Cold Email Compliance 2026: CAN-SPAM, GDPR, and CASL Guide

What CAN-SPAM Actually Requires for B2B Cold Email

CAN-SPAM is the easiest framework and the one most US-based senders already satisfy without knowing it. Six requirements apply: identify yourself honestly, include a physical address, use accurate subject lines, honor opt-outs within 10 business days, avoid deceptive headers, and include an opt-out mechanism. No consent requirement. No prior business relationship needed.

The $517-per-email figure gets misquoted constantly. It's a maximum penalty per violation, not a flat per-email fine. Send 1,000 emails with no physical address and that's 1,000 violations. At $517 each, you're looking at $517,000 in maximum exposure. The math is harsh but the fix is one footer update.

What most teams miss: "opt-out mechanism" doesn't require a formal unsubscribe link. A reply-based opt-out ("Reply STOP to be removed") satisfies the requirement under FTC guidance, per FTC.gov CAN-SPAM enforcement documentation. Most sequences running on Smartlead or Instantly include this automatically. The bigger risk is honoring opt-outs within 10 days across your full tool stack. If a prospect replies "remove me" and your team re-adds them two weeks later, that's a violation.

CAN-SPAM Compliance Checklist

• Physical US mailing address in every email footer (a PO Box counts)
• Subject line matches email content, no false urgency or misleading offers
• From name and domain match your actual business identity
• Reply-based or link-based opt-out in every email
• Opt-out requests processed within 10 business days
• Unsubscribes suppressed in Apollo.io, HubSpot, and your sending tool simultaneously

GDPR and B2B Cold Email: The Legitimate Interest Argument

GDPR does not ban cold email to European prospects. Most teams assume it does and exclude EU lists entirely, missing a market where enterprise buyers sit. The legal basis for B2B cold outreach is "legitimate interest" under Article 6(1)(f) of the GDPR. If you pass the three-part test, you can email EU contacts without prior consent. Most role-targeted B2B outreach passes it.

The three-part test: (1) you have a real commercial reason to contact them, (2) the processing is necessary for that reason, and (3) the contact's interests don't override yours. Here's the position worth taking: a sales email to a VP of Marketing about a B2B tool they might buy passes part three. A cold text to a consumer at 11 PM does not. Context and relevance are what separate compliant B2B outreach from spam, and if your list is role-targeted and your pitch is relevant, you pass the test.

Where teams actually fail GDPR isn't on consent. It's the right to access and the right to erasure. Under Article 15, a prospect can ask what data you hold on them. Under Article 17, they can demand deletion. If your contact data lives in Apollo.io enriched by Clay with no audit trail, answering that request takes hours. Build the process before you need it.

Legitimate Interest Assessment Template

Run this assessment before adding any EU segment to your sequences. Document it. One paragraph per list segment is enough for most data protection authorities. They look for evidence of thought, not legal precision.

CASL: The Framework That Actually Trips Teams Up

CASL is the strictest of the three frameworks and the one most teams ignore until they're already in trouble. Unlike CAN-SPAM, CASL requires express or implied consent before sending commercial electronic messages to Canadian recipients. "Implied consent" exists if you've had a prior business relationship with the contact, but it expires after two years. Cold outreach with no prior relationship requires express consent first. That rules out traditional cold email for most sequences.

The practical answer: build a separate Canadian segment and route those prospects through LinkedIn before email. Identify Canadian contacts at the data-sourcing stage in Apollo.io using country-level filtering under the Person Search parameters, send a LinkedIn connection request first, and move to email only after you've established contact. CASL fines reach CAD$10 million per violation for corporations, per the Canadian Radio-television and Telecommunications Commission (CRTC). The 2017 Compu-Finder enforcement case resulted in a CAD$1.1 million fine for ignoring unsubscribes across 317,000 emails.

CASL Decision Tree for Canadian Prospects

• Express consent on file: proceed with email.
• Business relationship in the last two years: implied consent, proceed with documentation.
• Email publicly listed alongside business information: potential implied consent; document it before sending.
• No prior relationship, no public business listing: LinkedIn connection request first. Email only after a direct response.

Step-by-Step Compliance Audit for Your Outbound Setup

The first compliance audit takes 4-6 hours. Quarterly audits after that take about 2 hours each. Start with suppression lists, then work backward through data sources and active sequences. Most teams find 2-3 fixable issues in the first pass. Nearly every one of them comes from opt-out lists that exist in one tool but not another.

Step 1: Sync Your Suppression Lists Across Every Tool

Export opt-out lists from every tool you use: Instantly, Smartlead, Apollo.io, and your CRM. Compare them. In most setups these lists don't sync automatically. A contact who opted out in Smartlead can still get emailed from Apollo.io if the suppression lists aren't connected. This is the most common compliance gap across the campaigns Modern Inbound manages, and it's fixable in under an hour.

Fix it by exporting a master opt-out list from your CRM monthly and uploading it to every sending tool as a suppression list. Instantly and Smartlead both support webhook triggers for opt-out events. HubSpot's opt-out property can feed a Clay table that pushes suppression updates downstream.

Step 2: Document Your Data Sources

List where every contact in your sequences came from. For each source, confirm whether the data provider has a Data Processing Agreement (DPA) covering EU contacts. Apollo.io has a DPA available in its privacy documentation. Clay routes data through external enrichment APIs and each API has its own data terms. If you're mixing enrichment sources for EU contacts, you need a DPA from each enrichment vendor in the workflow, not just the primary one.

Step 3: Add Jurisdiction Flags and Audit Sequence Footers

In Apollo.io or Clay, add a "jurisdiction" column to every lead list: US, EU, CA, UK, Other. Build separate sequences or sequence branches for EU and Canadian contacts. Then open every active sequence in Smartlead or Instantly and check each template for a physical address in the footer, opt-out language, and accurate from-name. This audit takes 20 minutes. Most teams skip it when duplicating campaign templates, which is exactly when compliance gaps get introduced.

Monthly Compliance Maintenance: The 2-4 Hour Routine

Compliance drifts fast. Opt-outs pile up in one tool but not another. New sequences get launched without footer checks. A monthly routine keeps your setup clean and gives you a documented audit trail if a regulator ever asks. Two of the five tasks below can be partially automated; the rest take 15-30 minutes each.

If your spam complaint rate climbs above 0.1% in Google Postmaster Tools, stop and investigate before your next monthly review. Gmail defers mail before you hit 0.3%, per Google's 2024 Sender Requirements update. A rising complaint rate is a compliance signal and a deliverability signal at the same time. Document each monthly review with a timestamp in Notion or as a HubSpot task. Evidence of a documented process carries weight with regulators, per guidance from the UK Information Commissioner's Office (ICO).

What Compliance Actually Does to Your Reply Rates

A compliant setup performs better, not just safer. Clean suppression lists mean your sequences don't waste sends on opted-out contacts who'll mark you as spam. Accurate footers and from-names reduce spam flags from engaged prospects. Jurisdiction-segmented lists mean your EU and Canadian touches land with higher relevance because they've been routed through a more deliberate sequence. Teams that implement this framework see 2-3x reply rate improvement within 4-6 weeks, based on Modern Inbound's data across 3,000+ managed outbound campaigns.

The gain comes from two places: fewer wasted sends to people who already said no, and better deliverability because your sending domains carry lower complaint rates. On a 50,000-email-per-month motion, dropping your complaint rate from 1% to 0.05% means 475 fewer spam reports monthly. Your sequences land in primary inboxes. Replies climb. Compliance and performance aren't competing priorities here. They're the same thing.

If you'd rather skip building and maintaining this infrastructure yourself, this is exactly what Modern Inbound sets up for clients from day one. Book a call to see how the setup works.

Scale Outreach Without Hiring SDRs

Most B2B teams underestimate the work before sending: buyer-language research, list logic, DNS, warm-up, deliverability, copy testing, and reply handling. Modern Inbound runs the operating layer so founders can stay focused on sales calls.

Frequently Asked Questions

Is cold email to EU prospects legal under GDPR in 2026?

Yes. B2B cold email to EU prospects is legal under GDPR when you rely on legitimate interest under Article 6(1)(f). You need a genuine commercial reason to contact them, their role must match your ICP, and the contact would reasonably expect business-related email. Document your Legitimate Interest Assessment per list segment before launching any EU sequences.

How much can CAN-SPAM fines actually reach?

CAN-SPAM fines are $517 per violation, stacked per email and per broken rule. Send 1,000 emails with no physical address and a deceptive subject line, and that's 2,000 violations with up to $1,034,000 in maximum exposure. The FTC pursues patterns rather than single emails, but fixing the basics costs under 2 hours and eliminates the exposure entirely.

How long does it take to make a B2B outbound setup compliant?

The initial audit and setup takes 1-2 weeks for most teams running sequences on Instantly or Smartlead with Apollo.io as the data source. Ongoing maintenance runs 2-4 hours per month. The biggest time cost in the first pass is syncing suppression lists across all tools and adding jurisdiction flags to existing lead lists in Apollo.io or Clay.

What's the most common cold email compliance mistake B2B teams make?

Fragmented opt-out lists. A prospect unsubscribes in Smartlead but stays active in Apollo.io and gets re-enrolled in a new sequence two months later. This violates CAN-SPAM's 10-day opt-out requirement and GDPR's right to erasure simultaneously. The fix is a master suppression list in your CRM synced to every outbound tool monthly, not a one-time upload.

Do I need express consent to cold email Canadian prospects?

For cold outreach to Canadian prospects with no prior business relationship, CASL requires express consent before sending commercial electronic messages. Most B2B teams route Canadian prospects through LinkedIn first and move to email only after a direct response. Implied consent applies if you've had an active business relationship with the contact in the last two years, per CRTC CASL enforcement guidelines.