Cold Email Compliance: CAN-SPAM, CASL and GDPR Explained

Note: This article provides general information about CAN-SPAM, CASL and GDPR. It is not legal advice. Laws vary by jurisdiction and circumstance, and you should consult a qualified lawyer about your specific situation.

Cold email is legal in the United States, Canada and the European Union. What differs is the standard you have to meet before you send. CAN-SPAM lets you email a stranger until they opt out. CASL generally requires consent first. GDPR requires a lawful basis for processing the recipient's personal data. Most compliance failures come from applying one regime's rules in another regime's jurisdiction.

Key takeaways

• Consent requirements depend on jurisdiction: generally required under CASL, not required under CAN-SPAM, and dependent on lawful basis under GDPR.
• Under CASL, the sender carries the burden of proving consent was obtained.
• CASL's conspicuous publication exception is what makes B2B prospecting workable in Canada.
• Every regime requires accurate sender identification and a working, prompt unsubscribe path.

What does CAN-SPAM require?

CAN-SPAM, enforced by the US Federal Trade Commission, sets baseline rules for any commercial email sent to a recipient with no prior relationship, which is the definition of a cold email. It is an opt-out regime: you do not need permission before the first message, but you must honour a withdrawal of consent.

The law was built around a simple idea: recipients need to know who is contacting them and why. In practice that means accurate header and sender information, a subject line that reflects the content, a valid physical postal address, and a working opt-out mechanism. A message that hides its origin or fakes a reply-to address fails the standard immediately.

CAN-SPAM compliance is not a one-time checkbox. It applies to every message in a sequence, including automated follow-ups.

What counts as a cold email under the law?

A cold email is any commercial message sent to someone you have not previously contacted or worked with. Recipients have no existing relationship to fall back on for context or consent.

Sender identity matters here. Personalization fields that pull in a prospect's real name and job title do more than lift reply rates. They support the accurate, non-deceptive identification the statute expects. Connecting a real Gmail account means every message carries a traceable, accountable sender identity rather than a masked or disposable address, and gives you a record if a recipient ever questions who reached out and why.

What is CASL and how does it apply?

Canada's Anti-Spam Legislation is the strictest of the three regimes and governs commercial electronic messages sent to recipients in Canada. Unlike CAN-SPAM's opt-out model, CASL is fundamentally consent-based: you generally need consent before sending. It is enforced by the Canadian Radio-television and Telecommunications Commission.

Express and implied consent

Express consent means the recipient has actively agreed to receive messages. It does not expire, but the recipient can withdraw it at any time, and the sender bears the burden of proving it was obtained.

Implied consent arises in defined situations, including an existing business relationship such as a recent purchase or contract, and the conspicuous publication exception.

The conspicuous publication exception

This is the provision that makes B2B prospecting workable in Canada. Implied consent exists where all three of the following hold:

• The business contact address has been conspicuously published, for example on a company website or business directory.
• The publication is not accompanied by a statement that the person does not wish to receive unsolicited commercial messages.
• The message is relevant to that person's business role, functions or duties.

That third condition does real work. A message pitching accounting software to a finance director is relevant to their role. An unrelated product pitch to the same address is not, and the exception would not cover it.

Identification and unsubscribe requirements

Every commercial electronic message must clearly identify the sender and anyone on whose behalf it is sent, and include a mailing address that stays valid for at least 60 days after the message is sent. The unsubscribe mechanism must be readily performed, must stay valid for at least 60 days, and requests must be processed without delay and no later than 10 business days.

Penalties

The CRTC can impose administrative monetary penalties of up to CAD $1 million per violation for an individual and up to CAD $10 million per violation for a business.

How does GDPR apply to B2B email?

GDPR protects individuals rather than businesses, and corporate inboxes attract somewhat lighter treatment than personal ones. A cold email sent to a work address is generally permissible where the message relates directly to that person's job function and you have a lawful basis for processing their personal data, most commonly legitimate interest.

Legitimate interest is not a blanket permission. It requires that your interest in sending is balanced against the recipient's rights, that the contact is relevant to their role, and that you can demonstrate the assessment if challenged.

Consent requirements also vary among EU member states, which apply the ePrivacy rules differently. Verify local interpretation and enforcement practice before launching a campaign into a new market rather than assuming one rule covers the bloc.

Does Novpha handle compliance for you?

No. Novpha operates on a shared-responsibility model, not as an automated shield. By using the platform, you confirm you are the actual sender of every email and that you are responsible for following anti-spam and privacy laws yourself.

• You own the compliance decisions.
• Novpha supplies the search, send and follow-up engine.
• Verified contacts still require your judgment on consent and relevance.

Think of it as a division of labour: the platform finds and sends; you stay accountable for what you send and how.

Compliance habits that protect your outreach

Good habits start with data discipline, not clever copywriting. Holding any customer data, even a single email address, creates an obligation to keep it secure. Verified addresses filed into organized folders instead of a sprawling spreadsheet reduce the chance you are emailing a stale, incorrect or previously bounced contact. Clean data is the first line of defence long before a message gets written.

Does personalization reduce legal risk?

Indirectly, yes. Generic blasts read as spam and draw complaints faster than targeted messages, and complaints are what attract regulatory attention. A message that clearly explains why this person, at this company, is worth contacting is also much easier to defend against a relevance challenge under CASL or GDPR.

How should you organize prospects for ongoing compliance?

Segmentation matters as much as the first send. Filing prospects into named lists lets you work one permission-appropriate group now while holding the rest for later. You can separate warm leads from cold, honour unsubscribe requests by segment, and demonstrate which group received which message.

The habits are simple:

• Secure every address you collect, even a short list.
• Write to a real decision-maker, with their role in mind.
• Sort prospects into named groups you can track and update.
• Keep verified, current data instead of recycled lists.
• Record how and when consent arose, particularly for Canadian recipients.

How Novpha keeps sends traceable

Every message goes out from the Gmail account you connected, not from a shared or anonymous server. That single-inbox structure keeps every send and reply auditable in one place, which matters when a recipient or a regulator asks where a message came from.

Automation adds structure without adding risk. Auto-reply answers incoming messages in the tone you originally wrote. Follow-up nudges go out after seven days by default, or on whatever schedule you set, and stop the instant someone responds. Nobody gets pestered after they have already answered, which matters under rules that treat unwanted repeat contact as an aggravating factor.

FAQ