The Jurisdictional Trap: Where Your Recipient Lives Matters

The location of your subscriber trumps the location of your company. A US-based marketer emailing London subscribers still needs to abide by GDPR, and a Canadian agency emailing New York contacts still needs to satisfy CAN-SPAM. Three distinct consent models coexist, and the one that applies to you depends entirely on where your recipient lives.

Opt-out (US, CAN-SPAM) lets you send first and offer an unsubscribe later. As Emailchef's compliance guide puts it, CAN-SPAM is "a slightly softer version of the GDPR" because there is no obligation to obtain explicit consent before sending. The catch is the fine print: accurate sender info, honest subject lines, a physical postal address, and a working unsubscribe honored within 10 business days.

Opt-in (EU, UK, Canada) requires explicit permission before the first send. GDPR consent must be freely given, specific, informed, and unambiguous. Pre-checked boxes don't qualify, and vague language like "by browsing our website you agree to receive emails" is not consent.

Soft opt-in occupies the middle ground. Under the ePrivacy Directive's Article 13, existing customers can receive marketing about similar products if they had a clear chance to object at collection and in every subsequent email. It's narrow, and it doesn't apply to cold prospects.

The practical rule that most compliance guides converge on: if you send internationally, follow GDPR. It's the strictest of the three, and complying with it automatically satisfies most CAN-SPAM requirements as well. For a growth partner like Worqd that runs campaigns across B2B and B2C verticals in multiple countries, that means building every send around documented consent, clear purpose language, and an easy unsubscribe as the default.

Here's what each regime looks like at a glance:

• United States (CAN-SPAM): Opt-out model. Penalties reach $53,088 per separate offending email under the FTC's 2025 inflation adjustment.
• European Union (GDPR + ePrivacy): Opt-in required. Fines reach €20 million or 4% of annual global turnover, whichever is higher.
• Canada (CASL): Express or implied consent required. Described as one of the strictest anti-spam laws in the world, with penalties up to $10 million CAD per violation for businesses.
• UK (PECR): Opt-in required alongside GDPR. Fines reach up to £500,000.

One nuance worth flagging: CASL recognizes implied consent with hard time limits (two years after a purchase, six months after a general inquiry). GDPR's "legitimate interest" basis is characterized as risky for marketing because the recipient's fundamental rights can often override it. When in doubt, treat the stricter reading as the real one.

Penalties and the Cost of Guessing

The bill for a compliance mistake almost never matches the size of the company that made it. Regulators fine on the basis of the violation, not your headcount, and the numbers are steep enough to end a small business outright.

Start with Europe. Under GDPR, a breach can cost up to €20 million or 4% of annual global turnover, whichever is higher, according to GDPR.eu's breakdown of email rules. That ceiling isn't theoretical: Amazon received a GDPR fine of €746 million ($812 million), and Google paid €50 million to France's CNIL for burying consent information across multiple documents. In the US, the CAN-SPAM Act allows up to $53,088 per separate offending email under the FTC's 2025 inflation adjustment, per MoEngage's compliance summary. One careless campaign to a 20,000-person list isn't a warning letter. It's a number with seven figures in it.

Canada's CASL, which governs Worqd's own backyard in Halifax, carries penalties of up to $10 million CAD per violation for businesses. The pattern across recent enforcement:

• Verkada faced $2.95 million in CAN-SPAM penalties in 2024 for marketing emails with no unsubscribe option.
• Experian Consumer Services paid $650,000 in 2023 for email violations.
• Austrian Post was fined €9 million for mishandling data subject requests.

Mailbox providers enforce on their own terms, too. Gmail and Yahoo now hold bulk senders to a 0.3% spam-complaint threshold and require authentication, per Bloomreach's guide to permission-based email. Miss it and your deliverability collapses long before a regulator calls.

This is why provider choice matters as much as campaign copy. Worqd builds outreach as personalized, permission-aware contact with relevant accounts, and the booking process requires explicit consent before anyone is contacted. That's a deliberate default for clients operating across jurisdictions where the rules differ sharply.

None of this is legal advice. It's a reason to ask your provider hard questions about consent records, opt-out handling, and how they treat old contact lists before you send anything.

Why GDPR Is the Safest Global Baseline

If your recipients live in more than one country, you're not choosing between privacy laws. You're choosing which one to satisfy first, and the answer is the strictest.

GDPR is that standard. According to Emailchef's comparison of GDPR, CAN-SPAM, and CASL, following GDPR automatically satisfies most CAN-SPAM requirements, which makes it the safest baseline for anyone sending across borders. The reason is simple: GDPR requires prior, unambiguous consent, while CAN-SPAM lets you send first and unsubscribe later.

That gap explains the penalties. GDPR fines reach €20 million or 4% of global turnover, and CASL penalties run up to $10 million per violation for businesses, according to MoEngage's breakdown of email compliance law. US-based senders aren't exempt either, since obligations follow the recipient's location rather than the sender's.

Four procedures do most of the compliance work:

• Opt-in methods: collect consent that is freely given, specific, and informed, with no pre-checked boxes.
• Proof of consent: keep a record of when, how, and where each contact agreed.
• Opt-out options: make unsubscribing easy and honor it quickly (CAN-SPAM allows 10 business days).
• Legacy contacts: obtain fresh consent before re-engaging older records.

That last point matters more than most teams expect. Pipeline Recovery work, which revives contacts already sitting in a CRM, depends on legacy consent being handled properly rather than assumed.

This is the standard Worqd applies to its own outreach: personalized, permission-aware messages to relevant accounts, with explicit consent captured at the point of contact. The same four procedures apply whether you're running cold email, reactivating old leads, or following up on inbound inquiries.

Operational Rules for Compliant Outreach

Knowing the law is one thing. Running outreach that stays on the right side of it, day after day, is where most teams slip up.

The first hard rule: never buy, rent, or scrape email lists. Purchased lists are generally prohibited under the GDPR and ePrivacy framework because they defeat the point of consent entirely, and email providers like HubSpot explicitly list them as unacceptable consent sources. One practitioner puts it bluntly: list buying breaks almost every serious framework. It also wrecks deliverability, since Gmail and Yahoo now enforce a 0.3% spam-complaint threshold for bulk senders.

The second rule is knowing the difference between a transactional email and a marketing one. Order confirmations, shipping notices, and password resets are permitted because the recipient's transaction allows them. But marketing email needs its own permission. Don't try to hide a promotional pitch inside a receipt and call it transactional. Regulators look at an email's primary purpose, and getting it wrong is risky, not clever.

This matters a lot when follow-up is automated. If you use AI SDRs or automated response systems to re-engage old leads or reply to inbound inquiries, the system needs documented consent to work from, not just an assumption. Four procedures matter here: enable an opt-in method, keep proof of consent, offer a working opt-out, and handle legacy contacts properly before reactivating them. That last one is easy to forget. A lead who inquired two years ago may have moved on, and under Canada's CASL, implied consent from a general inquiry only lasts six months (two years after a purchase).

At Worqd, we treat these rules as design constraints rather than afterthoughts. Our booking funnel asks for explicit consent ("I agree to be contacted about my request") before anyone hears from us, and our B2B outreach is personalized, permission-aware outreach to relevant accounts, the opposite of a template blast. Automated follow-up only works well when the permission behind it is real.

A few practical habits that keep compliant outreach on track:

• Build your own list through opt-in forms, booking funnels, and genuine business relationships, and record when and how each contact agreed to hear from you.
• Keep promotional content out of transactional emails unless you have separate marketing consent for that contact.
• Honor opt-outs fast. CAN-SPAM gives you 10 business days, and CASL requires the unsubscribe mechanism to stay functional for at least 60 days after sending.
• Before any automated re-engagement of old leads, check whether consent still exists and document what you find.
• When in doubt, follow the strictest standard that applies to your audience. If you follow GDPR, you automatically comply with most CAN-SPAM requirements too.

The stakes justify the discipline. CAN-SPAM penalties can reach $53,088 per offending email under the FTC's 2025 inflation adjustment, and CASL fines can hit $10 million per violation for businesses. Compliance isn't paperwork for its own sake. It's what keeps your follow-up running, your domain out of spam folders, and your pipeline growing on contacts who actually want to hear from you.