How to Build a Compliant Cold Email Campaign for US and European Prospects

Most outbound teams handle compliance in one of two bad ways. Either they ignore it entirely and blast the same sequence at a list scraped from LinkedIn — US, Germany, UK, everyone — or they get spooked by GDPR horror stories and refuse to email Europe at all. Both are wrong. US and EU rules are genuinely different, but they are both workable if you segment your list by jurisdiction and build the campaign around the stricter requirement rather than the looser one.

This is not legal advice. I run outbound infrastructure, not a law firm. Email marketing law in Europe is layered (GDPR plus national ePrivacy implementations plus unfair-competition law in some countries) and it changes. Treat what follows as an operational map of what the rules ask for, then get a lawyer in the relevant jurisdiction to sign off before you scale.

{"h2":"The two regimes, stated plainly"}

The US and the EU regulate cold email from opposite starting points.

CAN-SPAM (US) is an opt-out law. You may send a commercial email to someone who never asked for it. What you may not do is lie about who you are, hide where you are, or keep emailing after they ask you to stop. There is no consent requirement and no registration process. It is one of the most permissive email regimes in the developed world.

GDPR plus ePrivacy (EU/UK) regulates the *data*, not just the message. A named business email address — jane.doe@acme.de — is personal data. Processing it needs a lawful basis, the person has rights over it, and you owe them information about where you got it. On top of that, each member state implemented the ePrivacy Directive's rules on unsolicited commercial email differently, and some of those implementations are much stricter than GDPR itself.

So a single campaign aimed at both markets has to satisfy CAN-SPAM's disclosure rules *and* a defensible EU lawful basis *and* whatever the prospect's country says about unsolicited B2B email.

{"h2":"What CAN-SPAM actually requires"}

The statute is short. The operational version:

{"ul":["Header and \"from\" information must be accurate — no forged domains, no fake sender names, no routing tricks.","The subject line must not misrepresent the content. \"Re: our call yesterday\" when there was no call is a violation, not a growth hack.","The message must be identifiable as a commercial solicitation. In practice, a clear pitch and a real signature covers this.","You must include a valid physical postal address. A registered agent address or a PO box registered to you is acceptable.","You must provide a working opt-out mechanism and keep it working for at least 30 days after sending.","Opt-outs must be honored within 10 business days, and you may not charge, require a login, or demand information beyond an email address to process one.","Harvesting addresses by scraping or dictionary attacks is an aggravating factor that increases penalties."]},

Penalties are assessed per email and the ceiling is inflation-adjusted annually — currently north of $50,000 per individual message. The usual enforcement trigger is not the first email; it's ignoring opt-outs. We've covered the US picture in depth in Is Cold Email Legal in the United States? CAN-SPAM Explained.

{"h2":"GDPR: consent is not the only lawful basis"}

The most common misconception is that GDPR requires opt-in consent for cold email. It doesn't. Article 6 lists six lawful bases, and legitimate interests — Article 6(1)(f) — is the one B2B outbound normally relies on. Direct marketing is explicitly named in Recital 47 as a potential legitimate interest.

Legitimate interest is not a free pass. It requires a documented three-part test, usually called a Legitimate Interests Assessment:

{"ul":["Purpose. What is the interest? \"Promoting a B2B service to professionals whose job function makes it relevant\" is a real interest. \"Hitting our pipeline number\" phrased honestly is still fine, but tie it to relevance.","Necessity. Could you achieve the same result in a less intrusive way? If your targeting is 'everyone at every company with 10+ employees', necessity is hard to argue. Tight, role-based targeting is both better outbound and better compliance.","Balancing. Would the recipient reasonably expect this contact? A VP of Sales getting a pitch about sales tooling at their work address: yes. A nurse getting a pitch about crypto at their hospital address: no."]},

Write the LIA down. One page per campaign type is enough. The point is that if a regulator or an annoyed prospect asks, you have a dated document showing you thought about it rather than a shrug.

{"h2":"The ePrivacy layer is where people actually get caught"}

GDPR gives you legitimate interest. National ePrivacy and unfair-competition laws can take it away. This varies enough that you should segment sends by country, not by \"Europe\".

{"table":{"headers":["Jurisdiction","Typical position on unsolicited B2B email","Practical implication"],"rows":[["United States","Opt-out (CAN-SPAM)","Send freely with accurate headers, postal address, working opt-out"],["United Kingdom","PECR marketing rules apply to individual subscribers; corporate subscribers largely exempt","Limited companies and LLPs are generally fair game; sole traders and partnerships are treated like individuals"],["France","B2B email to a professional address about the person's job is generally allowed on an opt-out basis","Inform at collection, offer opt-out, keep it role-relevant"],["Netherlands","Opt-out permitted for business recipients","Standard LIA + opt-out approach works"],["Germany","Prior consent generally required, including B2B, under unfair-competition law","Treat as high risk; many teams exclude or use non-email channels first"],["Italy, Spain, Austria","Consent-leaning regimes with narrow exceptions","Get local advice before volume sending"]]}},

Country-level nuance changes; verify before you rely on any row above. But the structural lesson is stable: your sequence builder needs a country field and the ability to exclude by it. If you can't suppress Germany from a campaign in two clicks, your compliance posture is theoretical.

{"h2":"The transparency obligation almost everyone skips"}

Article 14 covers personal data you did not collect from the person directly — which is exactly what a cold list is. It requires you to tell them who you are, what data you hold, where you got it, your lawful basis, how long you'll keep it, and their rights. The timing requirement: within one month, or at the time of first communication if that comes sooner. For cold email, that means the first email.

You do not need to turn your opening email into a privacy notice. The workable pattern is a short footer line plus a link:

{"ul":["One sentence naming the source: \"I found your details on your company website / a public B2B directory.\"","A link to a privacy notice page covering retention, lawful basis, and data subject rights.","A clear opt-out line that also works as an objection to processing."]},

Three extra lines. That's the whole thing, and it's the single cheapest compliance improvement available to most senders.

{"h2":"Opt-out and suppression: build it once, apply it globally"}

CAN-SPAM gives you 10 business days. GDPR's right to object (Article 21) has no comparable grace period for direct marketing — the obligation is to stop. Don't maintain two standards. Process every opt-out immediately, suppress across every campaign and every mailbox in the workspace, and keep the suppressed record forever (you need the record to honor the request — deleting it entirely means you'll email them again next quarter).

A few practical rules:

{"ul":"Suppression must be workspace-wide, not campaign-wide. Someone who unsubscribed from Campaign A should never appear in Campaign C.","Treat a reply saying \"not interested, remove me\" as an opt-out. It is, legally, regardless of whether they clicked anything.","Suppress at the domain level when a company asks you to stop contacting anyone there.","List-Unsubscribe with one-click (RFC 8058) is now effectively mandatory for bulk senders at Gmail and Yahoo anyway — see [Google and Yahoo Sender Requirements. Whether cold email needs a visible unsubscribe link is a separate question we've covered in Does Cold Email Require an Unsubscribe Link?."]},

{"h2":"A build order for a two-region campaign"}

{"ul":["1. Tag every lead with a country and a source. Source means the actual URL or dataset, not \"the internet\". You'll need it for the Article 14 line and for defending the LIA.","2. Split into jurisdiction segments. At minimum: US, UK/opt-out EU, consent-required EU. Exclude the third bucket from email unless counsel says otherwise.","3. Verify the list. Compliance and deliverability overlap here — sending to dead addresses harms both your reputation and your argument that targeting is careful.","4. Write one LIA per segment and date it.","5. Build the email with the compliance furniture in place: real sender name, real company, postal address, source line, privacy link, opt-out.","6. Set retention. Decide how long an unengaged lead stays in the system — 12 to 24 months is a common choice — and actually delete on schedule.","7. Check your processor paperwork. If a vendor touches EU personal data on your behalf, you need a data processing agreement and clarity on where data is stored.","8. Log everything: send timestamps, opt-outs, objections, deletion runs."]},

{"h2":"Where Sendvanta fits"}

Compliance is mostly process, but the tooling either helps or fights you. Sendvanta is built so the safe path is the default: one-click unsubscribe and workspace-wide suppression are on by default rather than optional add-ons, replies and opt-out requests land in one unified inbox so a \"remove me\" doesn't get lost across twenty mailboxes, and every send goes through your own Gmail, Microsoft 365, or SMTP mailboxes — nothing is proxied through shared IPs, so the sending identity in the headers is genuinely yours. We also don't sell lead lists, which means the question of where your data came from stays answerable: you brought it, and you know the source. Deliverability health scoring and SpamAssassin checks before send handle the adjacent problem of not looking like spam in the first place. You can see the full feature set at /features, and the free plan ($0, 1,000 active leads, 3,000 emails/month, up to 10 of your own SMTP mailboxes) is enough to build and test a properly structured two-region campaign before you pay anything.

{"faq":[{"q":"Can I legally cold email someone in the EU without their consent?","a":"In many EU countries, yes — under GDPR's legitimate interests basis, provided the contact is business-to-business, relevant to the person's job role, documented with a legitimate interests assessment, and accompanied by source disclosure and an easy opt-out. Some countries, notably Germany, apply stricter unfair-competition rules that effectively require prior consent even for B2B. Segment by country and take local advice."},{"q":"Is a work email address personal data under GDPR?","a":"If it identifies a person — jane.doe@acme.com — yes. Generic role addresses like info@ or sales@ are less likely to be personal data on their own, but they can still fall under national ePrivacy rules on unsolicited commercial email, and they rarely perform well anyway."},{"q":"Does CAN-SPAM require an unsubscribe link specifically?","a":"It requires a clear and conspicuous opt-out mechanism, not a link specifically. A reply-based instruction can satisfy the statute if you actually honor it. In practice, Gmail and Yahoo bulk-sender rules push most senders toward a List-Unsubscribe header with one-click support regardless."},{"q":"How long can I keep a cold lead's data if they never reply?","a":"GDPR has no fixed number; the requirement is that you don't keep it longer than necessary and that you state your retention period. Many B2B senders settle on 12 to 24 months of inactivity before deletion. Pick a period, publish it in your privacy notice, and enforce it on a schedule."},{"q":"What's the biggest practical compliance risk for a small outbound team?","a":"Failing to suppress opt-outs across every mailbox and campaign. It's the most common complaint trigger, it's the thing regulators actually act on, and it's entirely preventable with workspace-level suppression."}]},

Compliance done this way costs you three lines of email copy, a privacy page, a country field, and a one-page document per campaign type. That's it. The teams who treat it as an existential blocker usually haven't read the rules; the teams who get in trouble usually ignored an opt-out.