Why Cold Email Compliance Is Harder Than It Looks

Cold email is legal in the United States, across the European Union, and in Canada. The catch is that each of those jurisdictions runs a different rulebook, and the rulebook that applies is the one where your recipient opens their inbox, not the one where you sit at your desk.

The US is the most permissive. CAN-SPAM does not require prior consent and does not distinguish between B2B and B2C. It regulates how you send: accurate header information, honest subject lines, a physical postal address, and a working opt-out processed within ten business days. Penalties run up to $53,088 per violating email after the FTC's January 2025 inflation adjustment.

The EU is a different animal. GDPR permits B2B cold email under legitimate interest (Article 6(1)(f), with Recital 47 naming direct marketing), but the ePrivacy Directive is implemented country by country. A message that is lawful in Sweden can be unlawful in Germany, where the UWG typically requires prior consent even for B2B sends. Penalties scale with turnover: up to €20 million or 4% of global annual revenue, whichever is higher. European regulators have collected €7.1 billion in GDPR fines since May 2018, with €1.2 billion issued in 2025 alone.

Canada inverts the default. CASL requires express or implied consent before any commercial email goes out, and the burden of proving that consent sits with the sender. Penalties reach CAD $10 million per violation. France is tightening further: since August 2026, consumer outreach requires prior opt-in, while B2B stays under the lighter regime.

Here is what that means in practice:

• Recipient location, not sender location, picks the law. Emailing someone in Berlin from Toronto triggers GDPR and German national rules.
• A single EU-wide send is not defensible. Country-level segmentation is a hard requirement.
• B2B and B2C are treated differently in the EU and Canada, but not in the US.
• Vendor liability does not transfer. You remain responsible for what an agency sends on your behalf.

The real question for any business evaluating a cold email provider is not whether cold email is legal. It is whether the provider can document defensibility across all three regimes during an audit. A bought or scraped list fails everywhere; a per-campaign suppression list fails everywhere too. The providers worth working with are the ones who can show you their jurisdiction segmentation, their Legitimate Interest Assessments, and their global suppression logic before you sign anything.

That kind of documentation is what separates a compliant outreach operation from a liability waiting to trigger a fine. If you want to see what permission-aware, jurisdiction-segmented B2B outreach looks like in practice, the Worqd insights hub walks through the approach the team uses for clients across SaaS, services, and home industries.

The Three Rulebooks: CAN-SPAM, GDPR/ePrivacy, and CASL

Cold email is legal across the US, EU/UK, and Canada, but the rules look nothing alike. Treat them as three separate rulebooks, not one global standard, because the same send can be perfectly fine in Texas and unlawful in Munich.

The US runs on an opt-out model. You do not need permission before sending, but the email itself has to follow specific rules:

• Include a valid physical postal address
• Provide a working opt-out mechanism that processes requests within 10 business days and stays functional for at least 30 days
• Use honest subject lines that reflect what's inside
• Clearly identify the message as an advertisement when it is one

Penalties run up to $53,088 per violating email under the FTC's January 2025 inflation adjustment, according to RevenueFlow's compliance overview. CAN-SPAM also does not distinguish between B2B and B2C, so the same rules apply regardless of who is reading.

The EU takes a different approach. GDPR permits B2B cold email under legitimate interest (Article 6(1)(f)), and Recital 47 explicitly names direct marketing as a recognized legitimate interest. You still need a documented Legitimate Interest Assessment, but you do not need prior consent for B2B outreach in most member states.

The catch is that the ePrivacy Directive is implemented country by country. According to Scrap.io's GDPR analysis, Germany and Austria require prior consent even for B2B under their national unfair competition laws, while the UK and Ireland are friendlier toward B2B outreach. France tightened its rules on 11 August 2026: cold email to consumers now requires prior opt-in, while outreach to professionals on business contact details stays under the lighter opt-out regime.

Enforcement is not theoretical. European regulators issued €1.2 billion in GDPR fines during 2025 alone, with over 330 fines recorded across the year.

Canada inverts the default. Under CASL, you need consent (express or implied) before sending, and the burden of proving that consent sits with you. There is a limited B2B exemption for messages sent to work addresses when the content relates to the recipient's professional responsibilities, but that exemption does not extend to personal email addresses.

Penalties reach up to CAD $10 million per violation, and unsubscribe links must stay functional for at least 60 days. Because Worqd's B2B outreach runs permission-aware and country-segmented from the start, campaigns into Canada get treated under the stricter standard by default rather than retrofitted after an audit question.

Where Compliance Actually Breaks Down

Most cold email fines don't come from misreading a statute. They come from operational basics: a list you shouldn't have bought, a footer with no address, an unsubscribe link that quietly broke three campaigns ago.

Take the list itself. A common assessment puts it plainly: a bought or scraped list has no lawful basis under GDPR and no existing business relationship under CASL. If you build your own list, with a recorded source and consent where required, that's the only version that holds up when a regulator asks. And regulators do ask. Roughly 70% of GDPR enforcement actions cite improper email sourcing.

The enforcement record shows how expensive these "basics" get:

• Orange France was fined €50 million by CNIL in 2025 for embedding ads in emails without clear consent, affecting 7.8 million people.
• Carrefour Spain paid €3.05 million to Spain's AEPD for failing to process unsubscribe requests.
• Verkada paid $2.95 million to the FTC in 2024 for missing unsubscribe links under CAN-SPAM.
• In Q3 2025, a German B2B software company emailing 50,000 IT managers across France, the UK, and Germany without legitimate interest assessments settled with a German DPA for €500,000, plus $150,000 in emergency consulting to fix the process.

Notice the pattern. None of these companies broke the law on purpose. They ran campaigns on processes that were never built for the jurisdiction they hit.

That's the failure mode worth watching. A CAN-SPAM-built process assumes opt-out is enough. Send that same process into Germany, where prior consent is typically required even for B2B under the UWG, and you're non-compliant the moment you hit send. Recipient location determines the law, not sender location, so a US-based team emailing a German IT manager triggers GDPR and German national rules regardless of where the email originated.

Suppression is the quieter failure. Most teams maintain an opt-out list per campaign, then launch a new campaign from a different domain and re-contact people who already unsubscribed. One practitioner analysis calls a per-campaign suppression list the most common avoidable compliance failure. The fix is unglamorous: one global, permanent suppression list across every campaign and domain, kept for at least five years, with opt-outs honored same-day in practice.

There's one more thing most businesses miss. Hiring an agency does not transfer liability. You're responsible for what a vendor sends on your behalf, which means a provider's compliance practices become your exposure. That's why we treat compliance as part of the outreach work itself at Worqd: personalized, permission-aware outreach to relevant accounts, with documented sources, rather than a template blast. When you evaluate any provider, ask for the paper trail: where contacts came from, how opt-outs are suppressed, and how the process changes by jurisdiction.

The rules aren't complicated. They're just three different rulebooks, and the fines land on the teams that tried to satisfy all of them with one process.

What to Demand From a Cold Email Provider Before You Sign

A provider's compliance claims mean nothing if they can't survive an audit. Before you sign, ask for the documentation that proves defensibility across every jurisdiction you're emailing into, because a message that's lawful in one EU member state can be unlawful in another.

Start with jurisdiction segmentation. Recipient location determines the law, not sender location, so any provider running a single EU-wide send is already cutting corners. Look for country-level segmentation and a default to the strictest opt-out standard across mixed campaigns. Then demand the paperwork.

• A documented Legitimate Interest Assessment for every EU and UK campaign, with Purpose, Necessity, and Balancing tests on file. Roughly 70% of GDPR enforcement actions cite improper email sourcing, according to enforcement analysis from Growleads.
• Global, permanent suppression across all campaigns and domains. Per-campaign suppression is the most common avoidable failure, as RevenueFlow's compliance breakdown notes. Opt-outs should clear within 10 business days, same day in practice, with suppression records retained at least five years.
• Clear liability allocation in the contract. Hiring an agency does not transfer liability, so confirm in writing how compliance responsibility is split.
• Rejection of any provider relying on purchased or scraped lists. A bought list has no lawful basis under GDPR and no existing business relationship under CASL.
• Authentication and unsubscribe infrastructure that satisfies both regulators and mailbox providers: SPF, DKIM, DMARC, and one-click unsubscribe under RFC 8058.

That last point matters more than most buyers realize. The behaviors that keep regulators away, like accurate sender identity and an easy opt-out, also keep spam complaint rates low and inbox placement high. Legal compliance and deliverability are the same workstream now, not two separate ones.

At Worqd, our B2B cold email and outreach work is built as permission-aware outreach to relevant accounts, with consent captured explicitly at booking. Ask any provider the same questions we'd expect: show me the LIA, show me the suppression architecture, and show me who carries the liability. If they can't, keep looking.

How Compliance Connects to Replies and Revenue

A compliant cold email program and a high-performing one are not two separate projects. The same work that keeps regulators away, accurate identity, honest subject lines, real opt-outs, and clean lists, is the work that gets your messages delivered and answered.

The gap between the two is measurable. Compliant B2B cold email open rates land between 27.7% and 31.32%, and top performers reach 40% to 50% with personalization. Meanwhile, 95% of cold emails generate zero reply, and pushing past 10 messages to the same recipient drops response rates to 3.8%. Volume without discipline buys you nothing.

That's why list quality and sending frequency matter more than raw output. A provider that segments by jurisdiction, documents its legitimate interest assessments, maintains global suppression, and authenticates every sending domain isn't just protecting you from fines. It's doing the work that lifts inbox placement and reply rates at the same time.

Customers already expect this level of care. According to Salesforce research, 79% of customers expect companies to understand their needs before contacting them. A generic blast to a scraped list signals the opposite.

Compliance done properly shows up in your pipeline, not just your legal file:

• Jurisdiction segmentation means the right message reaches the right market, not a single EU-wide send that breaks local rules.
• Documented LIAs and consent records support defensibility while forcing sharper targeting.
• Global, permanent suppression protects sender reputation, which protects deliverability.
• Verified authentication (SPF, DKIM, DMARC) keeps you out of spam folders and in front of buyers.

At Worqd, B2B outreach is built as personalized, permission-aware contact with relevant accounts, the opposite of a template blast. That approach is also why follow-up lands in inboxes instead of spam complaints. Compliance and revenue aren't in tension. They run on the same discipline.