The Short Answer: It Depends on Where They Live

Imagine two businesses send the exact same email. One gets a polite shrug from regulators; the other faces a six-figure fine. The difference isn't the email. It's where the recipient lives.

That's the core finding here: legality is governed by the recipient's location, not yours. If you're in the US emailing someone in Germany, German rules apply. If you're in Canada emailing someone in Texas, US rules apply. This is why a single yes-or-no answer doesn't work.

In the US, it's opt-out. The FTC's official guidance is clear: you don't need consent before adding someone to a mailing list, but every commercial email needs a working unsubscribe mechanism, honest headers, clear ad identification, and a physical postal address. Skip those and you're exposed to penalties of up to $53,088 per violating email, per the FTC. And once someone opts out, you must honor it within 10 business days, and you can never sell or transfer their address.

Almost everywhere else, it's opt-in. The EU, UK, Canada, and Australia flip the model: consent generally comes first. Under GDPR, consent must be freely given, specific, and unambiguous, obtained through an affirmative opt-in action. Pre-ticked boxes don't count. Fines can reach €20 million or 4% of global revenue, whichever is greater. Canada's CASL is similarly strict, with penalties up to $10 million per violation for corporations, and the UK's PECR and Australia's Spam Act follow the same consent-first logic.

There's one important nuance for B2B senders. Under GDPR, a documented "legitimate interest" basis can substitute for explicit consent when you're contacting someone in a professional capacity, though Germany and Austria typically still require consent even for B2B. The rules also shift fast at the US state level: California's CPRA ended its B2B exemption on January 1, 2023.

Here's the practical takeaway in one glance:

• US: no consent needed, but a clear opt-out is mandatory and never expires.
• EU and UK: opt-in consent or a documented legal basis before the first send.
• Canada: express or narrowly defined implied consent, with implied consent lasting only 2 years from the last transaction.
• Australia: explicit opt-in required before sending marketing email.

If you mail internationally, the safe move is applying the strictest standard to your whole list. That's the approach we take at Worqd with our own B2B outreach: permission-aware, personalized contact with documented consent, because a template blast to an unverified list is a compliance and deliverability problem at the same time. Complaint rates above 0.3% trigger spam filtering at Gmail and Yahoo, so even "legal" unsolicited email can quietly kill your sender reputation.

One more thing worth knowing: even where subscribing someone without consent is legal, some practices never are. Harvesting email addresses carries criminal penalties, including imprisonment, under CAN-SPAM. The law may tolerate an unsolicited newsletter. It doesn't tolerate how the address was obtained.

What the Law Actually Requires in Each Region

The rules you have to follow depend on where your recipient lives, and the differences are bigger than most senders expect. A campaign that's perfectly legal for a US audience can rack up six-figure fines when it lands in a European or Canadian inbox.

Start with the United States. The CAN-SPAM Act is an opt-out law, which means you can add someone to a list and send them commercial email without prior consent. But the FTC's rules attach the moment you hit send. You need honest headers, a clear ad label, a physical postal address, and a working unsubscribe that you honor within 10 business days and keep active for at least 30 days. Violations run up to $53,088 per separate email, so a sloppy blast to 1,000 people is a serious problem, not a slap on the wrist. And there's no B2B exemption: business addresses get the same protection as personal ones.

The European Union flips the default. Under GDPR and the ePrivacy rules, you need consent that's freely given, specific, and unambiguous, confirmed with an affirmative opt-in action. Pre-ticked boxes don't count. The one real opening for cold outreach is "legitimate interest" under Article 6(1)(f), which regulators recognize for direct marketing, but it has to be documented. A French regulator fined SOLOCAL Marketing Services €900,000 in 2025 for prospecting without consent, and Orange France took a €50 million hit the same year for embedding ads in emails without clear consent. Country risk varies too: Germany and Austria typically require consent even for B2B, while the UK, Ireland, and the Nordic countries accept a softer B2B standard.

Canada's CASL is arguably the strictest of the bunch. Before any commercial electronic message, you need express consent or narrowly defined implied consent, which mostly means a prior business relationship (valid for two years) or an address the recipient published publicly. Penalties reach $10 million for corporations, which is why Canadian-based teams like ours at Worqd treat consent documentation as a baseline for every outreach engagement rather than an afterthought.

The UK and Australia round out the picture:

• Under PECR and UK GDPR, fines reach £20 million or 4% of global annual turnover, whichever is higher.
• Australia's Spam Act allows penalties up to AUD 220,000 for repeat offenders.
• Both regimes generally require opt-in consent before the first marketing email.

The enforcement numbers show regulators aren't joking. European data protection authorities issued more than 330 fines in 2025 alone, and roughly 35% of all GDPR fines involve consent violations. If you're choosing an email or outreach provider, this is the compliance conversation worth having upfront: ask how they handle consent records, unsubscribe processing, and jurisdiction-based list segmentation before you sign anything.

B2B vs. B2B Cold Outreach: Where the Real Risk Lives

The rules that govern a newsletter signup and those that govern a cold sales email are not the same rules, even when both land in the same inbox. Under GDPR, the difference between a B2B prospect and a consumer is often the difference between a lawful first touch and a fine.

For business outreach, consent doesn't have to come first. A documented legitimate interest basis under Article 6(1)(f) can carry the first email, supported by GDPR Recital 47, which treats direct marketing as a potential legitimate interest. As one compliance analysis puts it, legitimate interest isn't a shortcut around consent. It's the mechanism designed for the exact scenario where consent is impossible before the first touch. That basis only holds up, though, when you write it down.

A Legitimate Interest Assessment is the document that separates routine outreach from a serious penalty. France's CNIL fined SOLOCAL Marketing Services €900,000 in 2025 for prospecting without consent, and the same source notes that a proper LIA is what keeps a campaign in ordinary-workday territory. Roughly 35% of GDPR fines involve consent violations, and more than 330 fines were issued across European DPAs in 2025 alone. Enforcement is not theoretical.

This is where B2B justifications collapse. The lower threshold for commercial contact applies to someone's professional role at a business address, not to their personal Gmail. Running consumer contacts through a B2B legitimate-interest argument is exactly where regulators hand down fines, because the balancing test fails the moment the recipient isn't acting in a professional capacity.

Before any outreach campaign, check these:

• Confirm every address is a genuine business address, not a personal one
• Complete a three-part LIA covering purpose, necessity, and balancing
• Check country rules, since Germany and Austria typically require consent even for B2B
• Keep opt-out handling and suppression lists active from day one

Worqd builds B2B cold email and outreach as personalized, permission-aware contact rather than template blasts, and its booking funnel captures explicit consent before any follow-up. If you're weighing providers, ask to see how they document legal basis and enforce opt-outs. That paperwork tells you more than any pitch deck.

How to Subscribe People the Right Way

Getting consent right isn't just about avoiding fines. It's about building a list that actually performs, because the inbox punishes sloppy practices just as hard as regulators do. Here's the practical checklist for subscribing people the right way.

Segment your list by jurisdiction first. The legality of adding someone without consent flips entirely depending on where the recipient sits. In the US, the FTC's official guidance confirms you don't need prior consent, but the EU, Canada, and the UK all require consent or a documented legal basis before the first send. If your list spans borders, apply the strictest standard to everything.

Use double opt-in where it counts. A German court ruling (OLG Celle, 2014) accepted the double-opt-in procedure as a reasonable way to prove consent for each individual address, which is why it's best practice across the EU. It also protects you from typos, spam traps, and malicious signups that inflate your bounce rate.

Honor opt-outs fast and permanently. Under CAN-SPAM, you must process unsubscribe requests within 10 business days, keep the opt-out mechanism live for at least 30 days after sending, and never charge a fee or require a login. Opted-out addresses can't be sold or transferred, even as part of a mailing list. The stakes are real: Verkada paid a $2.95 million FTC fine simply for missing unsubscribe links.

Document consent and your legal basis. For B2B outreach in the EU, a written Legitimate Interest Assessment covering purpose, necessity, and balancing is what separates lawful outreach from SOLOCAL's €900,000 fine for prospecting without consent. Even in the US, the ANA recommends recording when and how consent was obtained.

• Keep records of who consented, when, where, and what you disclosed.
• Target only professional addresses in the EU, never personal Gmail accounts.
• Check country-specific rules; Germany and Austria typically require consent even for B2B.
• Store your LIA documentation where you can actually produce it if a regulator asks.

Never buy unvetted lists or harvest addresses. Harvesting carries criminal penalties, including imprisonment, under CAN-SPAM. And buying a non-compliant list doesn't transfer the liability away from you; the buyer carries primary compliance responsibility regardless of the source.

The deliverability math makes the same argument. Bounce rates above 2% damage sender reputation, and complaint rates above 0.3% trigger spam filtering or blocks at Gmail and Yahoo. A list built on shaky consent costs you the inbox before it ever costs you a fine.

That's why any growth partner worth working with, including our team at Worqd, treats permission-aware list building as a compliance practice and a performance practice. When you're evaluating providers, ask how they source contacts, document legal basis, and handle opt-outs. If the answer is vague, your domain reputation is the collateral.

Good consent records and clean lists aren't overhead. They're the reason your emails land, get opened, and turn into booked calls instead of spam-folder archaeology.