This paper analyses email marketing as a legitimate form of commercial email, which, if abused, can become spam. The discussion begins with the contextualisation of privacy in the digital environment, to understand the importance of the protection of personal data and the consent of its holder for its use. Then, email marketing and the abusive practice of spam are addressed. Opt-in and opt-out consent systems are also presented, which, if complied with, legitimise the sending of an electronic commercial communication such as e-mail marketing. The United States, the European Union and Brazil have adopted regulations that implement these systems, the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM), Directive 2002/58/EC and the Code of Self-Regulation for the Practice of E-mail Marketing (CAPEM), respectively, which are discussed throughout this paper. In the end, it is proposed the responsive regulation of the practice of email marketing in Brazil by the National Data Protection Authority, in order to improve and make effective the regulation of this practice and, thus, guarantee the privacy of citizens.