# Cold Email Compliance Cheat Sheet (CAN-SPAM, GDPR, CASL)

> A one-page comparison of the legal requirements for cold outbound email across the US, EU/UK, and Canada, plus a pre-send compliance checklist you can run before scaling into a new region.

Free cheat sheet for sales leaders. Topic: [Cold Email, LinkedIn & Social Selling](https://www.peerlab.ai/library/topic/cold-email-linkedin-social-selling/). Published by PeerLab in the [Sales Enablement Resource Library](https://www.peerlab.ai/library/). Source: https://www.peerlab.ai/library/cold-email-compliance-cheat-sheet/

## How to use it

Run the 11-item checklist before every new outbound campaign, and use the comparison table to identify which consent basis and record-keeping standard applies before you send into a new country.

## What's inside

- Side-by-side comparison table: scope, consent model, sender ID, opt-out, record-keeping, penalties
- CAN-SPAM (US) requirements in plain language
- GDPR (EU/UK) requirements in plain language
- CASL (Canada) requirements in plain language
- B2B-specific nuances for each regime
- An 11-point pre-send compliance checklist
- A not-legal-advice disclaimer and when to escalate to counsel

*This is a practical operating reference, not legal advice. Laws change and enforcement varies by jurisdiction, have counsel review your outbound program before scaling into a new region.*

## Side-by-Side Comparison

| | CAN-SPAM (US) | GDPR (EU/UK) | CASL (Canada) |
|---|---|---|---|
| **Scope** | All commercial email to US recipients, B2B and B2C alike; sender location irrelevant | Any processing of personal data of anyone in the EU/UK, regardless of where your company is based | Any "commercial electronic message" sent to or from a computer system in Canada |
| **Consent model** | Opt-out: consent not required before the first message | Consent or another lawful basis (legitimate interest is commonly used for B2B, but must pass a balancing test); several member states require opt-in for individual marketing under ePrivacy rules | Opt-in required: express consent, or implied consent (existing business relationship within 2 years, or an inquiry within 6 months) |
| **Sender ID** | Valid physical postal address required; no misleading header/from/subject info | Must identify the data controller and purpose of processing | Must identify the sender and someone who can be contacted on their behalf, plus a valid mailing address |
| **Opt-out** | Clear, working mechanism, honored within 10 business days | Consent must be as easy to withdraw as it was to give, honored without undue delay | Working unsubscribe mechanism, honored within 10 business days |
| **Record-keeping** | No formal consent records required (opt-out regime), but suppression lists must be maintained | Must maintain records of processing activities and the lawful basis relied on | Must be able to prove consent was obtained: who, when, how |
| **Penalties** | Roughly $50,000+ per violating email (FTC-adjusted annually); no private right of action for individuals; enforced by FTC/state AGs/ISPs | Up to €20 million or 4% of global annual turnover, whichever is higher | Up to CAD $10 million per violation for organizations; a private right of action was passed into law but has been indefinitely suspended: enforcement is currently via the CRTC |
| **B2B nuance** | No B2B exemption: same rules apply to business and consumer email | Legitimate interest is commonly used for B2B marketing but must be documented and balanced against individual rights | Implied consent via an "existing business relationship" or the "conspicuous publication" of a business contact's email tied to their role can cover some B2B outreach |

## Pre-Send Compliance Checklist

- [ ] Sending domain and reply-to are real, monitored addresses
- [ ] Physical mailing address included in every commercial email (CAN-SPAM requirement)
- [ ] Working, low-friction unsubscribe link in every email
- [ ] Unsubscribes processed within 10 business days across all three regimes
- [ ] Suppression list checked before every send
- [ ] Subject lines are not deceptive about the email's content
- [ ] If targeting EU/UK contacts: documented lawful basis (consent or legitimate interest) on file per list/campaign
- [ ] If targeting Canadian contacts: consent basis identified per contact (express, existing business relationship, or conspicuous publication) and dated
- [ ] Consent/suppression records retained (who, when, how, and opt-out date if applicable)
- [ ] No purchased/scraped consumer email lists used for EU or Canadian sends
- [ ] Legal/compliance sign-off obtained before adding a new geography to outbound campaigns