Most B2B teams treat compliance as a legal afterthought — something to worry about if a prospect complains. That's backwards. A 2025 review of enterprise mailbox providers found that spam complaint rate, not any single authentication flag, is the strongest predictor of domain-wide inbox placement drops. Compliance violations and deliverability failures are usually the same event described from two different desks: legal calls it a CAN-SPAM violation, and the sending team calls it a domain that suddenly can't reach the inbox.
The rules themselves aren't complicated, but they differ meaningfully across CAN-SPAM, GDPR, and CASL, and most cold email automation platforms don't enforce any of them by default — they'll happily let a sequence email an EU contact with no legitimate-interest basis or omit a physical address from a footer. This guide covers what each regime actually requires for B2B outreach, where the real risk sits, and how to build compliance into automated prospecting instead of bolting it on after a complaint.
Regulators rarely go after individual B2B senders directly — enforcement actions against small and mid-market companies for a single cold email are vanishingly rare. The practical risk isn't a fine. It's that non-compliant sending behavior produces the exact signals mailbox providers use to demote a domain: high spam complaint rates, unsubscribe requests that go unhonored and get reported as spam instead, and sending patterns that match known abuse profiles.
Gmail and Microsoft's bulk sender requirements, which we've covered in detail in our cold email deliverability guide, now explicitly require a one-click unsubscribe mechanism and a sub-0.3% spam complaint rate for any domain sending meaningful volume. Every major compliance regime — CAN-SPAM's opt-out requirement, GDPR's right to object, CASL's consent-and-unsubscribe rules — maps almost directly onto those same technical requirements. Build for compliance and you build for deliverability at the same time; ignore one and the other degrades with it.
CAN-SPAM is permissive relative to GDPR — it doesn't require opt-in consent before the first email, which is why cold email remains legal for B2B outreach in the US. But "legal" and "safe to ignore" aren't the same thing. The requirements that actually matter for a sending program:
- A working, honored opt-out mechanism. Every email needs a clear unsubscribe option, and requests must be processed within 10 business days — in practice, automated systems should honor them within minutes, both because delayed suppression drives spam complaints and because Gmail and Yahoo's bulk sender rules now expect near-instant processing. - Accurate header and subject line information. No deceptive "Re:" prefixes on a first-touch email, no subject lines that misrepresent the message content. This is enforced more by spam filters than by regulators at this point — deceptive subject lines are one of the clearest machine-learning signals filters use to classify a sender as abusive. - A valid physical postal address in the footer. A frequently skipped requirement that costs nothing to include and is trivial to template into every sequence. - Correct identification of the message as an advertisement where applicable. Most relationship-building B2B outreach doesn't require this, but sequences that pivot into a promotional offer should include it.
None of this requires opt-in consent for a first cold email to a business contact — that's the core distinction that makes CAN-SPAM materially different from GDPR, and it's why most US-focused cold email automation is built around CAN-SPAM's lighter-touch model by default.
GDPR is where most cold email programs actually get exposed to risk, because it applies to any email sent to a contact located in the EU or UK regardless of where the sending company is based. The common misconception is that GDPR bans cold email outright. It doesn't — B2B cold outreach can rely on "legitimate interest" as a lawful basis instead of opt-in consent, but legitimate interest has real conditions attached, not a blanket exemption:
- The outreach must be genuinely relevant to the recipient's professional role. Legitimate interest covers a message plausibly useful to someone in that specific position at that specific company — it does not cover a mass list scraped without regard to actual fit. This is one of the strongest arguments for tight ICP scoring before a contact ever enters a sequence; a well-scored list isn't just a conversion-rate lever, it's the compliance basis itself. - A clear, immediate opt-out must be available on the first message, not buried three touches into a sequence. - The recipient must be told who's contacting them and why, in plain terms, in that first email. - Data minimization applies. Store only the contact information necessary for the outreach itself, and be able to produce or delete a contact's data on request — GDPR's right to erasure applies to a prospect database exactly as it does to a customer database.
Practically, this means a EU-targeting sequence needs firmer ICP discipline than a US-only one, a visible opt-out on touch one instead of touch three, and a data retention policy that actually deletes contacts who unsubscribe rather than just suppressing future sends while retaining the record indefinitely.
CASL is the strictest of the three regimes relevant to most B2B senders, because it defaults to requiring consent rather than treating legitimate interest as sufficient on its own. B2B senders typically rely on CASL's "existing business relationship" or "conspicuous publication" exemptions — the latter covering situations where a contact has publicly published their business email in a context reasonably related to their role, which covers most cold outreach to a publicly listed corporate email address. Two things matter more under CASL than under CAN-SPAM or GDPR: the sender's identity and contact information must be unambiguous in every message, and the unsubscribe mechanism must function for a minimum of 60 days after the message is sent, with no exceptions. Teams running list-building processes like the ones described in our B2B contact data guide should tag Canadian contacts specifically, since the exemption basis differs from both the US and EU default.
The reliable way to handle three overlapping regimes at B2B scale isn't a manual review step before every send — it's building the rules into the automated prospecting workflow itself, the same way domain warmup and send-rate limiting get built in rather than checked by hand. A few things that should be automatic rather than manual:
- Geography-aware suppression logic, so a contact's location determines which consent basis and unsubscribe rules apply before the first email goes out, not after a complaint arrives. - Instant, cross-sequence unsubscribe processing. A single opt-out should suppress a contact across every active and future sequence immediately, not just the one they replied to. - A retained, queryable suppression list that persists independent of any single campaign, so a contact who opts out in March never resurfaces in a new list uploaded in September. - ICP scoring tight enough to double as a relevance filter, not just a conversion filter — the same targeting discipline we detail in our ICP scoring framework is what makes a legitimate-interest basis defensible under GDPR in the first place.
This is also where the case for automated prospecting over a manually run SDR motion gets stronger, not weaker. A human SDR working from a spreadsheet is realistically not cross-referencing every new contact against a suppression list and a geography-specific consent rule before every send. A system built to enforce those rules at the point of send does it on every contact, every time, without the rule depending on someone remembering to check.
- Reusing a purchased or scraped list without geography tagging. A single untagged EU or Canadian contact in a US-focused blast is enough to trigger a legitimate complaint and a spam-filter penalty simultaneously. - Slow-walking unsubscribe processing. Even a 24-hour delay between an opt-out request and suppression is long enough to generate a spam complaint from an impatient recipient, which does more deliverability damage than the delay itself. - Treating compliance as a one-time list scrub. Consent and relevance basis need to be current at send time, not at the time a contact was first added to a database months earlier. - No audit trail. Being unable to show when and how a contact opted in, or when they opted out, turns a routine complaint into a much harder conversation with a regulator or an email provider's abuse team.
Compliance and deliverability aren't separate workstreams for a serious B2B outreach program — they're the same discipline viewed from two angles, and building one into automated prospecting builds the other in for free. Tight ICP scoring, geography-aware suppression, and instant opt-out processing do more to protect a sending domain than any authentication record alone.
OnyxSend enforces geography-aware suppression, cross-sequence unsubscribe processing, and scored targeting inside the same automated prospecting workflow, so B2B teams can scale cold email automation without treating CAN-SPAM, GDPR, and CASL as three separate manual checklists. See our pricing or request access to see how a compliant sequence is built and scored before it ever reaches a prospect's inbox.