubscribe tag), type your postal address into the footer yourself, label ads, keep header details honest and honor opt-outs within 10 business days. GDPR adds a lawful basis and a right to object to direct marketing.
Part of the guide: GoHighLevel compliance
Key takeaways
- CAN-SPAM has eight requirements per the FTC guide: honest headers, honest subject lines, an ad label, your location, a clear opt-out, opt-outs for subscribers too, prompt honoring of opt-outs, and responsibility that stays with you even when a vendor sends. Opt-outs must be processed within 10 business days.
- In HighLevel, turn on Include Unsubscribe Link under Sub-Account Settings, Business Profile, General, or place the unsubscribe tag in each email. Using both puts two links in one email.
- HighLevel's footer element has no dedicated address field in its documentation. Type the postal address into the footer text yourself.
- HighLevel adds a List-Unsubscribe header that its article says cannot be disabled. Keep the in-body link too.
- GDPR is a separate law. HighLevel is the processor and you are the controller; Article 21 gives people the right to object to direct marketing at any time.
CAN-SPAM compliance in GoHighLevel comes down to four things you can see in the email: an unsubscribe link that works, your postal address, a clear ad label with honest sender details, and an opt-out you honor. HighLevel supplies the unsubscribe plumbing. The address, the labeling and the list are yours. This page is the email chapter of the GoHighLevel compliance guide, written for people who send marketing email from HighLevel and want the checklist in one place.
Checked on 2026-10-13 against the FTC’s CAN-SPAM compliance guide, HighLevel’s help center and GDPR Article 21. This is not legal advice. Counsel handles edge cases, especially for EU and UK recipients.
What does CAN-SPAM actually require?
The FTC’s guide lists eight requirements, and they apply to commercial email. Paraphrased from the FTC page:
| # | Requirement | What it means in practice |
|---|---|---|
| 1 | Accurate header information | From, To, Reply-To and routing details must be truthful and identify who sent it |
| 2 | Honest subject lines | The subject must match the content |
| 3 | Identify the message as an ad | Clearly and conspicuously |
| 4 | Include a valid postal address | In the message |
| 5 | Explain how to opt out | A clear way, including an option to stop all marketing email, not blocked by spam filters |
| 6 | Subscribers and members can opt out too | A message with no unsubscribe link must fall within the Act’s transactional or relationship categories |
| 7 | Honor opt-out requests promptly | Within 10 business days; the method must work for at least 30 days after sending; no fee, no more than an email address; do not sell or transfer opted-out addresses (except to a company hired to help you comply) |
| 8 | Monitor what others do on your behalf | Hiring a sender does not transfer your legal obligations |
Source: FTC, CAN-SPAM Act: A Compliance Guide for Business, checked 2026-10-13.
Transactional or relationship messages are judged by their primary purpose and are generally exempt from most provisions, but cannot carry false routing information. The FTC reads those categories narrowly: a mixed message whose subject line suggests a commercial message is treated as commercial.
On cost, the guide says each separate email in violation can carry penalties of up to $53,088, noting the figure was updated in January 2024. That number is inflation-adjusted, so check the page for the current one. Both the company whose product is promoted and the company that originates the message may be held responsible.
How do I add an unsubscribe link in GoHighLevel?
Turn on the default link or use the tag, never both. HighLevel’s help article gives the two paths.
Default link (every email from the sub-account):
- Go to Sub-Account Settings > Business Profile.
- Open the General tab.
- Toggle on Include Unsubscribe Link. The link is added to the footer of every email sent from that sub-account, and you can customize its text or destination.
Tag (per email): put {{unsubscribe}} anywhere in the LC Email Builder (Conversations, Email Campaigns or Email Templates under Marketing), or use the built-in custom value “UNSUBSCRIBE LINK”. When the email sends, it becomes a clickable opt-out link.
If you turn the default off, you must add the tag to every email to stay compliant. HighLevel warns that using both methods puts two unsubscribe links in one email, which clutters the design and confuses recipients.
To confirm it worked: send a test to a mailbox you control, find the link in the footer, click it, then open the contact and check that Email DND is on.
Where does my postal address go?
In the email footer, typed by you. HighLevel’s footer element article describes the footer as a prebuilt section for company details, copyright text and compliance links, with no dedicated address fields: you add business name, address or legal text as text content in the Edit tab. The article does not say the address is pulled from account settings.
The practical consequence: an email built from a template missing the footer text goes out with no address. Put the address in your master footer or saved template, and check the rendered email, not the builder. A P.O. box is not covered by anything I opened, so if you use one, confirm with counsel that it qualifies as a valid postal address.
Does GoHighLevel honor unsubscribes automatically?
Yes, inside the platform. HighLevel’s DND article says Email DND turns on automatically after an unsubscribe, a spam report or a permanent bounce. Marketing emails cannot bypass it, although invoices, calendar notifications and system notifications can. To lift Email DND you need a valid address that is not on suppression lists, followed by a manual DND update, and you need the person’s renewed consent first.
HighLevel also adds a List-Unsubscribe header. Its article says the header gives recipients a one-click unsubscribe in the inbox, processes the opt-out and updates the contact record automatically, “cannot be disabled”, and is increasingly required by Gmail and Yahoo. The option shows only when inbox providers trust the sender’s reputation, header unsubscribes are not counted as spam complaints, and the in-body link should stay.
Two limits to be aware of:
- Other systems are not covered. If you also email the same people from another tool, an opt-out here does not reach it. The FTC says you must honor opt-outs for the whole business; keep one suppression list.
- Imports. If you import contacts from another system, bring over its unsubscribes first. I did not verify HighLevel’s import option for marking contacts as Email DND, so look for it in the import screen before you mail.
Which sending settings affect compliance?
CAN-SPAM requires honest header information, which includes a From address that matches who is sending. HighLevel’s email sending guide says the From Email must be on the same organizational domain as the dedicated sending domain, each sub-account should have its own dedicated domain (“Do not share sending domains across sub-accounts”), and the DMARC record should be set at _dmarc. Mismatched domains cause poor deliverability and DMARC misalignment. The full setup is in our SPF, DKIM and DMARC guide.
Complaints and bounces are compliance signals too. HighLevel’s article says to remove hard-bounced contacts immediately, enable validation on first send and re-validate every 90 days, and stop sending to unengaged contacts. Bounce thresholds can suspend your sending; see the email suspension rules and the FAQ on suspended sending.
| Symptom | Likely cause | Fix |
|---|---|---|
| Two unsubscribe links in one email | Default link on and tag in the template | Use one method per email |
| No unsubscribe link at all | Default toggled off and no tag | Turn the toggle on or add the tag |
| No postal address in the email | Footer element left blank | Type the address into the footer text |
| Opted-out contact keeps receiving email | Sent from a second tool, or DND lifted by hand | Merge suppression lists; re-check DND |
| Email filtered to spam after sending | Domain not authenticated or aligned | Fix SPF, DKIM, DMARC and the From domain |
What does GDPR add for email in HighLevel?
GDPR is a separate law with a different test: whether you have a lawful basis to email a person in the EU or UK at all. HighLevel’s role is processor and yours is controller; our GDPR FAQ covers the DPA, US hosting and cookie banner, and this page covers only what touches email.
- Right to object. Article 21(2) gives people the right to object to processing for direct marketing at any time, and 21(3) says their data may then no longer be processed for that purpose. The unsubscribe link plus Email DND is how you honor that in HighLevel.
- Consent records. Use an unchecked consent box on forms and store the wording and timestamp, as the GDPR FAQ describes.
- Cold lists. A purchased or scraped list rarely has a lawful basis. HighLevel’s sending guide generally advises against cold email; see can you send cold emails with GoHighLevel.
- Erasure requests. Delete the contact; HighLevel keeps deleted contacts restorable for 60 days according to our GDPR FAQ.
Consent rules for text messages are different again; see the TCPA consent and opt-out guide. The one thing to remember is that CAN-SPAM lets you email without prior consent if you offer an opt-out, while GDPR often does not.
Email compliance check before every campaign
- Unsubscribe link present once, working, and Email DND confirmed in a test.
- Postal address visible in the rendered footer.
- From name, From address and reply-to are accurate for the sending domain.
- Subject matches the content; the email is identifiable as an ad.
- Opt-outs from other tools merged into the list.
- Recipients have a lawful basis (consent records for EU and UK contacts).
- Domain authentication passes; bounce rate is under control.
If you want this built into your templates and workflows rather than checked by hand, aibrevo’s GoHighLevel service covers email setup; scope decides the price, see pricing or contact us.
Sources
- FTC, CAN-SPAM Act: A Compliance Guide for Business: eight requirements, 10 business days, penalty figure, responsibility. Checked 2026-10-13.
- HighLevel Support, Managing default unsubscribe links in LC Email: Business Profile toggle, unsubscribe tag, two-link warning. Checked 2026-10-13; no date shown in the extracted text.
- HighLevel Support, Footer element in Email Builder: no dedicated address fields. Checked 2026-10-13.
- HighLevel Support, How List-Unsubscribe helps email deliverability: header cannot be disabled. Checked 2026-10-13.
- HighLevel Support, How to set up and use DND: Email DND behavior. Checked 2026-10-13.
- HighLevel Support, Email sending guide: domain alignment, DMARC, validation, bounces. Checked 2026-10-13.
- GDPR, Article 21: right to object to direct marketing, paragraphs 2 and 3. Checked 2026-10-13.
- Not verified: whether a P.O. box satisfies the postal address requirement (the FTC page was summarized, not quoted on this point); HighLevel’s import option for loading prior unsubscribes; whether the Business Profile address feeds the footer.