Cold Email Compliance: GDPR, CAN-SPAM and Consent

Tools on this site process lists you already hold; they don’t grant permission to mail them. That distinction decides whether your next campaign is marketing or a regulatory event. The three regimes below cover most senders — EU/UK, US, Canada — and they agree on one principle: the burden of proof sits with you.

1. Know which law follows the recipient

GDPR / UK GDPR (EU/UK recipients): you need a lawful basis under Article 6 before sending — typically consent (freely given, specific, informed, unambiguous) or legitimate interests backed by a documented balancing test and an immediate opt-out. Purchased lists almost never satisfy either: the seller’s “consent” rarely names you, covers your purpose, or survives scrutiny. Fines scale to 4% of global turnover, but the routine penalty is quieter — mailbox providers and blocklists treat non-consensual mail as spam regardless of what any lawyer argues.

CAN-SPAM (US recipients): no prior consent required for commercial mail, but every message must carry your valid postal address, a clear opt-out mechanism honored within 10 business days, and truthful headers and subject lines. Each violating message carries statutory penalties — multiply by list size to feel it.

CASL (Canadian recipients): the strictest of the three — express or narrowly defined implied consent required before sending commercial electronic messages, with C$10M-scale penalties. Implied consent from an existing business relationship expires (two years generally, shorter for inquiries).

When a list spans regions, apply the strictest applicable rule per recipient, not the sender’s home rule. Segment by geography first — the domain analysis guide plus TLD spread gives a rough cut — then apply per-segment bases.

2. Build the consent trail before you build the list

Practical minimums that satisfy auditors across regimes: record what was consented to (which content, which frequency), when and where (timestamp, form URL or event), and the exact wording shown. Double opt-in (confirmation click) is the gold standard — it kills typos, throwaways and disputes in one step. Keep suppression lists permanently: every opt-out, hard bounce and complaint joins a never-mail-again file that every future send checks first. Deleting suppressions “to clean the database” recreates liability from thin air.

Hygiene supports compliance directly: run imports through the Email Cleaner and Email Validator per the hygiene workflow, quarantine disposable and role rows (role-address framework), and re-confirm aged cohorts rather than assuming decade-old “consent” still holds. The no-send verification guide grades quality without risking reputation.

3. Honor opt-outs and retention like infrastructure

Every campaign carries: your identity and contact details, a one-click unsubscribe that works (test it — broken opt-out links are the most cited complaint in enforcement actions), and prompt suppression within days, not quarters. Retention gets a schedule, not vibes: hiring data, event signups and trial cohorts each get a deletion date, and the derived list is a regenerable artifact — keep the cleaning pipeline, not the stale copy. Document the legitimate-interest assessments where you rely on them; an undocumented balancing test fails exactly when you need it.

Note what this site never does, by design: no contact-discovery database, no mailbox verification via SMTP probing, no sending feature, no accounts holding your lists. Processing stays local so there is no second copy of personal data on someone else’s infrastructure — but lawful basis for contacting the list remains entirely your determination. When the answer isn’t clearly yes, ask counsel before sending, not after the complaint.

Common mistakes that create liability (not just bounces)

Buying a “verified opt-in list” is the classic one. Verification describes deliverability, not consent — a syntactically perfect address whose owner never heard of you is still non-consensual mail under GDPR/CASL. Sellers warrant deliverability because they can’t warrant permission.

Second, confusing extraction with authorization. Pulling addresses out of PDFs, Sheets or threads you hold (Gmail exports, resumes) organizes data you possess; it does not create consent to mail it. Possession and permission are different columns — keep them separate in every workflow doc.

Third, burying opt-out. Pre-ticked boxes (invalid consent under GDPR), unsubscribe links that require logins, “allow 30 days” delays beyond CAN-SPAM’s 10 — each converts a routine unsubscribe into evidence. One working link, honored fast, logged permanently.

Finally, inheriting lists without provenance. “Marketing gave me this CSV from 2021” with no consent records is not a mailing list — it’s a quarantine file until re-confirmed. Treat unknown-provenance imports as guilty until proven innocent: validate, segment, re-confirm, then mail only the confirmers.

Pro tips for staying boring (in a good way)

Make the five-gate cleaning pass (CRM import checklist) the documented pre-send step — auditors love repeatable pipelines with artifacts (change reports, validation counts, suppression diffs). Publish sender authentication (SPF/DKIM/DMARC setup) so your compliant mail actually reaches inboxes instead of being filtered alongside the spammers you now outperform.

Troubleshooting

Symptom	Likely cause	Fix
High spam complaints despite clean syntax	Non-consensual sourcing (purchased, scraped, inherited lists)	Stop mailing the cohort; re-confirm with double opt-in and mail only confirmers
Opt-outs keep receiving mail	Suppression list not checked, or sync lag across tools	Centralize one suppression file; check it before every send; never delete suppressions
EU/UK engagement collapses after enforcement-style filtering	No documented lawful basis; providers filter aggressively	Segment by region, document Article 6 basis per segment, keep consent records
Old list “used to perform” now bounces and complains	Addresses decayed, domains lapsed, permission stale	Re-validate, MX-check, re-confirm aged rows; retire what doesn’t confirm

FAQ

Can I cold-email businesses under GDPR legitimate interests?

Sometimes — with a documented balancing test, strictly relevant targeting, and immediate opt-out — but purchased lists and mass scraped outreach routinely fail the test. Legitimate interests is a reasoned assessment, not a blanket exemption; document it per campaign and keep the opt-out instant.

Does CAN-SPAM require prior consent?

No, but it requires truthful headers and subjects, your postal address, and an opt-out honored within 10 business days. And CAN-SPAM compliance doesn’t satisfy GDPR or CASL for their recipients — apply each recipient’s regime.

How long must I keep suppression records?

Effectively permanently. An opt-out is a do-not-contact instruction with no expiry under any of the three regimes; deleting it recreates the violation the next time the address resurfaces in an import. Suppressions are the one file that never gets “cleaned.”

Do these tools make my mailing compliant?

No tool confers consent. What local processing gives you is data minimization (no second copy on a vendor’s servers), auditability (change reports, validation counts), and hygiene (fewer bounces and traps) — all of which support compliance without substituting for lawful basis. The permission decision stays human.

What to do next

Harden deliverability with the SPF/DKIM/DMARC guide, grade quality via the no-send verification guide, and run imports through the CRM checklist. Tools: Email Validator, Email Cleaner, MX Lookup.