GDPR vs CAN SPAM: Cold Email Rules Compared (2026)

TL;DR

• GDPR vs CAN SPAM in one line: CAN-SPAM is an opt-out law, GDPR is a lawful-basis law. In the US you may email a stranger until they ask you to stop. In the EU/UK you need a documented legal reason to hold and use their data before you send anything.

• GDPR does not ban B2B cold email. Legitimate interest (Art. 6(1)(f)) can cover it — if the contact is a business role, the offer is relevant to their job, and you can produce a balancing test on demand.

• The penalty gap is enormous. CAN-SPAM tops out around $53,088 per violating email under FTC inflation adjustments. GDPR reaches €20M or 4% of global annual turnover.

• The riskiest part of your stack is not your sequencer — it's your list. Scraped, unverified, unsourced contact data fails both regimes for different reasons.

• One compliant workflow satisfies both: role-based business contacts, documented sourcing, verified deliverable addresses, honest identification, one-click opt-out, and honored suppression within days not weeks.

Most outbound teams learn about these two laws in the worst possible order. A complaint lands, legal asks "what's our basis for having this person's email," and nobody has an answer.

This GDPR vs CAN SPAM guide fixes that order. You'll get the text-level requirements of each law, where they clash, what the enforcement record really looks like, and one operating checklist that works whether your prospect sits in Austin or Amsterdam.

What is CAN-SPAM and what does it actually require?#

CAN-SPAM (Controlling the Assault of Non-Solicited Pornography And Marketing Act, 2003) is a US federal law enforced mainly by the FTC. It is permissive by design. There is no consent requirement, no opt-in, no registration. You can email anyone, once or a hundred times, as long as you follow a short list of mechanical rules.

The operative requirements for a commercial message:

1. Don't lie in the header. "From," "To," "Reply-To," and routing information must identify the actual sender. Spoofed domains and fake originating addresses are the fastest way into an FTC file.

2. Don't lie in the subject line. The subject must reflect the message content. "Re: our call yesterday" when there was no call is a textbook violation, and it is very common in cold email.

3. Disclose that it's an ad. This can be clear and conspicuous without being a giant banner. The recipient just has to understand the message is commercial.

4. Include a valid physical postal address. A street address, registered PO box, or private mailbox registered with a commercial mail-receiving agency.

5. Provide a clear opt-out mechanism and honor it within 10 business days. You may not charge a fee, require any information beyond an email address, or make the recipient log in or visit multiple pages.

6. Monitor what others do on your behalf. If an agency, SDR contractor, or affiliate sends for you, you are still liable. Outsourcing does not outsource liability.

Notably absent: any rule about how you got the address. CAN-SPAM does not care whether the contact was inbound, purchased, inferred, or found through a domain search. That single fact explains why the US outbound industry grew the way it did.

What is GDPR and why is it fundamentally different?#

The General Data Protection Regulation (in force since May 2018, plus the UK GDPR post-Brexit) is not an email law. It is a personal data law that happens to apply to email, because a work address like firstname.lastname@company.com identifies a real person. That distinction is the whole ballgame.

Under GDPR, before you store sarah.chen@acme.de in your CRM — before you send anything at all — you need a lawful basis under Article 6. For outbound sales, only two are realistic:

• Consent (Art. 6(1)(a)) — freely given, specific, informed, unambiguous, and revocable. Buying a list does not transfer consent. Neither does a checkbox someone ticked on a third-party site.

• Legitimate interest (Art. 6(1)(f)) — your commercial interest in reaching a relevant business contact, weighed against that person's rights and reasonable expectations. Recital 47 names direct marketing as a possible legitimate interest.

Legitimate interest is the basis nearly every compliant B2B outbound program in Europe runs on. It is not a loophole. It is a documented test with three prongs — purpose, necessity, and balancing — and you must be able to produce it.

Then Articles 13 and 14 kick in. When you collect data from a source other than the person, you must tell them within a reasonable period (at most one month) or at first contact. Say what data you hold, where it came from, and how to object.

Add the two rights that break most CRMs:

• Right to object (Art. 21) — for direct marketing, the objection is absolute. No balancing, no grace period, no "let me route this to my manager." Stop means stop.

• Right of access and erasure (Arts. 15 & 17) — a prospect can ask what you have and demand it be deleted, and you have one month to respond.

Then there's the layer people forget: ePrivacy. The 2002/58/EC directive is implemented separately by each member state, and it is stricter than GDPR on unsolicited email.

Germany's UWG effectively requires prior consent, even B2B. France's CNIL allows B2B outreach to professional addresses when the message relates to the recipient's job. Ireland and the Netherlands sit in between. So "GDPR compliance" is necessary but not sufficient. The member-state rule decides whether you can send at all.

GDPR vs CAN SPAM: how do the two laws compare?#

Here's the head-to-head that matters when you're building a sending policy.

Two rows deserve emphasis.

Extraterritoriality. GDPR Article 3 binds you if you target EU data subjects, wherever your company sits. A five-person startup in Denver emailing a procurement lead in Milan is in scope. There is no minimum-size exemption. The real enforcement risk for a small sender is low, but "low" is not "zero," and it rises once you are big enough to be worth a complaint.

Private right of action. CAN-SPAM does not let individual recipients sue you. GDPR Article 82 does. That is the structural reason EU failures escalate: any annoyed recipient can file with their DPA for free, and DPAs must look.

Is GDPR actually a ban on cold email in Europe?#

No — and this is the most expensive myth in outbound sales. Teams either freeze EU expansion or ignore the rules completely. Both choices cost money.

The workable position, backed in substance by the UK ICO's direct marketing guidance and CNIL's B2B prospecting position, looks like this:

1. Target roles, not humans. procurement@ and press@ are corporate addresses with weaker personal-data claims. A named person's work address is personal data, but if you target them because of their job function, the legitimate interest argument is much stronger.

2. Relevance is your legal armor. If you sell warehouse automation and you email a Head of Logistics, the balancing test writes itself. If you email that same person about crypto, it collapses.

3. Document your source. You need to answer "where did this come from" in one click. A provider with published data sources makes that trivial. A scraped CSV from a Slack group does not.

4. Disclose at first contact. One sentence in your first email — what you have, where you got it, how to object — covers most of Article 14 in practice.

5. Honor objections instantly and globally. Not per-campaign. Not per-mailbox. One suppression list across every tool that touches send.

6. Keep data fresh. Article 5(1)(d) requires accuracy. A list you haven't re-verified in 18 months is not just a deliverability problem. It's an accuracy failure.

That last point is where compliance and deliverability meet, which is the happiest accident in this field. Running your list through an email verifier before every campaign cuts bounces, protects sender reputation, and shows the data-accuracy discipline Article 5 demands. One action, two audiences: your CTO and your DPO.

What do the penalties actually look like in practice?#

Enforcement patterns differ as much as the statutes.

CAN-SPAM enforcement is rare, concentrated, and usually bundled with a broader fraud case. The FTC has brought a modest number of standalone actions. They target high-volume affiliate operations with forged headers and deceptive subject lines, not B2B SDR teams.

The statutory maximum per email sounds catastrophic. In reality, the risk for a legitimate sender is close to zero if you include an address and honor unsubscribes. The bigger US risk is not the FTC. It's Google and Microsoft. Their 2024 bulk-sender rules — authenticated domains, one-click unsubscribe, complaint rates under 0.3% — are enforced automatically and instantly, and they hurt more than any regulator.

GDPR enforcement in the outbound lane is real, but rarely fatal for small firms. The headline nine-figure fines target ad tech and platform consent, not SDR teams.

What actually happens to a mid-market B2B sender is simpler. One complaint triggers a DPA inquiry. The DPA asks you to explain your lawful basis and your data sources. If you can't, expect a fine in the tens of thousands. The reputational cost of that letter reaching your enterprise prospects usually exceeds the fine itself.

The asymmetry is worth internalizing: US risk is mostly technical (deliverability), EU risk is mostly documentary (can you explain your list).

Which rules apply when your list is mixed?#

Almost every real prospect list is mixed. You have US contacts, EU contacts, a UK cluster, a few in Canada under CASL, some in Australia under the Spam Act. Managing four rulebooks in one sequencer does not work.

The only sane approach is route by jurisdiction, comply to the strictest applicable standard per segment.

In practice that means three lanes in your CRM: an opt-out lane (US), a legitimate-interest lane (most of EU/UK), and a consent-only lane (DE, IT, and anywhere your counsel is nervous). Tag at import, not at send. If you enrich contacts through an API, capture the country field at enrichment time so routing happens before a single email is queued.

A note on vendors. Several reputable B2B data providers publish their compliance posture in detail. BookYourData, for example, documents its data provenance and offers region-filtered lists. That is exactly the kind of transparency that makes an Article 14 disclosure easy. Whichever provider you use, the test is the same: can they tell you, in writing, where a given record came from?

How do you build one outbound workflow that satisfies both?#

Here's the operating checklist. It's boring on purpose. Boring survives audits.

1. Source with provenance. Use providers that document collection methods and let you re-verify on demand. Discovery from public company domains — the way a domain search works — is defensible. Scraping a private LinkedIn export is not.

2. Verify before every send, not once at import. Roles change, people leave, domains get parked. A pre-send verification pass is both a deliverability control and an Article 5 accuracy control.

3. Segment by jurisdiction at import. Country field mandatory. No country, no send.

4. Write the balancing test once, keep it in Notion, review it quarterly. Three short paragraphs: what interest, why email is necessary, why the recipient's rights aren't overridden. If you can't write it for a segment, don't email that segment.

5. Add a first-touch disclosure line for EU/UK. One sentence: what data you hold, where it came from, how to object. It costs nothing in reply rate and buys you the whole of Article 14.

6. Put a physical address in every footer, everywhere. CAN-SPAM requires it in the US. Elsewhere it signals legitimacy and helps email deliverability filters trust you.

7. Keep one global suppression list, honored same-day. Every tool reads from it: sequencer, CRM, newsletter, event platform. Ten business days is a legal ceiling, not a target.

8. Log everything. Source, date acquired, verification result, first contact date, any objection. If a DPA asks, you export a row. If they ask and you can't, the fine is not really about the email.

9. Authenticate your domain. SPF, DKIM, DMARC. Neither statute requires it, but Gmail and Outlook do — and it's a forged-header defense you'll never need to make.

10. Re-verify quarterly and purge dead records. Storage limitation (Art. 5(1)(e)) means you shouldn't keep contacts you'll never email.

Teams that do all ten spend about an hour a month on compliance and never think about it again. Teams that skip step 8 spend three weeks rebuilding a data lineage under time pressure.

What are the most common mistakes teams make?#

Assuming a purchased list carries consent. It doesn't, ever. Consent is not transferable under GDPR. If a vendor calls their list "GDPR-consented," ask to see the consent record for one named contact. The silence is instructive.

Treating unsubscribe and objection as the same queue. A CAN-SPAM unsubscribe can take days. A GDPR Article 21 objection is immediate and covers all processing, not just email. Route them differently.

Using the B2B exemption as a blanket. The UK's corporate-subscriber exemption under PECR covers limited companies and LLPs. It does not cover sole traders or unincorporated partnerships, which are treated as individuals. Roughly a fifth of UK businesses fall outside it.

Believing a US entity is out of scope. Article 3(2) is explicit about targeting. Where your servers live is irrelevant.

Ignoring catch-all domains. Many EU corporates run catch-all mail servers, which return "valid" for addresses that don't exist. Sending to guessed addresses fills your list with fictional people, wrecks accuracy claims, and quietly destroys deliverability. A dedicated catch-all verifier separates real mailboxes from the noise.

Forgetting subprocessors. Your sequencer, your enrichment vendor, and your CRM are all processors under GDPR. You need a Data Processing Agreement with each. Most publish one. Almost nobody signs them.

Which law should shape your sending policy?#

Build to GDPR, comply with CAN-SPAM automatically.

That's the whole strategic answer to GDPR vs CAN SPAM. Every CAN-SPAM requirement — honest headers, a real postal address, a working opt-out — already sits inside a GDPR-grade process. The reverse is not true. A program built only for CAN-SPAM has no lawful basis, no source records, and no way to answer a DPA letter.

So set one bar for the whole program. Know where every contact came from. Send only what is relevant to that person's job. Say who you are. Stop the moment someone asks. Do that, and the US rules take care of themselves — while your deliverability improves at the same time.