What Prior Written Consent Actually Means

If a regulator ever asks you to prove someone agreed to hear from you, "they seemed interested" won't cut it. Prior written consent is the standard that will, and understanding it is the first step in checking whether any outreach partner actually follows it.

At its core, prior written consent means advance, documented, verifiable permission. Each word carries weight. "Prior" means the permission exists before the first message goes out, captured through an opt-in action taken before any collection or processing of personal data. "Written" means a written statement or a digital note, something recorded rather than spoken. "Verifiable" is the part most businesses miss: the record has to be good enough to prove consent actually happened.

Canada's regulator frames the underlying idea clearly. Under CASL, express consent means a person has "clearly agreed to receive a commercial electronic message, either in writing or orally," according to the CRTC's compliance guidance. The U.S. TCPA uses the phrase "prior express written consent" in certain automated-contact contexts, which is where the exact term shows up most often in North American law.

Why do regulators put the burden of proof on the sender? Because the sender is the one who benefits. The CRTC states it plainly: "The onus of proving consent, be it express or implied, is on the person who claims they have consent." If you can't produce records showing the electronic address, the date, and the method by which consent was received, the law treats you as if you never had it.

That's why strong consent capture goes beyond a checkbox. Best practice includes:

• The exact text of the consent statement the person saw
• A timestamp showing when they agreed
• The IP address tied to the submission
• The electronic address consent was given for

The stakes make documentation worth the effort. Roughly 35% of the €7.1 billion in GDPR fines issued since May 2018 involved consent violations, according to enforcement analysis. And liability follows the brand even when a vendor sends on your behalf, so you can't outsource the responsibility.

This is also the standard worth checking when you evaluate a growth partner. Worqd's booking flow, for example, requires an explicit "I agree to be contacted about my request" checkbox before any details are captured, and its outreach is described as personalized and permission-aware rather than a template blast. That's the practical shape of prior written consent: ask first, record it, and be able to prove it later.

When the Law Requires It (and When It Doesn't)

Whether you need prior written consent at all depends on where your recipient is sitting, and that's where most outreach programs get into trouble. The same email can be perfectly legal in Texas, risky in Toronto, and fined in Munich.

Start with the United States. Under CAN-SPAM, you don't need anyone's consent before sending a commercial email. The FTC's compliance guide is blunt about it: no consent required, no exception for business-to-business email, but recipients keep their right to opt out, and penalties run up to $53,088 per email. The catch is TCPA, which some legal observers read as requiring prior express written consent for automated sends, though its application to email remains a gray area rather than a settled rule.

Canada is stricter. CASL requires express or implied consent before the first send, and it makes no exception for B2B outreach. The CRTC's guidance puts the burden squarely on you: the onus of proving consent falls on the person claiming it, with penalties reaching $10 million per violation for organizations.

Europe looks permissive on paper and isn't. GDPR lets B2B cold email run on legitimate interest under Article 6(1)(f) rather than consent, as analysis of EU enforcement explains. But the ePrivacy Directive is implemented differently in each country, so you can be GDPR-compliant and still break national law. Germany and Austria demand prior opt-in even for B2B, with Germany requiring double opt-in to corporate addresses and fining up to €300,000 per case under UWG Section 7.

Here's the quick map:

• US (CAN-SPAM): no consent needed, just working opt-out within 10 business days.
• Canada (CASL): express or implied consent required, even B2B.
• Most of the EU: legitimate interest works, with documented assessments on file.
• Germany and Austria: prior opt-in required, full stop.
• UK, Ireland, Nordics: most permissive in Europe, opt-out only for B2B.

This is why teams targeting Europe either build country-specific workflows or, as one comparison notes, default to the German standard for every EU prospect. That second approach is the one that holds up in practice. When your list spans jurisdictions, the strictest market you touch effectively sets your working standard, because regulators don't average the rules for you.

It's also why we run Worqd's outreach as permission-aware by default rather than jurisdiction-by-jurisdiction. Personalized sends to relevant accounts, explicit opt-in in our own booking flow, and no sensitive form fields pushed to analytics keep the program defensible everywhere, which costs far less than retrofitting compliance after a complaint lands.

The stakes are real: €7.1 billion in GDPR fines have accumulated since May 2018, and roughly 35% involved consent violations. If you're evaluating an outreach partner, ask how they document consent and which standard they build to. If the answer is "it depends on the country," you're carrying the risk they haven't priced in.

The Cost of Getting Consent Wrong

Getting consent wrong isn't an abstract risk. Regulators have collected €7.1 billion in GDPR fines since May 2018, and roughly 35% of those cases involved consent violations, according to enforcement tracking data. If your outreach touches the EU, that number is the backdrop to every send.

The U.S. looks friendlier on paper, but the ceiling is still steep. Under CAN-SPAM, penalties reach $53,088 per email, per the FTC's compliance guide. Canada goes further: CASL caps penalties at $10 million CAD per violation for organizations. Real cases show regulators aren't bluffing. CNIL fined Orange France €50 million for ads without clear consent, and Italy's regulator hit Enel Energia with €26.5 million for campaigns sent without valid consent.

Here's the part that surprises most companies: hiring an agency doesn't move the risk. The FTC is explicit that "you can't contract away your legal responsibility to comply with the law," and both the brand being promoted and the sender can be held liable. Under CASL, the primary organization remains liable even when a vendor sends on its behalf. The fines land on your company, not your contractor.

That reality makes a provider's consent practices a due-diligence question, not a nice-to-have. Before you sign with anyone running outreach for you, ask:

• How is consent captured, and what's recorded? The CRTC expects the electronic address, date, and method of consent, and the burden of proof sits entirely on the sender.
• Is outreach personalized to relevant accounts, or is it a template blast to a purchased list? Buying from a non-compliant provider doesn't eliminate your direct liability.
• What happens to form data after capture? Sensitive fields flowing into public analytics is a data-minimization failure waiting to become a finding.

This is why Worqd treats consent as a design decision rather than a checkbox. Our booking flow requires an explicit "I agree to be contacted about my request" before any details are submitted, and states plainly that those details are used only to prepare for the call. Our B2B outreach is permission-aware and personalized to relevant accounts, which is a higher bar than CAN-SPAM demands and consistent with how the strictest jurisdictions expect senders to behave.

The math is simple. A compliance failure costs more than any campaign could plausibly earn you, and the liability stays with your name no matter who pressed send. Vetting how a provider handles consent is cheaper than explaining to a regulator why you didn't. If you want outreach built with that discipline from day one, book a growth call and ask us about it directly.

What Good Consent Records Look Like

A checked box means nothing on its own. What matters is what you can prove months later, when a regulator asks you to show it.

The burden sits entirely with the sender. Canada's CRTC states plainly that the onus of proving consent is on the person who claims they have it, and recommends records capturing the electronic address, the date, and the method consent was received. So "prior written consent" is really a records discipline, and a weak record is functionally the same as no consent at all.

Here's what a defensible consent record includes:

• A timestamp showing exactly when the person opted in
• The IP address tied to the submission
• The verbatim consent text the person actually saw and agreed to
• An opt-in box that was unchecked by default, so consent came from a positive action
• Proof that unsubscribe requests were honored within 10 business days, the deadline under both CAN-SPAM and CASL

The unchecked-by-default point matters more than it looks. GDPR consent requires a proactive opt-in action; pre-ticked boxes and vague permission statements don't meet the standard. The same logic applies to wording: capture the exact sentence, because if your consent text changes, your old records no longer match what people agreed to.

Data minimization is part of the same discipline. If someone submits a form, the sensitive fields in that submission shouldn't flow into public analytics tools where they sit outside your consent controls. This is why Worqd's booking flow, for example, requires an explicit "I agree to be contacted about my request" checkbox while keeping sensitive form fields out of public analytics entirely. Consent capture and data handling are two halves of the same practice.

The stakes are concrete. Roughly 35% of the €7.1 billion in GDPR fines collected since May 2018 involved consent violations, and CAN-SPAM penalties reach $53,088 per email. When you evaluate an outreach provider, ask to see a sample consent record: timestamp, IP, exact text, and opt-out handling. If they can't produce one on the spot, you've learned everything you need to know.

How Worqd Handles Consent in Its Own Funnel

Theory is fine, but consent practices are easiest to judge when you can see one in the wild. Here's how Worqd's own booking flow works as a worked example, and what it tells you about any provider you're evaluating.

Before anyone books a growth call at worqd.com, the funnel asks them to check a box: "I agree to be contacted about my request." The form states plainly that details are only used to prepare for the call. That's a positive, unchecked-by-default opt-in, which matches how compliance guidance defines express consent under Canada's CASL. No pre-ticked boxes, no implied agreement.

The same discipline extends to outbound. Worqd describes its B2B outreach as "personalized, permission-aware outreach to relevant accounts," the opposite of a template blast. That's a deliberate choice, since U.S. law technically requires no prior consent for marketing email at all under the FTC's CAN-SPAM guide. The stricter posture matters because the burden of proof sits with the sender: Canada's regulator states that "the onus of proving consent, be it express or implied, is on the person who claims they have consent," with records capturing the address, date, and method (CRTC guidance). Worqd also keeps sensitive form fields out of public analytics, part of the same data-minimization stance.

Why does this matter to you? Because liability follows your brand, not your vendor. The FTC is explicit that hiring another company to send your email doesn't transfer legal responsibility, and under CASL the primary organization remains liable even when an agency sends on its behalf. With €7.1 billion in GDPR fines collected since 2018, roughly 35% involving consent violations, the stakes are real.

Before you let any provider send on your behalf, ask:

• How do you capture and document consent? You want records with address, date, method, and the exact consent text.
• Do you pre-tick boxes or use vague permission language? GDPR standards reject both.
• What's your legal basis per jurisdiction? Legitimate interest works in some countries; Germany and Austria require prior consent even for B2B.
• Where does form data go? Sensitive fields shouldn't land in public analytics tools.

A provider who answers these quickly, with specifics, has thought about it. One who changes the subject hasn't, and that's your answer.