Updated September 2026
Email is still the one marketing channel an online store fully owns, and automated flows keep selling long after you press send. What changed since 2023 is the fine print: Gmail, Yahoo and Microsoft now enforce strict sender rules, Apple has made open rates unreliable, and AI agents now sit inside platforms like Klaviyo. This 2026 guide covers how to grow a consented list, which flows to build first, where SMS and WhatsApp fit, and which numbers to watch.
Key takeaways
- Automations carry the load. In Klaviyo’s benchmark data, flows make up just 5.3% of email sends but generate nearly 41% of email revenue.
- Deliverability is a gate, not a nice-to-have. Bulk senders need SPF, DKIM, DMARC and one-click unsubscribe. Gmail ramped up enforcement in November 2025, and Outlook.com has rejected non-compliant bulk mail since May 5, 2025.
- Stop grading emails on opens. Apple Mail Privacy Protection artificially inflates open rates, so judge performance on clicks, orders and revenue per recipient.
- SMS and WhatsApp complement email. Each needs its own opt-in and has its own costs, and WhatsApp pricing changes again on October 1, 2026.
- Use AI as an assistant, not an autopilot. Klaviyo’s Marketing Agent and Customer Agent can draft campaigns and answer shoppers, but a person should own strategy, offers and final approval.
Why email still earns its place in 2026
Social reach and ad costs move from month to month; your email list does not. Every automated flow you build keeps working without new ad spend.
Klaviyo’s 2026 benchmarks, based on more than 183,000 Klaviyo customers, show that flows generate nearly 41% of total email revenue from 5.3% of sends, with revenue per recipient nearly 18 times higher than campaigns. Meanwhile, the Baymard Institute puts the average documented cart abandonment rate at 70.22%. A well-built abandonment flow is one of the cheapest ways to win some of those shoppers back.
Grow your list with consent
A healthy list starts with people who asked to hear from you. Bought or scraped lists damage deliverability and often break the law.
- Make the value clear. Say exactly what subscribers get: early access, restock alerts, a first-order offer or useful guides.
- Ask one or two questions. A simple “what are you shopping for?” at signup gives you preference data for segmentation from day one.
- Use several entry points. Pop-ups, footer forms, checkout opt-ins and quizzes each capture different shoppers. If your theme makes forms slow or clunky, fix the Shopify store experience first.
- Collect SMS consent separately. Text messaging has its own consent standard, covered below.
Know the basic rules where your customers live. In the US, the CAN-SPAM Act requires a valid physical postal address and a clear opt-out, and opt-outs must be honored within 10 business days, with penalties of up to $53,088 per violating email. In the UK, the ICO’s PECR guidance requires consent, or a “soft opt-in” for existing customers buying similar products, with a chance to opt out at signup and in every message. EU subscribers fall under GDPR consent rules. If you sell into several markets, design your forms for the strictest standard.
The core automated flows every store needs
Build these before you worry about a campaign calendar. Each is triggered by customer behavior, so it arrives when interest is highest.
| Flow | Trigger | What to send |
|---|---|---|
| Welcome series | New subscriber | Brand story, bestsellers, reviews and any promised signup offer |
| Browse abandonment | Viewed a product, no add to cart | A light reminder with reviews or FAQs |
| Cart abandonment | Added to cart, no checkout | Cart contents plus shipping and returns info; an incentive only if margins allow |
| Checkout abandonment | Started checkout, no order | A direct link back that addresses payment or delivery concerns |
| Post-purchase | Order placed or delivered | Thanks, delivery updates, how-to content, a review request, then cross-sells |
| Replenishment | Expected reorder date | A timely “running low?” reminder with an easy reorder link |
| Win-back | No purchase in a set period | New arrivals and a reason to return; suppress if no response |
Abandonment flows are usually the fastest win. Klaviyo’s abandoned cart benchmark report found an average placed order rate of 3.33% and revenue per recipient of $3.65, the highest of any flow type it measured. If you use Shopify’s own email tool, abandoned checkout automations are free and do not count toward the 10,000 free emails included each month.
Keep timing tight: send the first abandonment reminder within hours rather than days, and make sure every flow exits people as soon as they buy.
Campaigns and segmentation
Campaigns are your scheduled sends: launches, restocks, seasonal sales and stories. They perform far better when they go to the right segment rather than the whole list. Klaviyo’s benchmarks put the average campaign click rate at 1.69% against 5.58% for flows, which shows how much relevance and timing matter.
Useful segments to start with:
- Engaged subscribers: people who clicked or ordered recently (define engagement by clicks and purchases, not opens).
- First-time buyers, repeat customers and VIPs: each needs different messages and offers.
- Product or category interest: based on browsing and purchase history.
- At-risk and lapsed customers: Klaviyo offers predicted customer lifetime value and churn risk scoring to help find these groups.
- Regional segments: for time zones, currencies and local moments, for example Ramadan and Eid campaigns for GCC shoppers alongside Black Friday for US and UK customers.
Add a sunset policy: after a final re-engagement attempt, stop mailing people who have not clicked or bought for a long time. Unengaged contacts drag down inbox placement for the whole list.
Where SMS and WhatsApp fit
Email carries detail and storytelling. SMS and WhatsApp suit short, time-sensitive messages: shipping updates, back-in-stock alerts, early access and quick service questions. Treat each as a separate opt-in with its own frequency limits.
SMS
In the US, marketing texts fall under the TCPA and state laws. Klaviyo’s US compliance guidance calls for express written consent, a clear STOP opt-out and respect for quiet hours, and notes TCPA penalties of $500 to $1,500 per violation. Courts are still reshaping these rules: a February 2026 Fifth Circuit ruling rejected the FCC’s written-consent requirement, but only within that circuit. The safe approach has not changed: collect clear, documented opt-in consent and check with counsel before changing your process.
WhatsApp has become a mainstream commerce channel, and Klaviyo added native WhatsApp campaigns and flows in September 2025. It matters most in markets where people already message businesses there, and the UAE is one of them. In a YouGov survey of 1,000 UAE residents commissioned by Zbooni, 65% had used WhatsApp to contact a business in the past year and 85% said they wanted all businesses to offer WhatsApp support.
Budget for it carefully. Meta has charged per delivered template message since July 1, 2025, with marketing, utility and authentication messages priced by country, while replies inside the 24-hour customer service window have been free. That changes on October 1, 2026, when Meta starts charging for service messages and for utility templates sent inside that window. Check current rates before you plan high-volume WhatsApp flows.
Deliverability rules you cannot skip
The largest mailbox providers now require authentication and easy unsubscribes from anyone sending at volume, and as of 2026 they enforce it.
| Provider | Who it applies to | Key requirements | Enforcement |
|---|---|---|---|
| Gmail | All senders, with extra rules for about 5,000 or more messages a day to personal Gmail accounts | SPF or DKIM for everyone; SPF, DKIM and DMARC with domain alignment for bulk senders; one-click unsubscribe plus a visible link; spam rate below 0.3% | Ramped up from November 2025, including temporary and permanent rejections |
| Yahoo | Bulk senders | SPF and DKIM, DMARC of at least p=none, one-click unsubscribe (RFC 8058), unsubscribes honored within 2 days and spam rate below 0.3% | Current requirements |
| Microsoft (Outlook.com, Hotmail, Live) | Domains sending 5,000 or more messages to Microsoft consumer addresses | SPF and DKIM must pass; DMARC of at least p=none, aligned with the From domain | Since May 5, 2025, non-compliant mail is rejected with error 550 5.7.515 |
Two details often catch stores out. First, Google says bulk sender status is permanent once you reach it, even if your volume later drops. Second, Google recommends keeping user-reported spam below 0.1%, never letting it reach 0.3%, and fulfilling unsubscribe requests within 48 hours.
Unsubscribing is also easier than ever: Gmail’s Manage subscriptions view, launched in July 2025, lists senders by how often they email and lets people unsubscribe in one click.
The practical checklist: send from your own authenticated domain rather than a shared default, publish a DMARC record (starting at p=none), enable one-click unsubscribe headers, monitor complaints in Google Postmaster Tools, and warm up new sending domains gradually.
Apple Mail Privacy Protection: stop grading on opens
Apple introduced Mail Privacy Protection in 2021. When it is turned on, Apple Mail preloads images, including tracking pixels, whether or not the person reads the email. As Klaviyo explains, this artificially inflates open rates and makes it harder to spot truly engaged subscribers. Klaviyo tags these as Apple Privacy Opens so you can filter them out.
In practice, make clicks, placed orders and revenue per recipient your main measures of success, judge subject line tests on clicks or conversions, and treat open rate as a rough health signal only. A sudden drop in opens can still hint at a deliverability problem.
AI inside email platforms
Email platforms now ship AI that goes well beyond subject line suggestions. Klaviyo launched a Marketing Agent and a Customer Agent in September 2025; the Customer Agent answers shopper questions across chat, SMS, email and WhatsApp and hands off to people with full context. In June 2026, Klaviyo moved Composer, its AI marketing agent, into public beta; it audits existing flows and builds campaigns. The wider Klaviyo AI toolset also includes AI-built segments, email and SMS copy generation, personalized send times and product recommendations.
Used well, these tools save real time on drafts, flow audits and segment building. Keep a person in charge of anything that affects trust or margin: offers, product claims, brand voice and legal wording. Read every AI-drafted email before it goes live.
The KPIs that matter
| Metric | What it tells you | Watch for |
|---|---|---|
| Click rate | Whether content and offers earn attention | Compare flows and campaigns separately |
| Placed order rate | Share of recipients who bought | Depends on the attribution window you use |
| Revenue per recipient | Revenue efficiency of each send | The best single number for comparing messages |
| List growth and signup rate | Whether acquisition is feeding the list | Quality matters more than raw volume |
| Unsubscribe and spam complaint rate | Whether you are over-mailing or mistargeting | Keep complaints below 0.1% |
| Open rate | A rough health signal only | Inflated by Apple Mail Privacy Protection |
Email platforms tend to credit themselves generously for sales. Cross-check with GA4 and your store data, using consistent UTM parameters, so email is judged on the same basis as paid channels. Our guide to conversion tracking for e-commerce explains how to set that up, and our social media management guide covers how to grow the audience that feeds your list.
Frequently asked questions
How often should an online store send marketing emails?
There is no universal number. Send as often as you have something useful to say to each segment: recent buyers and clickers can take more campaigns, while unengaged subscribers should hear from you less. Watch unsubscribe and complaint rates whenever you increase frequency.
Do I need DMARC if I send fewer than 5,000 emails a day?
Gmail requires SPF or DKIM from all senders and DMARC from bulk senders, meaning close to 5,000 or more messages a day to personal Gmail accounts. Because bulk status is permanent and one big promotion can push you over the line, set up SPF, DKIM and DMARC now. It is usually a short job for whoever manages your domain.
Are email open rates still useful in 2026?
Only as a rough signal. Apple Mail Privacy Protection inflates opens, so judge performance on clicks, placed order rate and revenue per recipient.
Should I use SMS or WhatsApp instead of email?
Use them alongside email, not instead of it. SMS and WhatsApp suit short, urgent messages and conversations; email is better for detail. WhatsApp is especially worth testing if you sell in the UAE and wider GCC, but check Meta’s current pricing first.
Want an email and SMS program that follows the 2026 rules and drives repeat sales? WIMS Global builds and manages Klaviyo flows, campaigns and segmentation through our email and SMS marketing service, and our Shopify development team can fix signup forms and tracking on your store. Start with a free digital audit and we will show you where your list, flows and deliverability stand today.