Cold Email Compliance: CAN-SPAM, GDPR, and CASL Guide
Cold email compliance is non-negotiable. Violating email regulations can result in fines up to €20 million (GDPR) or $46,517 per email (CAN-SPAM). This guide covers the three main frameworks that govern cold email: CAN-SPAM, GDPR, and CASL.
CAN-SPAM Act (United States)
The CAN-SPAM Act applies to all commercial emails sent to US recipients.
Requirements: 1. **No misleading headers** — Your From name, reply-to, and domain must accurately identify you 2. **No deceptive subject lines** — The subject must relate to the email content 3. **Identify as an advertisement** — Not strictly required for B2B but recommended 4. **Include physical address** — Your valid business mailing address must appear in the email 5. **Provide opt-out mechanism** — Recipients must be able to unsubscribe 6. **Honor opt-outs within 10 days** — You must process unsubscribe requests promptly 7. **Monitor third parties** — You are responsible even if an agency sends on your behalf
CAN-SPAM for Cold Email in Practice: - Include your business address in your email signature - Add an unsubscribe link or include language like "Reply STOP to opt out" - Process opt-outs immediately (most cold email platforms like [Instantly](/tools/instantly) and [Smartlead](/tools/smartlead) handle this automatically) - Do not use misleading From names or subject lines
Penalty: Up to $46,517 per email in violation.
GDPR (European Union)
GDPR is stricter than CAN-SPAM and applies to emails sent to EU residents, regardless of where you are located.
Legal Basis for Cold Email Under GDPR: Cold email is possible under GDPR using the **legitimate interest** basis (Article 6(1)(f)). This requires:
- Legitimate interest — You have a genuine business reason to contact them
- Necessity — Email is a reasonable way to reach them
- Balancing test — Your interest does not override the recipient's privacy rights
Practical Requirements: - **B2B only** — Target people in their professional capacity, not personal emails - **Relevant to their role** — A VP of Sales getting a sales tool email = legitimate. A random person getting an unrelated pitch = not legitimate. - **Easy opt-out** — Include clear unsubscribe option in every email - **Data minimization** — Only collect and process data you actually need - **Record keeping** — Document your legitimate interest assessment - **Honor requests** — Delete data upon request (right to erasure)
GDPR for Cold Email in Practice: - Only email business addresses (not personal Gmail, Yahoo, etc.) - Ensure your message is relevant to the recipient's professional role - Include "Unsubscribe" link and honor it within 30 days (sooner is better) - Keep records of where you sourced each email address - Be prepared to delete contact data if requested
Penalty: Up to €20 million or 4% of annual global turnover.
CASL (Canada)
Canada's Anti-Spam Legislation is the strictest of the three. It requires consent before sending commercial emails.
Types of Consent: 1. **Express consent** — The recipient explicitly agreed to receive emails from you 2. **Implied consent** — Limited circumstances: - Existing business relationship (within 2 years of last transaction) - Published email address without a "no unsolicited email" notice - Referral by someone who has a relationship with the recipient
CASL for Cold Email: - Cold emailing Canadian prospects is risky without implied consent - **Published business email** on a company website can provide implied consent if the email is relevant to their role - Include your identity, physical address, and unsubscribe mechanism - Process opt-outs within 10 business days
Penalty: Up to $10 million CAD per violation.
Compliance Checklist for Cold Email
Regardless of jurisdiction, follow these practices:
- ✅ Only email business addresses, never personal
- ✅ Include your business name and physical address
- ✅ Include an unsubscribe mechanism in every email
- ✅ Honor opt-outs immediately
- ✅ Do not use misleading From names or subject lines
- ✅ Keep your message relevant to the recipient's professional role
- ✅ Verify emails with ZeroBounce or NeverBounce to avoid emailing invalid addresses
- ✅ Document your data sources and legitimate interest basis
- ✅ Use a dedicated sending platform that handles compliance features
How Cold Email Platforms Help with Compliance
Most dedicated cold email tools include compliance features:
- Instantly — Automatic unsubscribe handling, global suppression list
- Smartlead — Unsubscribe management, opt-out tracking
- Lemlist — Built-in unsubscribe, GDPR compliance features
- Woodpecker — Strong compliance features, EU-based company
These platforms automatically stop emailing contacts who opt out, which is critical for CAN-SPAM and GDPR compliance.
Compare platforms to find one with the compliance features you need, or browse all tools by category.