Three Rulebooks, One Send List

Cold email is legal in the US, the EU, and Canada. What changes is which rulebook you're playing by, and the penalties for guessing wrong run per email, not per campaign.

The United States runs an opt-out model under CAN-SPAM. The FTC makes no exception for business-to-business email, so the same rules that govern consumer mail apply to your prospect list. The current maximum civil penalty sits at $53,088 per violating email, which means one careless send to 1,000 addresses can theoretically expose you to more than $51 million in fines. Opt-outs must be honored within 10 business days, and your unsubscribe mechanism has to stay live for at least 30 days after the original message.

Europe works differently. GDPR doesn't ban cold email, and legitimate interest under Article 6(1)(f) is the usual basis for B2B outreach. But the ePrivacy Directive hands the consent question to each member state, so the rules shift at the border. Ireland permits legitimate interest for business contacts; Poland and Germany require prior consent with no B2B exception. France is more permissive for corporate addresses. That's why country-level segmentation beats an EU-wide send.

Canada is the strictest of the three. CASL requires express or implied consent before the first message, with implied consent limited to defined windows: two years after a purchase, six months after an inquiry. The burden of proving consent sits with the sender, and organizations face up to $10 million per violation.

The volume math is what makes this dangerous:

• Penalties attach per email, not per campaign. A single failed opt-out across 5,000 sends is 5,000 violations.
• Mailbox providers now enforce harder than regulators. Google wants spam complaint rates under 0.1%, never reaching 0.3%.
• Microsoft requires SPF, DKIM, and DMARC for senders over 5,000 emails per day as of May 5, 2025.
• Hiring an agency does not transfer liability. You remain responsible for what a vendor sends on your behalf.

That last point matters when you're evaluating an outreach partner. Platforms like Instantly, Lemlist, and Apollo supply sending infrastructure and leave compliance to users, so the entity pressing send owns the risk. At Worqd, B2B outreach is built as personalized, permission-aware contact with relevant accounts rather than template blasts, because the same habits that keep a campaign legal also keep it out of the spam folder.

The EU and UK Gray Zones Most Teams Get Wrong

GDPR doesn't ban B2B cold email, and that single misconception leads teams to either skip Europe entirely or send one EU-wide campaign that breaks the law in half the countries it reaches. The truth is more workable: legitimate interest under Article 6(1)(f) is the usual basis for B2B outreach, but the ePrivacy Directive hands the consent question to each member state, which means a send that's lawful in Ireland can require prior consent in Germany or Poland.

The split is stark. ePrivacy Article 13(5) leaves B2B consent to national law, and Ireland permits legitimate interest for business contacts while Poland and Germany require prior consent with no B2B exception. Poland goes furthest: Article 398 of the Prawo komunikacji elektronicznej, effective November 10, 2024, requires prior consent for any subscriber, including companies and sole traders, and the law never uses the word "consumer."

That leaves country-level segmentation as the only sane approach:

• Ireland and several other member states: legitimate interest can support B2B sends
• Germany and Poland: prior consent required, no B2B carve-out
• France and similar markets: more permissive for corporate addresses
• Everywhere: UK GDPR or EU GDPR still governs the data itself

The UK looks friendlier than it is. PECR regulation 22 applies only to individual subscribers, so corporate addresses at limited companies, LLPs, and Scottish partnerships sit outside its consent requirement. Sole traders and most partnerships count as individual subscribers, though, and when subscriber status is unclear, the safer read is to apply the stricter consent analysis. Get that wrong and you're exposed to a penalty ceiling that rose from £500,000 to £17.5 million or 4% of turnover on February 5, 2026.

This is where provider selection earns its keep. Hiring an agency doesn't transfer liability, and platforms like Instantly, Lemlist, and Apollo hand you sending infrastructure while leaving compliance to you. When you evaluate an outreach partner, ask how they segment by jurisdiction, maintain suppression lists, and document consent. Worqd's outreach runs as personalized, permission-aware contact with relevant accounts, and the booking funnel collects explicit consent before anything is sent. Ask any provider the same question. If they can't answer it clearly, that's your answer.

Mailbox Providers and AI Are the New Enforcers

Your campaign can pass every regulator on the books and still fail to reach the inbox. That's because Google, Microsoft, and Yahoo now enforce deliverability rules that are stricter than most countries' email laws. For any team sending cold email at scale, mailbox providers have become the de facto gatekeepers.

Google requires spam complaint rates to stay under 0.1%, never reaching 0.3%, and classifies senders of 5,000 or more emails per day to Gmail as bulk senders who must implement SPF, DKIM, and DMARC authentication. Microsoft enforces the same authentication requirements for high-volume senders as of May 5, 2025, and honors only the mailto form of one-click unsubscribe. Yahoo keeps its spam-rate ceiling below 0.3%. Hit those thresholds and your sender reputation collapses overnight, regardless of whether your content is legally compliant.

The technical baseline looks like this:

• SPF, DKIM, and DMARC configured and passing for every sending domain
• One-click unsubscribe links in both the email body and the header
• Spam complaint rate monitored continuously, with alerts before you cross 0.1%
• Accurate headers, a valid physical postal address, and honest subject lines on every message

The AI layer makes this harder. AI-generated outreach has triggered a new wave of legal exposure that mailbox providers are already responding to. The EU AI Act's Article 50(2) requires AI-generated content to be marked in a machine-readable format, with email-specific requirements phasing in through August 2026. In Washington State, the 2025 ruling in Brown v. Old Navy created a private right of action with $500-per-email penalties for misleading subject lines, and at least eight lawsuits have already been filed under that framework.

The common AI-generated violations are predictable: subject lines like "Re: Our conversation" when no conversation exists, stripped physical addresses, broken unsubscribe links caused by domain rotation, and cadence tools that re-enroll unsubscribed contacts from different addresses. Each one can trigger both a spam complaint and a regulatory violation. The entity pressing send bears primary responsibility, whether a human or an AI wrote the message.

This is where the choice of outreach partner matters. Platforms like Instantly, Lemlist, and Apollo provide sending infrastructure but leave compliance to users, and hiring an agency does not transfer liability. When evaluating a cold email provider, ask how they handle authentication, suppression lists, and AI-content disclosure. At Worqd, outreach is built around permission-aware, personalized contact rather than template blasts, with a single suppression process across every tool and channel so a prospect who opts out stays opted out. That kind of discipline keeps you inside both the mailbox providers' thresholds and the regulators' rulebooks at the same time.

Want to see how compliant outreach fits into the rest of the growth path? Book a Growth Call to walk through your current setup.

What to Check Before You Send (or Hire Someone to Send)

You cannot outsource legal responsibility. The entity pressing "send" bears primary responsibility, regardless of whether a human or AI wrote the message. Legal analysis confirms that hiring an agency does not transfer liability. If your vendor sends a non-compliant email, the fine lands on your company, not theirs.

This creates a critical gap in many vendor relationships. Platforms provide the infrastructure, but they leave compliance to you. The platforms profit from volume, while compliance remains an afterthought for them. You need to verify their practices before you launch.

Start with jurisdiction segmentation. One process rarely satisfies all three major rulebooks: CAN-SPAM, GDPR, and CASL. Industry guidance notes that the rules are just three different rulebooks that people try to satisfy with one process. Segment your lists by location to apply the correct consent model.

Next, audit your suppression logic. A per-campaign suppression list is the most common avoidable compliance failure. If a prospect unsubscribes in one tool but stays active in another, you violate multiple laws simultaneously. You need a single, global suppression list across all tools and campaigns.

Ensure your technical setup meets mailbox provider standards. Google and Microsoft require SPF, DKIM, and DMARC for bulk senders. These protocols verify your identity and prevent spoofing. Without them, your emails may land in spam folders or get blocked entirely.

Finally, verify your opt-out mechanisms are fast and functional. The fastest opt-out mechanism is the single biggest risk reducer. It must be honored within 10 business days under US law.

When evaluating partners, look for these specific safeguards:

• Jurisdiction-aware routing that segments US, EU, and Canadian contacts automatically.
• A unified suppression list that syncs across all sending domains and tools.
• Verified SPF, DKIM, and DMARC records for all sending domains.
• One-click unsubscribe links in both the email body and header.

Worqd treats compliance as a core part of our outreach strategy. We build campaigns with permission-aware personalization, ensuring every message respects the legal boundaries of the recipient's jurisdiction. This approach reduces legal risk while maintaining high deliverability.

Honest subject lines are non-negotiable. Misleading subject lines like "Re: Our conversation" when no prior contact exists create significant legal exposure. Recent rulings in Washington State have established private rights of action for such practices, with penalties up to $500 per email. Keep your subject lines accurate and reflective of the content.

Document your consent and opt-out records. Evidence of a documented process carries weight with regulators. If you cannot prove you had a valid reason to contact someone, you are at risk. Maintain clear records of how you acquired each lead and how they opted out.

Compliance and performance are the same discipline. The habits that keep you legal also support strong deliverability. Accurate identity, honest subject lines, and easy opt-outs reduce both regulator risk and spam complaints. Do not treat compliance as a separate hurdle. Integrate it into your daily sending workflow.