Email marketing for business: consented lists, segmentation and correct measurement

An email list is an asset a business owns, independent of social media algorithms. It is also where risk builds up: purchased addresses, unclear sign-ups, bursts of sending and misread numbers.

This article draws on Google and Yahoo sender guidelines, Apple's Mail Privacy Protection page, Mailchimp and Klaviyo help pages, and Decree 91/2020/ND-CP read through a copy on luatvietnam.vn, checked on October 22, 2026.

Click Star sells digital marketing and CRM services, so it has an interest in this topic.

Key points

• Every address needs evidence that the person wants the mail. Google and Yahoo both advise against buying lists and against pre-checked sign-up boxes.
• All senders to Gmail and Yahoo must keep spam complaints below 0.3% (Google writes 0.30%). Bulk senders must also support 1-click unsubscribe; Yahoo requires unsubscribes to be processed within 2 days.
• Decree 91/2020/ND-CP (via a copy) treats advertising email without prior consent as spam, and requires keeping sign-up and refusal records for at least 1 year.
• Double opt-in (email confirmation) filters out wrong addresses and fake sign-ups. Google, Yahoo and Mailchimp describe it. Decree 91 (copy) does not name that process but requires measures to verify clear consent (Article 11, clause 4).
• Open rate cannot be trusted alone because Apple Mail Privacy Protection stops senders from knowing whether a message was opened. Track bounces, spam complaints, unsubscribes, clicks and revenue per email.
• There is no industry-standard sunset threshold. The 90 and 180 day ladder here is a Click Star reference framework.

What a consented list means

An address belongs on a consented list when the business can show that the person asked to receive mail, when, and through which form. Addresses from business cards, third-party purchases or order records do not automatically qualify.

Google's sender guidelines (no date shown, read October 22, 2026) say to send only to people who want your messages, because they are less likely to report spam; the page advises against buying addresses and pre-checked boxes. Yahoo (also undated) says much the same.

What Google and Yahoo require from bulk senders

According to Google's Email sender guidelines page (read October 22, 2026), from February 1, 2024 senders of more than 5,000 messages a day to Gmail accounts must meet a separate set of requirements. Marketing messages must support 1-click unsubscribe, with a clearly visible unsubscribe link in the message.

Google's FAQ (read October 22, 2026) says this excludes transactional mail such as password resets, and needs List-Unsubscribe headers under RFC 8058; a mailto or plain web link does not qualify.

It recommends processing unsubscribes within 48 hours, and its current-requirements table also lists unsubscribes not honored within 48 hours as an issue (no delivery support or mitigations).

On spam complaints, Google's guidelines say below 0.3% in the requirements section for all senders to Gmail (0.30% in the section for over 5,000 messages a day), and below 0.10% while never reaching 0.30% in the monitoring section.

Yahoo (read October 22, 2026) sets similar requirements: List-Unsubscribe with 1-click support and unsubscribes honored within 2 days for bulk senders; spam complaints below 0.3% for all senders.

Vietnamese law on advertising email

This section rests on Decree 91/2020/ND-CP (issued August 14, 2020, effective October 1, 2020), read through a copy on luatvietnam.vn on October 22, 2026, not an official portal. Click Star does not give legal advice: check the original and ask a lawyer.

What the copy says, by the Article numbers in that copy:

• Articles 3 and 11: advertising email without prior consent is spam; consent includes declaring and confirming on a sign-up form on the advertiser's website, app or social network; the advertiser must be able to verify it.
• Article 11: keep sign-up, refusal request and refusal confirmation records for at least 1 year.
• Article 13: stop sending immediately after a refusal; no more than 3 advertising emails to 1 address within 24 hours unless otherwise agreed.
• Article 18: label advertising email [QC] or [AD] at the very start of the subject line.
• Articles 19 and 20: show advertiser details right before the opt-out section at the end of the email; allow refusal through a website or social network, by email and by phone; send a confirmation once, with no advertising.

According to a news item on luatvietnam.vn (secondary source), Decree 330/2026/ND-CP, issued August 19, 2026, sets penalties for advertising email sent without consent (Article 37); Click Star has not opened the original text, so it states no amounts. A Ministry of Public Security draft to replace Decree 91 (a file on bocongan.gov.vn) is not in force.

Double opt-in and the consent record

Double opt-in is a 2-step process: the person fills in a form, then clicks a link in a confirmation email before joining the list (Mailchimp, About Double Opt-in page, read October 22, 2026).

Google advises confirming each address before subscribing; Yahoo says the step prevents accidental or malicious sign-ups, fake addresses and most bots. Mailchimp notes that double opt-in for email works only with its own sign-up forms.

Click Star inference, not something the source says: a business with its own CRM must run the confirmation step itself.

Also a Click Star inference: Decree 91 (copy) does not name double opt-in, but Article 11, clause 4 requires advertisers to verify clear consent, and a confirmation email is one way to hold evidence of it. Circular 22/2021/TT-BTTTT has not been checked.

Click Star reference framework, not from outside sources: each consent record should hold at least 6 fields.

• Email address and the channel consented to (email, Zalo and SMS kept separate).
• Time of sign-up and time of confirmation click.
• Sign-up source: which form, page and campaign.
• The exact consent wording shown at that moment.
• Current status: subscribed, unsubscribed, bounced.
• Time and source of any refusal request.

Segmenting by behavior

Segment by what recipients do, not only by what they declare.

Click Star reference framework, not from outside sources: 4 groups are enough for a small business.

• New and not yet purchased: a welcome series that states what they will receive and how often.
• Active: recent click or purchase, full sending schedule.
• High value by RFM: dedicated content, personalized mail.
• Cooling: long without a click or purchase, lower frequency and entry into the sunset process.

Frequency and sunset policy

The right frequency is the one subscribers were told to expect. Yahoo advises honoring the list's original intent, for example not turning a weekly newsletter into daily mail. The 3 emails per 24 hours in the decree is a legal ceiling, not a recommended level.

For silent recipients, Google advises periodically asking whether people still want to be subscribed, and considering unsubscribing those who do not open or read.

Klaviyo (page updated July 7, 2025) warns that sending to profiles that have not engaged for 3 to 6 months can push mail into spam folders.

No source gives a universal threshold. Mailchimp (read October 22, 2026) says how long until someone counts as inactive depends on frequency and product type, from not opening the last 5 emails to a year or more; the business decides.

Click Star reference framework, not from outside sources; adjust it to your real sending frequency:

• Engaged: a click or purchase in the last 90 days, keep the normal schedule.
• Cooling: 90 to 180 days without a click or purchase, lower frequency, send useful content instead of stacked promotions.
• Dormant: over 180 days, send 1 email asking whether the person still wants mail.
• Stopped: no reply to the reconfirmation, move to the marketing suppression list.

Stopping is not deleting the record: the refusal record is still needed to avoid mailing someone by mistake.

Metrics to track, and why open rate is no longer enough

Open rate is measured with 1 hidden tracking pixel. According to Apple's Mail Privacy Protection page for iPhone (read October 22, 2026), the feature hides the IP address and stops senders from seeing whether a message was opened; it does not extend to links or attachments.

Mailchimp (MPP FAQ, read October 22, 2026) explains the effect: Apple Mail preloads the pixel even if the recipient has not opened the message, so mail can be recorded as opened and open rates inflate. It says clicks and purchases are stronger signals and are not affected.

Clicks are not perfectly clean either: Mailchimp (bot activity page, read October 22, 2026) says non-human interactions, such as antivirus scans, can inflate both opens and clicks.

Click Star proposes this set of metrics:

• Bounces: Yahoo advises monitoring hard and soft bounces; Google mentions auto-unsubscribing recipients with repeated bounces.
• Spam complaint rate: via Google's Postmaster Tools and Yahoo's feedback loop (CFL).
• Unsubscribe rate: Mailchimp advises tracking it alongside bounces and conversions.
• Clicks: read together with a bot filter if the platform has one.
• Revenue per email: Mailchimp mentions campaign-attributed revenue; dividing it by emails sent is Click Star's own definition.

Open rate can still be viewed, but only to compare trends within the same list, not as a condition for removing recipients or triggering automation.

A/B testing subject lines

Subject-line tests still help, but the winning criterion must change: Mailchimp says A/B results based on open rate may be inaccurate and suggests click rate. Click Star's rule: change 1 element at a time and fix the winning metric in advance.

Click Star's view. List quality matters more than list size. A small list with confirmation, records and a sunset process carries less reputation risk than a large mixed list.

A 4-step plan over 30 days

• Days 1 to 7: inventory address sources and separate addresses of unknown origin from the main sending list.
• Days 8 to 14: fix the forms (remove pre-checked boxes, add clear consent wording), turn on confirmation email, record consent.
• Days 15 to 21: check 1-click unsubscribe and the [QC] or [AD] label; build the 4 behavior groups.
• Days 22 to 30: run the sunset ladder for the cooling group, move reports to the primary metrics, run A/B tests on clicks.

Common mistakes

1. Buying or renting a list and sending right away; Google and Yahoo both advise against it.
2. Merging every address into 1 list and sending at the same frequency, whatever each person signed up for.
3. Using open rate as the main criterion for A/B tests, segmentation and automation triggers.
4. Putting the unsubscribe link only in the footer, missing the List-Unsubscribe header, or processing unsubscribes slowly.
5. Not recording the source and time of consent, so it cannot be shown when asked.

What is not known

• No industry-standard sunset threshold appears in the documents read; the 90 and 180 day ladder is Click Star's and has not been independently verified.
• No Vietnam-specific figures were found on Mail Privacy Protection adoption or bot-generated clicks.
• Brevo's page was blocked to the tools (code 403) and Klaviyo's double opt-in page could not be opened, so that part rests on Mailchimp, Google, Yahoo.
• It is unclear how Decree 91/2020 applies to transactional mail, mail to existing customers or business-to-business mail.
• The original of Decree 330/2026/ND-CP was not opened, so no penalties are stated; the copy of Decree 91 marks its Chapter IV (penalties) as repealed by Decree 14/2022/ND-CP, so no Decree 91 penalty provision is cited. It is unknown whether the draft replacing Decree 91 will be issued.