Three Rulebooks, One Mistake

One email can be perfectly legal in Texas and unlawful in Toronto. That's because cold email doesn't follow one global rulebook. It follows three, and the one that applies depends entirely on where your recipient sits, not where you do.

Consider how differently each regime treats the same message. In the United States, CAN-SPAM regulates how you send: no prior consent is needed, but you must identify yourself honestly, include a physical address, and honor opt-outs within 10 business days. In the EU and UK, GDPR and ePrivacy rules govern whether you may process the data at all, usually through a documented legitimate interest. In Canada, CASL flips the default entirely: a message is illegal until an exemption applies.

The stakes are real on every side. A single violating email under CAN-SPAM carries a penalty of up to $53,088, applied per message rather than per campaign, so a 1,000-address send with a broken unsubscribe link becomes theoretically a nine-figure exposure. GDPR fines reach €20 million or 4% of worldwide turnover, and CASL penalties run from CAD $1 million for individuals to $10 million for organizations.

Jurisdiction follows the recipient in practice. Emailing someone in Germany pulls in GDPR and Germany's stricter national rules, even from a US sender. Under CASL, if a message is accessed by a computer in Canada, the law applies regardless of where you sent it from. That last point matters to us directly: Worqd operates from Halifax, Nova Scotia, so CASL shapes how we handle every campaign, including ones our clients run from elsewhere.

The failure mode most sources flag is trying to satisfy all three regimes with one US-style process. A message fully compliant under CAN-SPAM can be unlawful under CASL or GDPR without changing a single word. The practical fix is segmentation:

• Segment your lists by jurisdiction before sending: US, EU/EEA, UK, and Canada each get their own process.
• Treat the EU as country-by-country, since ePrivacy is implemented per member state. Germany and Austria generally require prior consent even for B2B.
• In the UK, email to limited companies and LLPs is generally exempt from consent rules, but sole traders and most partnerships are not.
• Keep a written legitimate interest assessment for EU and UK sends, covering purpose, necessity, and a balancing test.

One more thing worth knowing before you hand outreach to a vendor: hiring an agency does not transfer liability under CAN-SPAM, and CASL adds director and officer liability on top. If you work with a partner, including us, the legal responsibility for what gets sent still sits with your business. That's why permission-aware targeting, honest identification, and a global opt-out list aren't just good practice. They're the floor.

The Penalty Landscape

Getting the rules wrong isn't a slap on the wrist. Cold email penalties are calculated per message, which means a single non-compliant campaign can multiply into a figure that would sink most marketing budgets several times over.

Start with the United States. CAN-SPAM lets the FTC pursue up to $53,088 per violating email (adjusted effective January 17, 2025), and that figure is per email, not per campaign. A 1,000-address send with a broken unsubscribe link is, in theory, a nine-figure exposure, according to compliance analysis from RevenueFlow. The most common triggers are surprisingly small: a missing physical address, an unsubscribe link that doesn't work, or suppression lists that don't carry over between campaigns.

Europe operates on a different scale entirely. GDPR fines reach €20 million or 4% of worldwide turnover for the most serious breaches, with a lower tier of €10 million or 2%. Enforcement is very real: European data protection authorities issued €1.2 billion in GDPR fines in 2025 alone, and roughly 35% of all fines since 2018 have involved consent violations. Recent cases show how this lands on senders. France's CNIL fined Orange €50 million in January 2025 over consent failures affecting 7.8 million people, and Spain's AEPD fined Carrefour Spain €3.05 million for failing to process unsubscribes properly.

Canada's CASL is arguably the strictest of the three. Individuals face fines up to CAD $1 million per violation, and organizations up to CAD $10 million. Even first-time offenders in CRTC settlements commonly pay CAD $100,000 to $200,000. And because CASL applies to any message accessed by a computer in Canada, it reaches senders far outside Canadian borders.

The UK raised its stakes too. As of February 5, 2026, PECR maximum fines jumped from £500,000 to £17.5 million or 4% of global turnover. The ICO has already been active: in January 2026 it penalized Allay Claims £120,000 for over 4 million unlawful texts and ZMLUK £105,000 for 67 million emails sent without valid consent.

Notice the pattern across all these cases. The fines rarely come from exotic violations. They trace back to the same handful of shortcuts:

• Purchased or scraped lists, which have no lawful basis under GDPR and no existing business relationship under CASL
• Broken unsubscribe links, or opt-outs honored in one campaign but not the next
• Missing physical postal addresses in the email footer
• Running one US-style opt-out policy globally, ignoring that the recipient's location determines which law applies

One more thing worth knowing if you work with an outside partner: hiring an agency does not transfer liability. Under CAN-SPAM, the legal responsibility stays with the brand on whose behalf the email is sent, and CASL adds director and officer liability on top. That's why, at Worqd, we treat every cold outreach engagement as permission-aware from the start: consent records, honest identification, and a global suppression list that applies across every campaign and domain.

The math is simple. Fixing a broken unsubscribe link takes minutes. The penalty for not fixing it is calculated per email.

The Unified Operating Standard

The rules themselves aren't complicated. The problem is that three different rulebooks govern the same inbox, and most teams try to satisfy all of them with one process built for the United States.

A unified operating standard closes that gap. Target business roles rather than personal consumer addresses, identify your organization honestly in every message, and include a physical postal address in each send. These three habits alone clear the identification requirements under CAN-SPAM, GDPR, and CASL at once.

Then build the opt-out to be global and permanent. Every unsubscribe applies across all campaigns, all domains, and every future list. Under CAN-SPAM and CASL, you have 10 business days to honor an opt-out, and the mechanism must stay active for at least 30 days after the send. A per-campaign suppression list is the most common avoidable failure in this space.

The framework rests on five operating rules:

• Segment recipients by jurisdiction before you send, because the recipient's location decides which law applies
• Never use purchased or scraped lists, since they carry no lawful basis under GDPR and no existing relationship under CASL
• Document a legitimate interest assessment for EU and UK sends, including purpose, necessity, and the balancing test
• Treat Germany and Austria as opt-in-only markets unless counsel confirms otherwise
• Keep suppression records permanent and shared across every sending domain

The stakes justify the discipline. CAN-SPAM penalties reach $53,088 per violating email, not per campaign, so a 1,000-address send with a broken unsubscribe link carries theoretical nine-figure exposure. CASL fines run to CAD $10 million per violation for organizations, and GDPR breaches reach €20 million or 4% of worldwide turnover.

One more thing worth knowing before you outsource any of this: hiring an agency does not transfer liability. Under CAN-SPAM the responsibility stays with you, and CASL adds director and officer liability on top. At Worqd, B2B outreach is built as personalized, permission-aware contact with relevant accounts, which is the opposite of a template blast. If you're evaluating providers, ask how they segment by jurisdiction and where suppression lives.

Jurisdiction-Specific Nuances

The same email can be legal in Texas and unlawful in Toronto. That's because jurisdiction follows the recipient: email someone in Germany and GDPR plus Germany's stricter national rules apply, even if you're sending from the US. Under Canada's CASL, the trigger is even broader. If your message is accessed by a computer in Canada, CASL applies regardless of where you sit, which matters for any Canada-based operation like ours in Halifax (Tomba).

The three major regimes work on fundamentally different logic. The US regulates how you send. The EU regulates whether you may process the data at all. Canada says it's illegal by default until an exemption applies (RevenueFlow). A message fully compliant under one rulebook can break another, which is why applying a single US-style policy globally is the most cited failure across compliance research.

The UK corporate exemption. Under PECR, email to limited companies, LLPs, and Scottish partnerships generally falls outside the consent requirement. But sole traders and most partnerships count as individual subscribers, so the exemption doesn't cover them. Treat them like consumers.

GDPR legitimate interest. GDPR doesn't ban B2B cold email. Recital 47 explicitly names direct marketing as a possible legitimate interest, but you have to document it. A proper Legitimate Interest Assessment covers three parts: purpose, necessity, and a balancing test against the recipient's privacy rights. The UK ICO offers a free LIA template (scrap.io). Simply wanting to sell something isn't enough; the outreach must be relevant to the recipient's business. B2C cold email under GDPR, by contrast, is essentially dead.

Country-level segmentation matters in Europe because the ePrivacy Directive is implemented per member state. The practical risk tiers:

• High risk: Germany and Austria, where prior consent is typically required even for B2B under UWG. Unless a lawyer confirms your specific use case, treat these as opt-in-only markets.
• Moderate risk: France, Netherlands, Spain, and Italy, where legitimate interest works but requires strict documentation.
• Lower risk: the UK, Ireland, Sweden, Denmark, and Finland.

Canada's consent-first model. CASL is one of the strictest email laws in the world, and most US-market cold email playbooks quietly break it. You need express consent or implied consent tied to an existing business relationship (roughly 24 months) or a recent inquiry (6 months). If you can't prove consent, you don't have it. Penalties run CAD $1 million per violation for individuals and $10 million for organizations, and CRTC settlements commonly land between $100,000 and $200,000 even for first offenses.

One more thing worth knowing before you outsource any of this: hiring an agency doesn't transfer liability. Under CAN-SPAM, responsibility stays with you, and CASL adds director and officer liability on top. When you work with a partner on B2B outreach, ask how they document consent and legitimate interest for each jurisdiction, not just what they send.

Compliance Meets Deliverability

Treating legal compliance as a tax on your outreach is a mistake. The same behaviors that keep regulators satisfied are exactly what keep your emails landing in inboxes instead of spam folders.

Mailbox providers like Gmail, Yahoo, and Outlook enforce their own strict requirements: authenticated sending (SPF, DKIM, DMARC), low spam complaint rates, and one-click unsubscribe per RFC 8058. As one analysis puts it, "legal is not the same as deliverable," and the gap between the two is where most campaigns quietly fail.

Here's the overlap: accurate sender identity, honest subject lines, and easy opt-outs satisfy CAN-SPAM, GDPR, and CASL while also keeping complaint rates low. When a recipient can tell who you are and leave in one click, they're far less likely to hit "report spam." That single action damages your sender reputation more than almost anything else you can do.

The behaviors that regulators and inbox providers both reward include:

• Identify yourself honestly with a real sender name and a physical postal address.
• Keep subject lines and content aligned with what you actually offer.
• Provide a one-click unsubscribe that stays active at least 30 days after send.
• Honor opt-outs globally and permanently across every campaign and domain.
• Target business roles and verified addresses, never purchased or scraped lists.

Broken suppression is the most common avoidable failure. Research on enforcement patterns shows regulators concentrate on purchased lists, missing physical addresses, dead unsubscribe links, and suppression lists that reset per campaign. Every one of those failures also trains mailbox providers to distrust your domain.

Purchased and scraped lists collapse on both fronts at once. They carry no lawful basis under GDPR and no existing business relationship under CASL, which means legal exposure the moment you hit send. They also generate complaints and bounces at rates that crater your sender reputation within a few sends. There's no formatting trick that makes a bought list work.

This is where compliance and deliverability pull in the same direction. A clean, role-targeted list with recorded sources and a permanent global suppression file keeps you inside CAN-SPAM, GDPR, and CASL while giving mailbox providers the signals they want. At Worqd, we build B2B outreach around this overlap: personalized, permission-aware contact with relevant accounts, never template blasts to scraped data.

The practical takeaway is simple. Build your list with recorded sources, segment by jurisdiction before you send, and treat every unsubscribe as global and permanent. You'll spend less time cleaning up complaints and more time in conversations that matter.