Cold Email Compliance: CAN-SPAM, GDPR, CASL and PECR Rules for B2B Outreach
On this page
Why Compliance Matters Beyond Avoiding Fines
Most cold email advice treats compliance as a checkbox: add an unsubscribe link, include your address, and you are fine. In practice, compliance is more nuanced than that, and the consequences of getting it wrong go beyond fines. A spam complaint rate above 0.1% (that is 1 complaint per 1,000 emails) triggers deliverability penalties from Gmail and Outlook that affect all email from your domain, including emails to existing customers. One poorly run cold campaign can tank the deliverability of your entire business email for months.
The four regulations that matter most for B2B cold email are CAN-SPAM (United States), GDPR (European Union), CASL (Canada), and PECR (United Kingdom). Each has different rules, and the one that applies depends on where the recipient is located, not where you are located.
CAN-SPAM (United States)
CAN-SPAM is the most permissive of the four regulations for cold email. It does not require prior consent (opt-in) before sending commercial email. You can email someone who has never heard of you, as long as you follow these requirements.
Every commercial email must include your valid physical mailing address. This can be your office address, a registered P.O. box, or a commercial mail receiving agency (CMRA) address registered with the USPS. A residential address works legally but is inadvisable for obvious reasons. Many cold emailers use a virtual mailbox service.
Every email must include a clear and conspicuous opt-out mechanism. The most common approach is an unsubscribe link in the footer. The opt-out must be processed within 10 business days (though best practice is instant or same-day). Once someone opts out, you cannot email them again from any email address at your company, not just the one that sent the original email.
The "From" name, email address, and subject line must not be deceptive. "From: Google" when you are not Google violates CAN-SPAM. "Subject: Re: our meeting" when you have never met violates CAN-SPAM. Your subject line must accurately reflect the content of the email.
There is no requirement to identify the email as an advertisement if the content is primarily commercial but sent as a one-to-one business communication (as most cold emails are). Mass promotional emails with no personalization are more likely to be classified as advertisements requiring identification.
Penalties for CAN-SPAM violations can reach $51,744 per email (as of 2024, adjusted for inflation). In practice, the FTC pursues enforcement against egregious spammers rather than B2B salespeople, but the legal risk exists.
GDPR (European Union)
GDPR applies when you email anyone located in the EU, regardless of where your business is based. It is significantly stricter than CAN-SPAM.
GDPR requires a "lawful basis" for processing personal data (which includes email addresses). For B2B cold email, the relevant lawful basis is "legitimate interest" (Article 6(1)(f)). Legitimate interest means you have a genuine business reason to contact the person, the email is relevant to their professional role, and your interest does not override their privacy rights.
In practice, legitimate interest for B2B cold email means the recipient is a business professional whose role is relevant to what you are offering. Emailing a VP of Marketing about a marketing tool is defensible as legitimate interest. Emailing the same person about life insurance is not, because it is unrelated to their professional role. The more targeted and relevant your outreach, the stronger your legitimate interest argument.
You must conduct a "Legitimate Interest Assessment" (LIA) before starting a cold email campaign to EU contacts. This is an internal document (not filed with any authority) that records your reasoning: what your legitimate interest is, why the processing is necessary to achieve it, and how you balance your interest against the individual's rights. If challenged, you need to produce this document.
Every email to an EU contact must include a way to opt out, and you must honor opt-outs immediately. You must also state who you are, why you are contacting them (your legitimate interest), and how you obtained their email address if asked. GDPR gives individuals the right to ask what data you hold about them and to request deletion.
Penalties for GDPR violations can reach 20 million euros or 4% of global annual revenue, whichever is higher. EU data protection authorities have been actively enforcing GDPR, and several companies have been fined for unsolicited email campaigns.
CASL (Canada)
CASL is the strictest of the four regulations. It requires express or implied consent before sending any commercial electronic message (CEM) to a Canadian recipient.
Express consent means the recipient actively opted in to receive your emails (checked a box, submitted a form, verbally agreed). Implied consent exists in limited circumstances: you have an existing business relationship (they purchased from you within the last 2 years, or they enquired about your services within the last 6 months), or they conspicuously published their email address without a "no unsolicited email" statement and your message is relevant to their professional role.
The "conspicuous publication" provision is the one that cold emailers rely on. If a business professional's email address is published on their company website, in a directory, or on LinkedIn without a restriction, and your email is relevant to their business or professional role, you have implied consent under CASL. However, this is a narrower permission than CAN-SPAM's blanket allowance.
Every CEM under CASL must identify the sender (your name and business), include your physical mailing address, provide a working unsubscribe mechanism, and be processed within 10 business days of an opt-out request.
Penalties under CASL can reach $10 million CAD per violation for businesses. The Canadian Radio-television and Telecommunications Commission (CRTC) has actively pursued enforcement.
PECR (United Kingdom)
Since Brexit, the UK operates under its own data protection regime: the UK GDPR (which mirrors EU GDPR) combined with the Privacy and Electronic Communications Regulations (PECR). For B2B cold email, PECR provides a "soft opt-in" exception that makes the UK more permissive than the EU for business-to-business communication.
Under PECR, you can send unsolicited B2B emails to a corporate email address (one that identifies the company, like info@example.com or j.smith@example.com) without prior consent, as long as you include an opt-out mechanism and honor opt-outs. Emails to individual subscribers (personal email addresses like j.smith@gmail.com) require consent, even for B2B purposes.
The practical effect: cold emailing UK business professionals at their work email addresses is permissible under PECR, similar to CAN-SPAM. But you must still comply with UK GDPR's data processing principles (purpose limitation, data minimization, accuracy, storage limitation), which means you need a legitimate reason to process their data and you should not retain their data indefinitely.
Building a Compliant Cold Email Program
The safest approach across all four regulations is to follow the strictest applicable rules for each recipient's location. For US contacts, CAN-SPAM's requirements are your minimum. For EU contacts, apply GDPR's legitimate interest framework. For Canadian contacts, verify that the "conspicuous publication" implied consent applies. For UK contacts, ensure you are emailing corporate addresses.
Before launching any cold outreach, verify that your prospect list is clean and accurate. Export your list (CSV), upload to Email Extractor to deduplicate, then run through a verification service to remove invalid addresses. Sending to invalid addresses does not violate any of these regulations directly, but it damages your sender reputation and makes future compliant emails less likely to reach the inbox.
Maintain an opt-out list (also called a suppression list) and check every outreach list against it before sending. Once someone opts out, they stay opted out permanently, across all campaigns and all sending accounts at your company.
