Cold email compliance checklist for GDPR and CAN-SPAM

Know which rule applies to whom

CAN-SPAM applies to commercial email sent to or from the United States and sets rules on identification, subject lines and opt-out. GDPR governs personal data of people in the EU and EEA, including business contacts, and requires a lawful basis and a way to exercise rights. Other countries add their own consent rules; Canada, the UK and Germany are common examples of stricter regimes.

A single campaign can fall under several at once. Segment the list by jurisdiction so a stricter rule is not accidentally applied to everyone, or ignored for the people it protects.

• Map each recipient's jurisdiction before sending.
• Apply the strictest applicable rule to the whole segment.
• Do not assume B2B is exempt; it usually is not under GDPR.

Record the source and the basis

For each contact, you should be able to say where the data came from and why you are allowed to use it. A conference list, a public directory, a purchased file and a website scrape are four different answers, and one of them may not support outreach at all.

Record the collection date. Data ages, and the basis for contacting someone two years after a conference is weaker than the basis a month later.

• Source recorded per contact, not per file.
• Lawful basis identified and written down.
• Collection date stored with the record.
• A named owner for data questions.

If you need contact data with a traceable source, sourced B2B contact data is built around that requirement.

The message itself

Identify who you are, honestly and without a misleading subject line. Provide a working way to opt out that does not require an account, and honour it promptly. Under CAN-SPAM a physical postal address is required in commercial email; under GDPR, transparency about the data and the basis is required.

Do not hide the opt-out behind a link that fails, and do not require a reply to unsubscribe while ignoring replies. The mechanism must work, and someone must own it.

• Accurate From name and subject.
• A postal address where required.
• A one-click style opt-out that does not need a login.
• Objections processed within your stated window.

Sending infrastructure with suppression built in is what cold email campaigns provides.

Retention and the request you will eventually receive

Decide how long you keep contact data and what happens when someone asks for access or deletion. A deletion request that cannot be honoured because the data is scattered across spreadsheets, a CRM and three sending tools is a failure of design, not of effort.

Worked example: a team received a deletion request from a contact who had been imported into two lists and one campaign history. Because the source field existed, they found all three records in an hour, deleted the contact, suppressed the address, and documented the action. Without the source field, the third record would have kept receiving mail.

• One place that lists every system holding contact data.
• A deletion procedure that also suppresses the address.
• A written retention period with a review date.

If you are running a first campaign, the operating plan in a first campaign plan keeps compliance decisions in scope.

The three records that answer most questions

When a regulator, a client or a recipient asks why they received your email, three records answer it: where the data came from, which lawful basis you relied on, and when they asked you to stop. If those exist and are accurate, the conversation is short.

Keep them together rather than across systems. A source field in the import file, a basis noted in a document nobody reads, and an opt-out in a third tool is not a record; it is three partial answers that take a day to reconcile.

Review the three records on a schedule. Data ages, bases change when the purpose changes, and an opt-out that was honoured in one tool may not have reached the other.

• Source, basis and objection history in one place.
• Reviewed on a schedule, not only after a complaint.
• Suppression propagated to every sending tool.
• Test the opt-out before every campaign, from an address that is not yours. A broken unsubscribe link is the kind of defect that turns a routine complaint into a formal one.
• Decide who answers a data request before one arrives. A named owner, a documented process and a place to record the outcome turn a stressful request into an hour of work. Without them, the first request exposes every gap at once, and the response time is decided by whoever notices it first.

Requirement, what it asks for and the practical check

A checklist is not legal advice. Confirm the requirement for each jurisdiction with a qualified adviser.

Frequently asked questions