All blogs & guides

COMPLIANCE

Cold Email Compliance: CAN-SPAM, GDPR, and CASL Explained Simply

By TransmitInbox team
Published August 19, 2026 · Updated October 13, 2026

You’ve found a business email address and have a relevant offer. Can you send it? The answer depends on the rules that apply to the recipient, how you got their details, and the basis for contacting them—not just whether you’ve included an unsubscribe link.

Identify the rules before building the campaign

Treat US, Canadian, EU/EEA, and UK audiences as separate review groups. GDPR and national electronic-marketing rules both matter in the EU/EEA. In the UK, PECR distinguishes corporate subscribers from individuals, including sole traders and some partnerships; UK GDPR may still apply. A US B2B workflow is not blanket permission elsewhere. ICO B2B guidance explains the UK distinction.

CAN-SPAM, GDPR, and CASL address different obligations. CAN-SPAM regulates commercial email in the United States. GDPR governs personal-data processing where it applies, while separate electronic-marketing rules also matter. CASL regulates commercial electronic messages with a Canadian connection. FTC guidance, European Commission guidance, CRTC guidance.

Your office location alone doesn’t answer which requirements apply. For example, the CRTC states that commercial electronic messages sent to recipients in Canada from another country must comply with CASL, subject to applicable exceptions.

Before choosing the message template, answer these questions:

• Where the sender and intended recipients are located.
• Whether recipients are individuals, sole traders, or incorporated businesses.
• How their contact details were collected.
• Any relationship, consent, or exception you intend to rely on.

If you don’t know an answer, check it before sending. An email domain alone won’t reliably tell you where someone is located.

Use list segmentation to keep these decisions manageable. A mixed list may need several different eligibility checks, even when everyone would receive the same offer.

CAN-SPAM: commercial email needs clear identification

CAN-SPAM applies to commercial messages, including business-to-business email. It isn’t limited to large campaigns.

The FTC’s core requirements include:

• Accurate sender, routing, and reply information.
• Subject lines that reflect the message’s content.
• Clear identification of the message as an advertisement.
• A valid physical postal address.
• A clear, easy method to stop future marketing emails.

Opt-out requests must be honored within 10 business days. The opt-out mechanism must remain capable of processing requests for at least 30 days after sending. You can’t charge recipients to unsubscribe or impose unnecessary steps (see FTC compliance guide).

Calling a sales pitch an ‘account update’ won’t change its actual purpose. Check what the message does, not the label your team gives it.

Put someone in charge of cancelling follow-ups after an opt-out. The right words in the footer are little comfort if another message goes out tomorrow.

GDPR: data processing and email permission are separate

When GDPR applies, processing personal data requires a lawful basis. Legitimate interests may be relevant to direct marketing, but it isn’t blanket permission to email anyone whose address you can find.

You must also examine the applicable electronic-marketing rules. The European Commission explicitly says email marketing must comply with the ePrivacy rules alongside data-protection requirements. National implementation matters, so avoid treating every European country as having identical B2B email rules. European Commission marketing guidance, ePrivacy Directive.

The UK has a separate framework involving UK GDPR and PECR. ICO guidance distinguishes corporate subscribers from individual subscribers, including sole traders and certain partnerships. Corporate subscribers generally don’t require consent under PECR’s email-marketing rule, but identification, opt-out, and applicable data-protection duties remain. Don’t apply that UK distinction automatically elsewhere (see ICO business-to-business guidance).

If considering legitimate interests, assess the purpose, necessity, and balance against the individual’s rights and expectations. Document the reasoning rather than simply adding “legitimate interests” to a spreadsheet (see ICO planning guidance).

Transparency also matters. For third-party marketing data, the Commission explains that individuals must be informed about the collection and marketing use no later than the first communication. People who object to direct-marketing processing must not continue receiving advertising.

Ask the list supplier how the data was collected and why your intended use is permitted. ‘GDPR compliant’ on a sales page isn’t an explanation of your particular campaign.

CASL: establish consent or a valid exception first

Where CASL applies, commercial electronic messages generally require consent, prescribed identification information, and an unsubscribe mechanism, unless an applicable exception changes those requirements. Consent may be express or implied under specific conditions.

Requests to unsubscribe must be processed without delay and no later than 10 business days. The unsubscribe link must remain valid for at least 60 days after the message is sent (see CRTC FAQ).

For cold outreach, pause at a familiar assumption: ‘The address is public, so we can email it.’ Under CASL, that conclusion needs more support.

The conspicuous-publication route has conditions. The recipient must have published, or caused the publication of, the address; there must be no accompanying statement against receiving commercial messages; and your message must relate to the recipient’s business role, functions, or duties. The sender must be able to demonstrate that the conditions are met (see CRTC implied-consent guidance).

If you rely on that route, keep the source, date, publication context, and reason the message fits the role. A purchased address with none of that background leaves you unable to explain the decision.

Don’t assume that all implied consent lasts indefinitely. Identify the specific basis, its conditions, and any applicable expiry before scheduling follow-ups.

Quick checklist before sending

Once the legal questions are settled, make the day-to-day process clear:

• Eligibility: Record why each audience group can receive the campaign.
• Evidence: Keep relevant consent, source, relationship, or assessment records.
• Identity: Review the sender name, subject, business details, and required address information.
• Transparency: Provide appropriate privacy information where required.
• Opt-outs: Test the mechanism and assign a responsible owner.
• Suppression: Check future imports and queued follow-ups.
• Review: Reassess when the audience, offer, data source, or jurisdiction changes.

Our guide to unsubscribes and complaints walks through the practical side of keeping those requests from getting lost between tools.

Be especially careful with three assumptions: that B2B is always exempt, that public means permitted, or that hiring an agency transfers all responsibility. If you can’t explain the basis for sending, resolve that question before the sequence starts.

Start by deciding who you may contact and why. A managed cold email service can help organise the records and opt-out process; a qualified adviser can help settle legal questions specific to your markets. Keeping those roles clear makes the campaign easier to manage.