Can I send cold emails under GDPR?

Short answer: yes, in most B2B contexts. Longer answer: B2B cold outreach is typically justified under "legitimate interest" — Recital 47 of the GDPR explicitly mentions direct marketing as a potential legitimate interest. But there are conditions. The product or service must be relevant to the recipient's professional role (selling CRM software to a VP of Sales is fine; selling gym memberships to their personal email is not). You must document your Legitimate Interest Assessment before sending. Every email needs a clear opt-out. And you can only process data that's actually necessary for the outreach — no hoarding extra personal data "just in case." One more thing: some EU member states (like Germany) have stricter interpretations under the UWG law. When in doubt about a specific country, check with a local privacy specialist.

What is the difference between GDPR and CAN-SPAM?

They regulate different things in different ways. GDPR is an EU data privacy regulation — it governs how you collect, store, process, and delete personal data. It requires a legal basis (consent, legitimate interest, etc.) before you can even have someone's email in your database. It gives individuals rights to access, correct, and delete their data. CAN-SPAM is a US law focused narrowly on commercial email. It doesn't restrict who you can email — it regulates how. Truthful headers, honest subject lines, physical address in the footer, working unsubscribe link, opt-out processing within 10 days. The practical difference: GDPR asks "should you have this person's data at all?" CAN-SPAM asks "are you following the rules when you email them?" If you email anyone in the EU, you need to comply with both.

What are the penalties for email compliance violations?

The numbers are scary, and they should be. GDPR fines max out at 20 million euros or 4% of global annual revenue — whichever is higher. Amazon got hit with a 746 million euro fine in 2021. CAN-SPAM violations carry penalties up to $51,744 per individual email. Do that math on a 10,000-email campaign and it gets existential fast. But here's what actually hurts most companies more than fines: deliverability damage. Get flagged for non-compliance and ESPs like Google and Microsoft start throttling or blocking your sends entirely. Rebuilding a damaged sender reputation takes 4-8 weeks of reduced volume. For an outbound-driven sales team, that's essentially shutting down your pipeline for two months.

Email Compliance & GDPR Checklist

A working gdpr email compliance checklist for B2B sales teams — covering consent, CAN-SPAM requirements, data subject rights, and the specific steps we follow at Cleanlist to keep our own outreach compliant across the EU, US, and Canada.

12Items
2-3 hoursEstimated time
ComplianceCategory

Work the list

Progress is saved in this browser, so you can close the tab and come back to the same ticks.

0 of 12 completed0%

Consent & Legal Basis

Identify your legal basis for processingGDPR gives you six legal bases, but for B2B email outreach you're realistically choosing between three: consent, legitimate interest, or contractual necessity. Most B2B cold outreach falls under legitimate interest — but you can't just claim it. You need a documented Legitimate Interest Assessment (LIA) for each segment of your database. We've seen companies fined not because their basis was wrong, but because they couldn't produce the documentation.medium
Review consent collection mechanismsCheck every opt-in form on your site and landing pages. Each one should clearly state what the contact is signing up for — the specific emails they'll receive, how often, and from whom. Pre-checked boxes are not valid consent under GDPR. Neither are vague statements like "we may contact you." If your forms say anything less specific than "You'll receive our weekly sales tips email," they probably need rewriting.easy
Maintain a consent recordFor every contact, record three things: when consent was given (timestamp), how it was given (which form, which page, what was displayed), and what exactly was consented to. Store this in your CRM or a dedicated consent management platform. When a regulator asks — and they do ask — "show me proof this person opted in" needs to be a 30-second lookup, not a 3-day scramble.medium
Audit third-party data sourcesThis is the one that catches most B2B teams off guard. If you buy contact lists, use data enrichment providers, or import leads from any third-party source, you are responsible for verifying that data was collected with a proper legal basis. Ask your providers for their data processing documentation. If they can't produce it, or if they get cagey about sourcing methods, that's your signal to find a different provider.hard

Email Content Requirements

Include physical address in all emailsCAN-SPAM requires a valid physical postal address in every commercial email you send. A PO box or registered agent address works — it doesn't have to be your office. GDPR similarly requires clear sender identification. Check your email templates right now. If your footer doesn't have an address, every email you've sent is technically non-compliant.easy
Add clear unsubscribe mechanismEvery commercial email needs a visible, one-click unsubscribe option. CAN-SPAM gives you 10 business days to process opt-outs, but in practice, aim for instant. Google and Yahoo's 2024 sender requirements made one-click unsubscribe headers mandatory for bulk senders — if you're sending 5,000+ emails per day, you need the List-Unsubscribe header, not just a footer link.easy
Use accurate sender informationYour 'From' name, email address, and subject line must accurately represent who is sending and what the email contains. This sounds obvious, but it gets murky fast. Sending from 'John at Google' when John works for your agency and you're emailing on Google's behalf? That's a CAN-SPAM violation. Subject lines like 'Re: Our conversation' when you've never spoken? Also a violation. Keep it honest.easy
Clearly identify commercial messagesCommercial emails should be recognizable as promotional content. You don't need a giant "ADVERTISEMENT" banner — but the commercial intent should be obvious from context. Where this gets tricky: cold outreach emails that look like personal messages. They're still commercial emails under CAN-SPAM and need to follow the same rules (physical address, unsubscribe option, honest sender info).easy

Data Handling & Rights

Enable data subject access requestsWhen someone asks "what data do you have on me?" — and under GDPR, they have every right to — you need to produce an answer within 30 days. Build a repeatable process now, before the first request arrives. That means knowing exactly where personal data lives across your CRM, email platform, enrichment tools, analytics, and any spreadsheets floating around. Most teams discover they have data in 6-8 more places than they thought.medium
Implement right to deletion processDeletion requests are the hard one. When someone says "delete my data," you need to remove it from everywhere: CRM, email platform, marketing automation, backups, exported CSVs, third-party enrichment tools, and that one spreadsheet your SDR keeps on their desktop. Map every system that touches personal data and build a deletion checklist. Then test it. Actually run a deletion request through your full stack and see if any data survives.hard
Review data retention policiesDefine clear retention periods: how long do you keep contact data after last engagement? After a deal closes? After a lead goes cold? GDPR's data minimization principle means you can't store data indefinitely "just in case." A common B2B approach: active prospects for 24 months after last interaction, closed-lost for 12 months, unresponsive cold outreach contacts for 6 months. Document it, automate the cleanup, and stick to it.medium
Ensure data processor agreements are in placeEvery third-party tool that touches personal data on your behalf needs a signed Data Processing Agreement (DPA). That includes your CRM, email platform, enrichment providers, analytics tools, and cloud storage. Most SaaS vendors have a DPA template on their legal page — but you need to actually sign it, not just assume it's covered by the Terms of Service. Audit your vendor list and check off each DPA. We've seen companies using 15+ tools with zero DPAs signed.medium

Pro Tips

01When in doubt, talk to a privacy lawyer who specializes in data protection — not your general counsel, not your accountant. The nuances of legitimate interest vs. consent in B2B cold outreach are genuinely complex, and getting it wrong can cost millions.
02GDPR applies to EU residents regardless of where your company is based. Headquartered in Texas? Doesn't matter. If you email someone in Berlin, GDPR applies to that email. Period.
03Legitimate interest is valid for B2B cold outreach in most EU jurisdictions — but only if you've documented your Legitimate Interest Assessment (LIA) before sending. Doing the assessment after a complaint is like buying insurance after the accident.
04Keep your compliance docs in one searchable place — a shared drive folder, a Notion database, whatever works for your team. When a regulator sends an inquiry (usually with a 14-day response window), you don't want to be digging through Slack threads.
05Cleanlist's data sourcing and processing practices comply with GDPR, CCPA, and CASL. We maintain DPAs with all upstream data providers and can produce compliance documentation on request.

Frequently Asked Questions

Can I send cold emails under GDPR?
Short answer: yes, in most B2B contexts. Longer answer: B2B cold outreach is typically justified under "legitimate interest" — Recital 47 of the GDPR explicitly mentions direct marketing as a potential legitimate interest. But there are conditions. The product or service must be relevant to the recipient's professional role (selling CRM software to a VP of Sales is fine; selling gym memberships to their personal email is not). You must document your Legitimate Interest Assessment before sending. Every email needs a clear opt-out. And you can only process data that's actually necessary for the outreach — no hoarding extra personal data "just in case." One more thing: some EU member states (like Germany) have stricter interpretations under the UWG law. When in doubt about a specific country, check with a local privacy specialist.
What is the difference between GDPR and CAN-SPAM?
They regulate different things in different ways. GDPR is an EU data privacy regulation — it governs how you collect, store, process, and delete personal data. It requires a legal basis (consent, legitimate interest, etc.) before you can even have someone's email in your database. It gives individuals rights to access, correct, and delete their data. CAN-SPAM is a US law focused narrowly on commercial email. It doesn't restrict who you can email — it regulates how. Truthful headers, honest subject lines, physical address in the footer, working unsubscribe link, opt-out processing within 10 days. The practical difference: GDPR asks "should you have this person's data at all?" CAN-SPAM asks "are you following the rules when you email them?" If you email anyone in the EU, you need to comply with both.
What are the penalties for email compliance violations?
The numbers are scary, and they should be. GDPR fines max out at 20 million euros or 4% of global annual revenue — whichever is higher. Amazon got hit with a 746 million euro fine in 2021. CAN-SPAM violations carry penalties up to $51,744 per individual email. Do that math on a 10,000-email campaign and it gets existential fast. But here's what actually hurts most companies more than fines: deliverability damage. Get flagged for non-compliance and ESPs like Google and Microsoft start throttling or blocking your sends entirely. Rebuilding a damaged sender reputation takes 4-8 weeks of reduced volume. For an outbound-driven sales team, that's essentially shutting down your pipeline for two months.

Related Cleanlist Features

Email Verification Data Enrichment

Do the data half in one pass.

Cleanlist puts one lookup through 25+ providers and stops at the first source that returns. Search is free and unlimited on every plan, and a lookup that finds nothing costs nothing.

Start free trial All checklists

14-day Scale trial: 250 credits, 3 seats, no card. Two-way sync with HubSpot, Salesforce and Pipedrive, one way out to Outreach, Salesloft and Lemlist. Cleanlist does not send the email.