Penalties vary depending on the severity and nature of the violation. For instance, under the CAN-SPAM Act, each separate email in violation can incur fines up to $43,280. The GDPR can levy fines up to 20 million euros or 4% of the annual global turnover, whichever is higher. CASL can impose penalties up to $10 million per violation.