Compliance · Advanced · 9 min read
Outbound compliance without a legal team
What CAN-SPAM actually requires, where GDPR changes the answer, and the five mechanisms that make compliance a property of the system rather than a policy nobody reads.
This is not legal advice and nothing on this page is. It is an engineer's description of the mechanisms that make a compliance posture real rather than declared, which is a different thing from a compliance opinion.
The short version: US cold email is lawful with specific obligations. EU cold email needs a lawful basis and a notice, and the answer varies by member state. Most tools handle the first and gesture at the second.
What CAN-SPAM actually requires
Accurate header information and a subject line that is not deceptive. A clear opt-out mechanism, honoured within ten business days. A valid physical postal address in every message. That is the core of it, and it is an opt-out regime rather than an opt-in one.
The address requirement is the one most often skipped, and it is the easiest to comply with and the easiest to prove you did not.
Where GDPR changes the answer
You need a lawful basis, usually legitimate interest for B2B, and legitimate interest is a balancing test you must be able to show your working on. You also owe an Article 14 notice to anybody whose data you obtained from a third party rather than from them.
Member states differ on electronic marketing to individuals, and a sole trader can be an individual. If you are selling into the EU, this is the part to take advice on rather than to reason about from a blog post.
The five mechanisms that make it real
A policy document is not a control. These are:
- Per-field provenance: where each fact came from, how, and when.
- Retention computed from the collection date, never from last-updated.
- A pre-send check on jurisdiction, entity type and lawful basis, per row.
- Suppression at two scopes, exempt from every purge.
- Unsubscribe and postal address injected by the sending layer, not by the caller.
Why the retention column matters more than it sounds
Anchoring a retention window to last-updated means an actively used record never expires. It is the exact finding that resulted in a €240,000 fine for one lead-generation company, and it cannot be fixed retroactively because the collection dates were never stored.
Opt-out in prose
The hard case is not the unsubscribe link. It is somebody replying take me off this list. That carries the same weight and arrives as free text, so the detection has to run before anything else and should not depend on a language model. A missed nuance is a wrong label, and a missed opt-out is a regulatory event.
The takeaway
Compliance is five data-model decisions made before you send anything. Made after, four of them are a migration.
Read next
All guidesEverything in these guides is a default in the product rather than an exercise left to the reader.
Everything above, running on your list
Describe the company, confirm the keywords, connect a channel. The agents take it from there, and Supervised mode is available when you want to review before sending.
Start with sales. $2,000 or $5,000 onboarding, then at least $250 monthly credit funding.