Cold Email Compliance: CAN-SPAM, GDPR and the Rest

Cold email occupies an awkward place in most people's understanding of the law: widely practised, widely assumed to be either completely fine or completely forbidden, and rarely looked at closely. The reality is more specific and more manageable than either belief.

In most of the markets a B2B team cares about, cold outreach is lawful — with conditions attached. The conditions differ by jurisdiction, but they overlap enough that a single sensible operating standard satisfies nearly all of them. What follows is that standard, and the reasoning behind it.

One caveat first, meant sincerely rather than as boilerplate: this is general information written by engineers, not legal advice. If you are operating at scale, in a regulated sector, or in a jurisdiction not discussed here, the cost of an hour with a lawyer is trivial against the cost of getting it wrong.

CAN-SPAM: permission is not the issue, honesty is

The United States regime is the most permissive of the major frameworks and the most widely misunderstood, usually in the direction of assuming it is stricter than it is.

CAN-SPAM does not require consent. You may send commercial email to someone who never asked for it. What it requires is that you do so without deceiving them. The From address and the routing information must be accurate. The subject line must not misrepresent what the message is about. You must identify the message as a commercial solicitation, disclose who is sending it, and include a genuine physical postal address. You must provide a working opt-out, and honour it within ten business days.

Most cold email that gets companies into trouble under CAN-SPAM fails on the honesty requirements rather than the mechanical ones. A subject line implying a prior conversation that never happened, a From name chosen to look like a personal contact, an unmonitored reply address — these are the violations that matter, and they are also the practices that produce spam complaints, which is not a coincidence.

GDPR: a lawful basis, not a prohibition

The European position causes the most confusion, largely because "GDPR" gets used as shorthand for "you cannot email people", which is not what it says.

GDPR governs the processing of personal data. A named person's work email address is personal data, so building a prospect list and mailing it is processing, and processing requires a lawful basis. Consent is one lawful basis. It is not the only one, and for B2B outreach it is usually not the relevant one.

The relevant basis is legitimate interest. Direct marketing is explicitly recognised as capable of being a legitimate interest. To rely on it you need to have actually done the assessment: identified your interest, considered whether the processing is necessary to achieve it, and weighed it against the recipient's rights and reasonable expectations. A senior decision-maker at a company that plausibly needs what you sell, contacted at their work address about their professional role, sits comfortably inside that. An individual at a personal address, contacted about something unrelated to their work, does not.

Three obligations follow and are frequently skipped. You must be able to say where you got the data — and tell the recipient if they ask. You must make objecting easy and honour it immediately, without the balancing test being reopened. And you must be able to show your reasoning: an assessment you never wrote down is difficult to rely on later.

The UK adds PECR alongside GDPR. Its practical effect for B2B senders is that corporate subscribers are treated more permissively than individuals and sole traders, so segmenting those out is worth the effort.

The requirements that appear everywhere

Read across the regimes and the same handful of obligations keep reappearing, in different language. That overlap is the useful part, because meeting the strictest version of each is simpler than maintaining four separate compliance postures.

Be honestly identifiable. Real sender, real company, real reply address, a subject line that describes the message. No regime permits deception, and no filter rewards it either.

Include a real postal address. Explicit under CAN-SPAM, and good practice everywhere. It is a small trust signal and its absence is an easy violation to prove.

Make opting out trivial, and honour it fast. The legal deadlines vary from immediately to ten business days. The mailbox providers now require two. Since the strictest applicable standard is the one you must meet, the only sane implementation is automatic and immediate — and the friction you remove converts complaints into quiet opt-outs, which protects the domain.

Know your list's provenance. Under GDPR this is a formal obligation. Everywhere else it is the difference between a list you can defend and one you cannot. It is also the best available predictor of bounce rate, which is why the compliance answer and the deliverability answer point the same way.

Compliance and deliverability are the same work

The most useful thing to notice about all of this is that almost none of it is in tension with performance.

Honest headers reduce complaints. Easy unsubscribe reduces complaints. A list built deliberately bounces less, which protects your domain reputation, which is the thing that determines whether any of your mail arrives. The regulatory floor and the deliverability floor turn out to be roughly the same floor, approached from different directions.

The practices that create legal exposure — bought lists, misleading subject lines, unsubscribe links that quietly do nothing — are the same practices that destroy sending reputations. Teams that treat compliance as a checkbox exercise separate from deliverability usually end up doing the work twice.

RepMail adds the standard List-Unsubscribe and List-Unsubscribe-Post headers to every campaign message, and maintains a workspace-wide suppression list that is enforced at send time — so an opt-out or a complaint on one campaign is honoured on every later one, including lists imported afterwards. Bounces and complaints are suppressed automatically from the delivery telemetry rather than needing manual cleanup. What the platform cannot do is tell you your lawful basis, or vouch for where a list came from; that judgement stays with the sender.