The Jurisdictional Divide: Opt-In vs. Opt-Out

The same email can be perfectly legal in Texas and illegal in Toronto. That's because the world is split between two consent models, and where your recipient lives decides which rules apply to you.

The United States runs on an opt-out model. Under CAN-SPAM, you don't need prior consent to send commercial email, even to business addresses. The FTC is explicit about this: subscribers don't lose their right to opt out just because they have a membership, but you're not required to ask permission first. Critics have nicknamed the law "You-Can-Spam" for exactly this reason.

Canada and the EU take the opposite approach. Both require consent before the first message.

• Canada (CASL) requires express consent, or narrowly defined implied consent, before any commercial electronic message. A purchase buys you two years of implied consent; an inquiry buys six months. The burden of proof sits on the sender, not the recipient.
• The EU (GDPR/ePrivacy) requires explicit opt-in for most recipients, and pre-ticked boxes don't count. Member states vary on B2B: Poland and Germany demand prior consent with no business exception, while the UK's PECR only covers individual subscribers, so corporate addresses fall outside its consent rule.
• The U.S. (CAN-SPAM) lets you send without permission, but only if you identify yourself honestly, include a working unsubscribe, and honor opt-outs within 10 business days. Violations run up to $53,088 per email, and that penalty attaches per message, not per campaign.

Two details trip up a lot of senders. First, CASL has extraterritorial reach, so emailing a Canadian recipient from anywhere in the world still counts. Second, B2B is not a blanket license anywhere. In Poland, consent has to exist before the first message, so you can't compliantly email someone to ask for it.

The stakes are real. GDPR fines reach €20 million or 4% of global revenue, whichever is higher, and CASL penalties hit CAD $10 million for corporations. Amazon alone was fined €746 million in 2022 over consent practices in its advertising.

This is why we treat consent as a jurisdiction question, not a formality. Worqd is based in Halifax, Nova Scotia, which means CASL isn't an abstraction for us; it's the law we operate under, and it shapes how we run permission-aware B2B outreach for clients in every market. If you work with any growth partner, it's worth asking where they're based and which consent standard they follow, because you carry the liability for every contact on your list no matter who sends the email.

The practical takeaway: adopt the strictest standard everywhere. Opt-in consent satisfies CAN-SPAM automatically, keeps you safe under CASL, and covers most GDPR scenarios. One standard beats three.

Penalties and Platform Enforcement Realities

The fines aren't theoretical, and they're not capped at "oops" money. Under the FTC's CAN-SPAM guidance, each violating email can cost up to $53,088, and the penalty attaches per email, not per campaign. One send to 1,000 addresses that breaks the rules counts as 1,000 separate violations.

Canada's CASL is harsher still: up to CAD $10 million per violation for corporations and $1 million for individuals, with the burden of proof on you to show consent was obtained. The CRTC has enforced this against real senders, including a $200,000 fine against Rogers Media for a broken unsubscribe option and a $50,000 penalty against an individual sender in August 2025. In the EU, GDPR fines reach €20 million or 4% of global annual revenue, whichever is higher, and 2023 alone saw more than €1.2 billion in total GDPR fines across the bloc.

Then there's a layer most people miss: the mailbox providers now act as their own regulators. Since February 2024, Google and Yahoo require bulk senders to include one-click unsubscribe and keep spam complaints below 0.3%, and Microsoft began rejecting non-compliant bulk email outright in May 2025. You can be legally compliant in the U.S. and still have every message silently filtered or bounced.

A few numbers worth keeping in mind:

• 53% of users mark email as spam when they can't find an unsubscribe link, which feeds directly into those complaint-rate thresholds.
• Permission-based campaigns see 38% higher open rates and 68% higher click-through rates than non-consent sends.
• Double opt-in lists convert 22.7% better than single opt-in, so the stricter standard is also the better-performing one.

One more thing that catches businesses off guard: you can't outsource the risk. The FTC is explicit that hiring another company to run your email doesn't contract away your legal responsibility. If you work with a growth partner on outreach or follow-up, as we do at Worqd with permission-aware B2B outreach, verify their consent practices directly, because the fine lands on your name, not theirs.

The practical takeaway is simple. Adopt the strictest standard, GDPR-style opt-in, everywhere you send. It satisfies CASL, clears the EU, and automatically covers what CAN-SPAM asks of you, while keeping complaint rates low enough that Google, Yahoo, and Microsoft keep delivering your mail.

The Liability Trap: You Cannot Outsource Compliance

Hiring someone to send your emails doesn't hand off your legal exposure. The FTC is blunt about this: you can't contract away your legal responsibility to comply with the law, even when another company handles your email marketing entirely (per the FTC's CAN-SPAM compliance guide).

The same principle applies everywhere else. Under GDPR, you carry primary compliance liability for every contact on your list, no matter where the list came from (compliance analysts note). And in Canada, the burden runs even deeper: the CRTC states that "the onus is on the person who is sending the message to prove they have obtained consent" (CRTC CASL guidance). If your agency can't produce consent records, you're the one who can't prove consent.

The math makes the stakes clear. CAN-SPAM penalties reach $53,088 per violating email, and the penalty attaches per email, not per campaign: one bad send to 1,000 addresses counts as 1,000 violations (compliance researchers explain). GDPR fines run to €20 million or 4% of global annual revenue, whichever is higher (per this comparison of the major frameworks).

So what should you actually check before signing with an agency or growth partner? A few questions do most of the work:

• How do they obtain consent, and can they document the date, method, and source for every contact?
• Do they use double opt-in, or single opt-in with no verification?
• How fast do they process unsubscribes, and do they ever transfer or sell opted-out addresses?
• Do they segment sends by jurisdiction, since Canada, Poland, and Germany require prior consent while the UK treats corporate addresses differently?

This is why Worqd treats consent documentation as a client-side deliverable rather than an afterthought. Permission-aware outreach to relevant accounts only works if the paper trail exists, and the paper trail belongs to the sender, not the vendor. A growth partner that can't show you exactly how consent was captured for each contact is handing you a liability you'll absorb alone.

The practical takeaway is simple. Vet your partners' compliance practices with the same rigor you'd apply to your own, because legally, there's no difference. The regulator who comes knocking will be knocking on your door.

Building a Compliant, High-Performance List

The cheapest compliance strategy is also the most profitable one: get consent before you send. Since Canada's CASL and the EU's GDPR both require opt-in while U.S. law doesn't, legal experts recommend adopting the strictest standard globally. One opt-in list satisfies every jurisdiction you might touch, and it performs better too.

The numbers back this up. Campaign research shows permission-based lists deliver 38% higher open rates and 68% higher click-through rates, while cutting unsubscribes by 33%. Double opt-in lists convert 22.7% better than single opt-in. People who actually asked to hear from you open, click, and stay.

Documenting consent is where most businesses fall short. Under CASL, the burden is on the sender to prove consent exists, not on the regulator to prove it doesn't. That means recording the date, method, and source of permission for every contact on your list. If you can't produce that record when a complaint lands, the consent legally doesn't exist.

Your documentation routine doesn't need to be complicated:

• Log the date, time, and source of every opt-in (form, landing page, or in-person signup)
• Use double opt-in so a confirmed email proves the recipient controlled the address
• Never import purchased or scraped lists; you carry liability for every contact regardless of where it came sourced from
• Honor opt-outs within 10 business days and never resell or transfer those addresses

One warning worth repeating: the FTC is explicit that you cannot contract away compliance responsibility. If you hire an agency or growth partner to run email outreach, their list practices are legally your practices. At Worqd, that's why our outreach is permission-aware and personalized rather than template blasts, and why our own booking funnel requires explicit consent before anyone is contacted. Ask any partner you're evaluating to show you their consent documentation before they touch your list.

The deliverability argument seals it. Google and Yahoo now require bulk senders to keep spam complaint rates below 0.3%, and Microsoft began rejecting non-compliant bulk email in May 2025. A list built on real consent keeps complaints low because recipients recognize your name in the inbox. A list built on shortcuts gets you filtered, flagged, or fined, and rebuilding a damaged sender reputation costs far more than the consent you skipped.