Deliverability and compliance: CAN-SPAM, GDPR, PECR and beyond

0:00 Deliverability and compliance

Every cold email has to get through two gates. The technical gate, where mailbox providers decide inbox, spam folder or nowhere. And the legal gate, where the law decides whether you can send it at all. AI makes it easy to send more, faster, which makes both gates more important. This lesson is practical guidance, not legal advice, so always check your own situation.

0:28 Mailbox rules

Mailbox providers tightened the rules. Google and Yahoo introduced bulk-sender requirements in 2024, and Microsoft followed for Outlook in 2025. Bulk senders need SPF and DKIM set up, a DMARC policy aligned with the From domain, one-click unsubscribe for marketing messages, and low spam complaint rates. Google advises staying below point one percent and never reaching point three percent. Follow these practices even below bulk thresholds, because that's how reputation is judged.

0:59 Why it matters

Why does this matter? Because one bad week of sending can damage your domain's reputation for months, and some mistakes can bring regulatory fines. With AI making it easy to send more, the pressure to scale volume is higher than ever. The teams that thrive treat deliverability and compliance as part of the craft, not an afterthought. It's also a trust signal: buyers notice when you make it easy to opt out and honest about where you found them.

1:33 The delivery van

Here's an analogy. Sending email is like driving a delivery van. Authentication, SPF, DKIM and DMARC, is your registration and number plates: without them, nobody trusts the van. Complaint rates are your driving record: too many incidents and you lose access to the roads. And laws like CAN-SPAM, PECR and GDPR are the rules of the road, which differ a little from country to country. Good drivers know all three.

2:03 Simple example: 50 UK prospects

A simple example. A small consultancy wants to email fifty UK prospects. Forty-five are limited companies with corporate addresses; five are sole traders. Under PECR, the consultancy can email the forty-five corporate contacts with clear identification and an easy opt-out, and it still needs a lawful basis for the personal data under UK GDPR. The five sole traders are individual subscribers, so it should not cold email them without consent. Instead, it can connect on LinkedIn or invite them to a webinar.

2:39 Sales team habits

For sales teams, a few operational habits matter most. Send cold outreach from a dedicated, authenticated subdomain or secondary domain, to protect your main domain. Warm up new mailboxes gradually, and keep daily volume per mailbox modest. Verify addresses before sending, because bounces hurt reputation. Monitor Google Postmaster Tools, bounces, complaints and blocklists. And skip link shorteners, heavy images and attachments in cold emails.

3:07 United States: CAN-SPAM

Now the legal gate, starting in the United States. The CAN-SPAM Act covers commercial email, and it makes no exception for business-to-business. You need accurate headers, honest subject lines, identification as an ad where applicable, a valid physical postal address, a clear opt-out that you honour within ten business days, and you're responsible for vendors sending on your behalf. Penalties are assessed per email and adjusted annually.

3:36 United Kingdom: PECR + UK GDPR

In the UK, two regimes work together. PECR distinguishes corporate subscribers, like companies and LLPs, from individual subscribers, including sole traders and some partnerships. You can email corporate subscribers without prior consent, as long as you identify yourself and offer an opt-out. Individual subscribers generally need consent or the soft opt-in. UK GDPR still applies to the personal data: lawful basis, transparency, minimisation and rights. And the Data Use and Access Act 2025 raised PECR fines to UK GDPR levels.

4:11 EU, Gulf and Pakistan

In the European Union, GDPR applies to the data everywhere, but rules on unsolicited B2B email vary by member state. Some permit it under conditions; others, such as Germany, are much stricter and often require prior consent. In the Gulf, Saudi Arabia's Personal Data Protection Law, enforced since September 2024, and the UAE's federal data protection law regulate marketing use of personal data, including transparency and cross-border transfers. Pakistan's framework is evolving. When in doubt: consent, transparency and easy opt-out.

4:46 Compliant outbound checklist

Here's a compliant outbound checklist. Document your lawful basis, such as a legitimate interests assessment. Record where each contact came from, and include a privacy notice link in the first email. Make your identity clear and subject lines honest. Offer easy opt-out, honour it fast, and keep one global suppression list across every tool. Treat sole traders under consent rules. Check country rules for EU targets. Bind vendors, including AI SDR tools, by contract. And keep authentication aligned and complaints monitored.

5:21 Worked example: expansion done right

A SaaS company in Dubai expanded into the UK and Germany. It set up an authenticated subdomain, warmed mailboxes over several weeks, added a transparency line and privacy link to first emails, and recorded data sources. In the UK it targeted corporate addresses and excluded sole traders. For Germany, legal advice led it to earn consent through events, content and LinkedIn engagement instead of cold email. Complaints stayed low, and no regulatory issues arose.

5:53 Pitfalls and metrics

Three pitfalls cause most problems. Sending cold outreach from your main corporate domain. Assuming B2B is exempt everywhere. And keeping separate unsubscribe lists in each tool, so people who opted out keep getting messages. Measure inbox placement, bounce and complaint rates, unsubscribe handling time, DMARC alignment, and aim for zero regulatory complaints.

6:16 Try this now

Try this now. Check your sending setup. Look up your sales domain's SPF, DKIM and DMARC records with a DNS checker, and confirm DMARC alignment. Confirm you send cold outreach from a separate, warmed domain or subdomain. Test that unsubscribe works in one click and that opt-outs sync across every tool into one suppression list. Then go through the compliance checklist from the lesson text for each country you target, and fix the three biggest gaps.

6:49 Recap

To recap. Pass the technical gate with authentication, one-click unsubscribe, low complaints, warm-up and a dedicated domain. Pass the legal gate by knowing CAN-SPAM, PECR, GDPR and local laws in your target markets. Keep one suppression list and bind your vendors. Your next step: audit your setup against both checklists in the lesson text and fix the top three gaps. Next: AI SDR agents, what works and the risks.