The Phrase That Decides Whether Your Outreach Is Legal

You've seen the phrase everywhere: in your loan paperwork, in a provider's compliance page, in the fine print of a contract you almost signed. "Prior written consent required." Nobody stops to explain what it actually demands of you.

Strip away the legalese and the core meaning is remarkably consistent. In an SBA loan agreement, the borrower "will not sell or transfer any collateral... without the prior written consent of SBA," as one small business owner discovered when reviewing their EIDL collateral terms. A confidentiality agreement says the same thing about reproducing designs: no advance written permission, no action. Three elements, every time:

• It's permission, not notification. The other party has to agree, not just find out.
• It's in writing. Verbal approval or a nod in a meeting doesn't count.
• It comes first. You get it before you act, never after.

In cold outreach, the phrase gets one more word and a lot more teeth. "Prior express written consent" governs autodialed, prerecorded, and AI-voice calls and texts to mobile numbers in the US, even in B2B contexts. Per telemarketing law guidance, that consent must be clear, conspicuous, documented, and easily revocable, and it can't be buried in your terms of service. A pre-ticked box fails the standard too, since GDPR requires a proactive opt-in action rather than implied agreement.

The stakes are real. TCPA violations run up to $1,500 per call or message. Canada's CASL carries penalties of $10 million CAD per violation for corporations. And the law follows the recipient, not your office: a US business emailing someone in Germany triggers GDPR for that contact, so multi-jurisdiction campaigns need to meet the strictest applicable rule.

This is where vetting a growth partner gets practical. If a provider runs AI voice agents or automated follow-up on your behalf, their consent practices become your legal exposure. Ask two questions: where is consent recorded, and how does someone revoke it? A provider who can't answer both crisply is guessing.

Worqd's own answer, per its stated practices, is permission-aware, personalized outreach to relevant accounts rather than template blasts, plus an explicit consent checkbox ("I agree to be contacted about my request") in its booking funnel. That's the shape real consent should take: a specific, documented, revocable yes, gathered before the first contact, with the details used only for the stated purpose.

The phrase isn't a technicality. It's the line between outreach that builds pipeline and outreach that builds legal risk, and now you know exactly which side of it your efforts sit on.

When You Need It and When You Don't

Consent rules swing wildly depending on where your prospect sits and how you reach them. A single campaign can trigger three different legal standards at once, and the strictest one wins.

In the US, email runs on an opt-out model. CAN-SPAM requires no prior consent at all, just a working unsubscribe you honor within 10 business days. Phone and text are a different world. The TCPA demands prior express written consent for autodialed, prerecorded, or AI-voice calls and texts to mobile numbers, even in B2B.

Europe and Canada split the difference in opposite directions.

• GDPR (EU/UK): B2B cold email usually runs on legitimate interest, not consent, as long as the outreach is role-relevant and documented. Germany and Austria still require prior consent under UWG.
• CASL (Canada): The strictest mainstream framework. Express or narrowly defined implied consent must exist before the first commercial message. Implied consent expires 2 years after a purchase or 6 months after an inquiry.
• HIPAA (US healthcare): Marketing use of patient data needs written authorization specific to that use. A checked box at registration doesn't cut it.

The fines make the stakes concrete. CAN-SPAM violations run up to $53,088 per email, TCPA up to $1,500 per call or message, and GDPR up to €20 million or 4% of global revenue. CASL tops out at $10 million CAD per violation for corporations.

Here's the rule that catches most teams off guard: the law follows the recipient, not your office. A US company emailing a contact in Germany answers to GDPR. Multi-state US calling must satisfy the strictest state standard. Where you sit is irrelevant.

That matters more than ever for AI-driven outreach. The FCC clarified in 2023 that AI voice bots face the same prior express written consent requirement as prerecorded messages. Any growth partner running AI SDRs or AI voice agents needs a documented answer to this.

Worqd states that its outreach is personalized and permission-aware rather than template blasts, and its booking funnel captures explicit consent ("I agree to be contacted about my request") before any follow-up. When you vet a provider, the practical test is simple: ask where consent is recorded and how someone revokes it. If the answer is vague, keep looking.

What Non-Compliance Actually Costs

The financial exposure from consent failures is staggering, and regulators aren't shy about enforcing it. A single CAN-SPAM violation can cost up to $53,088 per email, according to the FTC's own compliance guide. Multiply that across a campaign and the math gets ugly fast.

Across the Atlantic, the penalties run even higher. GDPR violations can trigger fines of up to 4% of global revenue or €20 million, whichever is greater. Canada's CASL sets corporate penalties at up to $10 million CAD per violation. And under the TCPA, each unauthorized call or text to a mobile number can carry up to $1,500 in statutory damages.

Real enforcement actions show these aren't theoretical numbers:

• Verkada paid a $2.95 million settlement to the FTC in 2024 (the largest CAN-SPAM penalty in the agency's history) after sending 30 million emails over three years with no working opt-out mechanism.
• Orange France absorbed a €50 million fine from France's CNIL for inbox ads designed to look like real emails, without clear consent from recipients.
• Compu-Finder, a Canadian company, received a CAD$1.1 million CASL fine after ignoring unsubscribe requests across 317,000 emails.
• Cadia Healthcare settled a HIPAA case for $182,000 after using patient data for marketing without written authorization.

Consent violations are the single largest driver of GDPR enforcement. Roughly 35% of all GDPR fines since May 2018 trace back to consent failures, according to enforcement tracker data. Yet only 24% of email marketers are fully GDPR compliant, which means most teams are operating with real exposure they don't fully see.

That gap is why vetting a growth partner's consent practices matters more than vetting their creative. Ask any provider where consent is recorded and how a recipient revokes it. If the answer is vague, the risk lands on you. When you work with Worqd, you can see the consent step built directly into the booking flow: an explicit "I agree to be contacted about my request" checkbox, with your details used only to prepare for the call.

AI Outreach Makes Consent Non-Negotiable

If your growth partner runs AI voice agents, the rules just got tighter. In 2023, the FCC clarified that AI voice calls fall under the same prior express written consent standard as prerecorded messages, a direct response to rising AI robocall abuse. If a provider you're considering uses AI SDRs or AI voice agents, that provider's consent practices now matter more than they did a few years ago.

The practical tests of real consent are straightforward. It has to be unambiguous, documented, and easily revocable, and it cannot be buried in terms of service. Under GDPR, pre-ticked boxes and vague permission statements fail the standard outright. So when you vet a provider, ask two questions:

• Where exactly is consent recorded, and can you show me?
• How does someone revoke it, and how fast does that revocation take effect?

Those questions matter because requirements swing hard by jurisdiction. US email runs on an opt-out model under CAN-SPAM, where penalties reach up to $53,088 per violating email. Canada's CASL is stricter, requiring express or narrowly defined implied consent before the first commercial message, with fines up to $10 million CAD for corporations. And because the law follows the recipient rather than the sender, a US business emailing into Germany answers to GDPR regardless of where its office sits.

This is where Worqd's stated practices come in. The company describes its B2B outreach as personalized, permission-aware outreach to relevant accounts rather than template blasts, and its booking funnel requires an explicit "I agree to be contacted about my request" checkbox. For a growth partner running AI systems that answer and qualify leads in under 60 seconds, that documented opt-in is the difference between fast follow-up and a compliance problem.

Want to see how consent gets handled on a real growth call? Book a Growth Call and ask where your prospects' permission lives.

How Worqd Handles Consent in Its Own Outreach

Everything in this section comes from Worqd's own stated practices, not from independent audits. We're labeling it clearly for that reason. But it's useful to see what a provider's consent posture actually looks like in practice, because the standards from earlier sections (clear, conspicuous, documented, revocable) are easy to claim and harder to build.

Worqd, the AI-powered growth agency, describes its B2B outreach as "personalized, permission-aware outreach to relevant accounts, the opposite of a template blast." That distinction matters legally. Under the TCPA, prior express written consent is required for autodialed or AI-voice calls and texts to mobile numbers, even in B2B contexts, and the FCC clarified in 2023 that AI voice bots fall under the same rules as prerecorded messages. Since Worqd runs AI SDRs and AI voice agents, that ruling applies directly to its outreach.

Here's what Worqd says it does, in its own words:

• Its booking funnel includes an explicit consent checkbox: "I agree to be contacted about my request." It's an affirmative action you take, not a pre-ticked box (which fails GDPR's standard) and not permission buried in terms of service.
• The funnel states that the details you submit are used only to prepare for the call. That's a purpose-limitation statement, which matters because consent for one use doesn't cover every use.
• Outreach targets relevant accounts with personalized messages rather than volume blasts. This aligns with the legitimate-interest logic under GDPR, where emailing a professional at their work address about something relevant to their job tends to pass the balancing test.
• No sensitive form fields are sent to public analytics tools. That keeps personal data out of third-party tracking systems where consent chains get murky.

Why does any of this matter to you as a buyer? Because enforcement is real and the penalties are steep. The FTC can fine up to $53,088 per violating email under CAN-SPAM, TCPA violations run up to $1,500 per call or message, and CASL penalties in Canada (where Worqd is based) reach $10 million CAD per violation for corporations. Roughly 35% of GDPR fines since 2018 have involved consent violations.

The practical takeaway: ask any provider you're vetting where consent is recorded, how someone revokes it, and whether the strictest applicable law governs their outreach. If a vendor can't answer those three questions plainly, that tells you something.

If you want to see how this works firsthand, book a growth call at worqd.com/book. You'll go through the consent flow yourself, and you'll see exactly what gets asked, what gets agreed to, and how your details are used before anyone follows up.