Email marketing is bound by CAN-SPAM and GDPR (for Europe) regulations which require you to protect users' privacy and avoid emailing to purchased lists. Besides these, some standard practices involve using opt-in, offering an unsubscribe link within the email, storing the user consent, updating the email lists, monitoring the results of the campaigns, and clearly identifying yourself when sending emails.