Leader
Cheat Sheet
Free
Cold Email Compliance Cheat Sheet (CAN-SPAM, GDPR, CASL)
A one-page comparison of the legal requirements for cold outbound email across the US, EU/UK, and Canada, plus a pre-send compliance checklist you can run before scaling into a new region.
What's inside
- Side-by-side comparison table: scope, consent model, sender ID, opt-out, record-keeping, penalties
- CAN-SPAM (US) requirements in plain language
- GDPR (EU/UK) requirements in plain language
- CASL (Canada) requirements in plain language
- B2B-specific nuances for each regime
- An 11-point pre-send compliance checklist
- A not-legal-advice disclaimer and when to escalate to counsel
This is a practical operating reference, not legal advice. Laws change and enforcement varies by jurisdiction — have counsel review your outbound program before scaling into a new region.
Side-by-Side Comparison
| CAN-SPAM (US) | GDPR (EU/UK) | CASL (Canada) | |
|---|---|---|---|
| Scope | All commercial email to US recipients, B2B and B2C alike; sender location irrelevant | Any processing of personal data of anyone in the EU/UK, regardless of where your company is based | Any "commercial electronic message" sent to or from a computer system in Canada |
| Consent model | Opt-out — consent not required before the first message | Consent or another lawful basis (legitimate interest is commonly used for B2B, but must pass a balancing test); several member states require opt-in for individual marketing under ePrivacy rules | Opt-in required — express consent, or implied consent (existing business relationship within 2 years, or an inquiry within 6 months) |
| Sender ID | Valid physical postal address required; no misleading header/from/subject info | Must identify the data controller and purpose of processing | Must identify the sender and someone who can be contacted on their behalf, plus a valid mailing address |
| Opt-out | Clear, working mechanism, honored within 10 business days | Consent must be as easy to withdraw as it was to give, honored without undue delay | Working unsubscribe mechanism, honored within 10 business days |
| Record-keeping | No formal consent records required (opt-out regime), but suppression lists must be maintained | Must maintain records of processing activities and the lawful basis relied on | Must be able to prove consent was obtained — who, when, how |
| Penalties | Roughly $50,000+ per violating email (FTC-adjusted annually); no private right of action for individuals; enforced by FTC/state AGs/ISPs | Up to €20 million or 4% of global annual turnover, whichever is higher | Up to CAD $10 million per violation for organizations; a private right of action was passed into law but has been indefinitely suspended — enforcement is currently via the CRTC |
| B2B nuance | No B2B exemption — same rules apply to business and consumer email | Legitimate interest is commonly used for B2B marketing but must be documented and balanced against individual rights | Implied consent via an "existing business relationship" or the "conspicuous publication" of a business contact's email tied to their role can cover some B2B outreach |
Pre-Send Compliance Checklist
- Sending domain and reply-to are real, monitored addresses
- Physical mailing address included in every commercial email (CAN-SPAM requirement)
- Working, low-friction unsubscribe link in every email
- Unsubscribes processed within 10 business days across all three regimes
- Suppression list checked before every send
- Subject lines are not deceptive about the email's content
- If targeting EU/UK contacts: documented lawful basis (consent or legitimate interest) on file per list/campaign
- If targeting Canadian contacts: consent basis identified per contact (express, existing business relationship, or conspicuous publication) and dated
- Consent/suppression records retained (who, when, how, and opt-out date if applicable)
- No purchased/scraped consumer email lists used for EU or Canadian sends
- Legal/compliance sign-off obtained before adding a new geography to outbound campaigns
How to use it
Run the 11-item checklist before every new outbound campaign, and use the comparison table to identify which consent basis and record-keeping standard applies before you send into a new country.