--- title: "Deliverability and compliance: CAN-SPAM, GDPR, PECR and…" description: "Two gates between you and the buyer Every cold email must pass two gates. The technical gate : mailbox providers decide whether your email reaches the…" url: https://optimizeall.com/learn/ai-for-sales-teams/deliverability-and-outreach-compliance updated: 2026-10-05 --- AI for Sales Teams: Prospecting, Conversations and Pipeline · Outreach at scale, done right · lesson 6 of 16 · 8 min # Deliverability and compliance: CAN-SPAM, GDPR, PECR and beyond ## Two gates between you and the buyer Every cold email must pass two gates. The **technical gate**: mailbox providers decide whether your email reaches the inbox, the spam folder or nowhere. The **legal gate**: laws decide whether you may send it at all, and how. AI increases volume and speed, which makes both gates more important, not less. This lesson is practical guidance, not legal advice; check the rules for your jurisdictions and take advice for your situation. ## Deliverability essentials Since 2024, major mailbox providers have tightened requirements for senders. Google and Yahoo introduced bulk-sender requirements in 2024, and Microsoft followed for Outlook consumer domains in 2025. For bulk senders (Google defines this around 5,000 messages a day to its users) they include: - **Authentication**: SPF and DKIM set up, with a DMARC policy published and aligned with your From domain. - **Easy unsubscribe**: one-click unsubscribe (via List-Unsubscribe headers) for marketing messages, processed promptly. - **Low spam complaint rates**: Google advises keeping user-reported spam rates low (below 0.1%) and never reaching 0.3%. - **Valid forward and reverse DNS**, TLS for transmission, and correctly formatted messages. Even below bulk thresholds, follow these practices; they are how mailbox providers judge reputation. **Operational practices for sales teams:** - Send cold outreach from a **dedicated subdomain or secondary domain**, properly authenticated, to protect your main domain's reputation. - **Warm up** new domains and mailboxes gradually; keep daily volumes per mailbox modest. - **Verify addresses** before sending; high bounce rates damage reputation. - Monitor **Google Postmaster Tools** and your providers' feedback; watch bounces, complaints and blocklists. - Avoid link shorteners, heavy images, attachments and spammy wording in cold emails. ```text DNS checklist (illustrative records; your email provider gives the exact values) SPF : example-sales.com TXT "v=spf1 include: -all" DKIM : selector._domainkey.example-sales.com TXT "" DMARC : _dmarc.example-sales.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com" (start with p=none to monitor, then move to quarantine/reject once aligned) ``` ## Legal essentials by region (summary) **United States: CAN-SPAM Act.** Applies to commercial email, including B2B, with no exception for business-to-business. Requirements include: accurate header information, non-deceptive subject lines, identifying the message as an ad where applicable, a valid physical postal address, a clear way to opt out, honouring opt-outs within 10 business days, and responsibility for vendors sending on your behalf. Penalties are significant and assessed per email (the FTC adjusts the maximum annually). US law is opt-out based; some states add rules. **United Kingdom: PECR plus UK GDPR.** PECR distinguishes **corporate subscribers** (companies, LLPs, government bodies) from **individual subscribers** (individuals, sole traders, some partnerships). You may send B2B marketing emails to corporate subscribers without prior consent, but you must identify yourself and provide a valid way to opt out; for individual subscribers (including sole traders), you generally need consent or the "soft opt-in" for existing customers. UK GDPR still applies to the personal data involved: lawful basis (often legitimate interests, with an assessment), transparency (tell people where you got their data), minimisation and rights. The Data (Use and Access) Act 2025 raised maximum PECR fines to the UK GDPR level (up to £17.5 million or 4% of global turnover). **European Union: GDPR plus national ePrivacy rules.** GDPR applies as above. Rules for unsolicited B2B email differ by member state: some permit B2B email under conditions, while others (for example Germany) are much stricter and often require prior consent. Check each target country. **Gulf and Pakistan.** Saudi Arabia's Personal Data Protection Law (enforced since September 2024) and the UAE's federal data protection law regulate processing of personal data, including for marketing, with requirements on lawful basis or consent, transparency and cross-border transfers; telecom and marketing regulators may impose additional rules on unsolicited messages. Pakistan's data protection framework has been evolving; check current status and sector rules. When in doubt, favour consent, transparency and easy opt-out. ## A compliant outbound checklist ```text [ ] Lawful basis documented (e.g., legitimate interests assessment for B2B outreach) [ ] Data source recorded for each contact; privacy notice link in first email [ ] Sender identity clear; physical address (US); honest subject lines [ ] One-click unsubscribe / clear opt-out; honoured fast; global suppression list across tools [ ] Sole traders / individual subscribers treated under consent rules (UK/EU) [ ] Country rules checked for EU targets (e.g., stricter B2B rules in some states) [ ] Vendors (including AI SDR tools) contractually bound and monitored [ ] SPF, DKIM, DMARC aligned; complaint and bounce rates monitored ``` ## Worked example: a Dubai SaaS company expanding to the UK and EU A Dubai SaaS firm launched outbound into the UK and Germany. It set up an authenticated subdomain, warmed mailboxes over several weeks, added a short transparency line and privacy link to first emails, and recorded data sources. For the UK, it targeted corporate addresses and excluded sole traders; for Germany, legal advice led it to rely on events, content and LinkedIn engagement to earn consent rather than cold email. Complaint rates stayed low and no regulator complaints arose. ## Pitfalls - Sending cold outreach from the main corporate domain. - Assuming "B2B is exempt" everywhere. - Separate unsubscribe lists in each tool, so opted-out people keep receiving messages. ## How to measure success Inbox placement tests, bounce and complaint rates, unsubscribe handling time, DMARC alignment rate, and zero regulatory complaints. ## Video lecture: Deliverability and compliance: CAN-SPAM, GDPR, PECR and beyond Lecture coming soon · 14 chapters · about 7 minutes. Read the full transcript below. 1. Deliverability and compliance 2. Mailbox rules 3. Why it matters 4. The delivery van 5. Simple example: 50 UK prospects 6. Sales team habits 7. United States: CAN-SPAM 8. United Kingdom: PECR + UK GDPR 9. EU, Gulf and Pakistan 10. Compliant outbound checklist 11. Worked example: expansion done right 12. Pitfalls and metrics 13. Try this now 14. Recap ## Lecture transcript ### Deliverability and compliance Every cold email has to get through two gates. The technical gate, where mailbox providers decide inbox, spam folder or nowhere. And the legal gate, where the law decides whether you can send it at all. AI makes it easy to send more, faster, which makes both gates more important. This lesson is practical guidance, not legal advice, so always check your own situation. ### Mailbox rules Mailbox providers tightened the rules. Google and Yahoo introduced bulk-sender requirements in 2024, and Microsoft followed for Outlook in 2025. Bulk senders need SPF and DKIM set up, a DMARC policy aligned with the From domain, one-click unsubscribe for marketing messages, and low spam complaint rates. Google advises staying below point one percent and never reaching point three percent. Follow these practices even below bulk thresholds, because that's how reputation is judged. ### Why it matters Why does this matter? Because one bad week of sending can damage your domain's reputation for months, and some mistakes can bring regulatory fines. With AI making it easy to send more, the pressure to scale volume is higher than ever. The teams that thrive treat deliverability and compliance as part of the craft, not an afterthought. It's also a trust signal: buyers notice when you make it easy to opt out and honest about where you found them. ### The delivery van Here's an analogy. Sending email is like driving a delivery van. Authentication, SPF, DKIM and DMARC, is your registration and number plates: without them, nobody trusts the van. Complaint rates are your driving record: too many incidents and you lose access to the roads. And laws like CAN-SPAM, PECR and GDPR are the rules of the road, which differ a little from country to country. Good drivers know all three. ### Simple example: 50 UK prospects A simple example. A small consultancy wants to email fifty UK prospects. Forty-five are limited companies with corporate addresses; five are sole traders. Under PECR, the consultancy can email the forty-five corporate contacts with clear identification and an easy opt-out, and it still needs a lawful basis for the personal data under UK GDPR. The five sole traders are individual subscribers, so it should not cold email them without consent. Instead, it can connect on LinkedIn or invite them to a webinar. ### Sales team habits For sales teams, a few operational habits matter most. Send cold outreach from a dedicated, authenticated subdomain or secondary domain, to protect your main domain. Warm up new mailboxes gradually, and keep daily volume per mailbox modest. Verify addresses before sending, because bounces hurt reputation. Monitor Google Postmaster Tools, bounces, complaints and blocklists. And skip link shorteners, heavy images and attachments in cold emails. ### United States: CAN-SPAM Now the legal gate, starting in the United States. The CAN-SPAM Act covers commercial email, and it makes no exception for business-to-business. You need accurate headers, honest subject lines, identification as an ad where applicable, a valid physical postal address, a clear opt-out that you honour within ten business days, and you're responsible for vendors sending on your behalf. Penalties are assessed per email and adjusted annually. ### United Kingdom: PECR + UK GDPR In the UK, two regimes work together. PECR distinguishes corporate subscribers, like companies and LLPs, from individual subscribers, including sole traders and some partnerships. You can email corporate subscribers without prior consent, as long as you identify yourself and offer an opt-out. Individual subscribers generally need consent or the soft opt-in. UK GDPR still applies to the personal data: lawful basis, transparency, minimisation and rights. And the Data Use and Access Act 2025 raised PECR fines to UK GDPR levels. ### EU, Gulf and Pakistan In the European Union, GDPR applies to the data everywhere, but rules on unsolicited B2B email vary by member state. Some permit it under conditions; others, such as Germany, are much stricter and often require prior consent. In the Gulf, Saudi Arabia's Personal Data Protection Law, enforced since September 2024, and the UAE's federal data protection law regulate marketing use of personal data, including transparency and cross-border transfers. Pakistan's framework is evolving. When in doubt: consent, transparency and easy opt-out. ### Compliant outbound checklist Here's a compliant outbound checklist. Document your lawful basis, such as a legitimate interests assessment. Record where each contact came from, and include a privacy notice link in the first email. Make your identity clear and subject lines honest. Offer easy opt-out, honour it fast, and keep one global suppression list across every tool. Treat sole traders under consent rules. Check country rules for EU targets. Bind vendors, including AI SDR tools, by contract. And keep authentication aligned and complaints monitored. ### Worked example: expansion done right A SaaS company in Dubai expanded into the UK and Germany. It set up an authenticated subdomain, warmed mailboxes over several weeks, added a transparency line and privacy link to first emails, and recorded data sources. In the UK it targeted corporate addresses and excluded sole traders. For Germany, legal advice led it to earn consent through events, content and LinkedIn engagement instead of cold email. Complaints stayed low, and no regulatory issues arose. ### Pitfalls and metrics Three pitfalls cause most problems. Sending cold outreach from your main corporate domain. Assuming B2B is exempt everywhere. And keeping separate unsubscribe lists in each tool, so people who opted out keep getting messages. Measure inbox placement, bounce and complaint rates, unsubscribe handling time, DMARC alignment, and aim for zero regulatory complaints. ### Try this now Try this now. Check your sending setup. Look up your sales domain's SPF, DKIM and DMARC records with a DNS checker, and confirm DMARC alignment. Confirm you send cold outreach from a separate, warmed domain or subdomain. Test that unsubscribe works in one click and that opt-outs sync across every tool into one suppression list. Then go through the compliance checklist from the lesson text for each country you target, and fix the three biggest gaps. ### Recap To recap. Pass the technical gate with authentication, one-click unsubscribe, low complaints, warm-up and a dedicated domain. Pass the legal gate by knowing CAN-SPAM, PECR, GDPR and local laws in your target markets. Keep one suppression list and bind your vendors. Your next step: audit your setup against both checklists in the lesson text and fix the top three gaps. Next: AI SDR agents, what works and the risks. ## Key takeaways - Cold email must pass a technical gate (authentication, reputation, complaints) and a legal gate (consent, transparency, opt-out). - Authenticate with SPF, DKIM and DMARC, use one-click unsubscribe, keep complaint rates low, warm up and use a dedicated sending domain. - CAN-SPAM covers B2B email; UK PECR allows B2B email to corporate subscribers with identification and opt-out; GDPR applies to the data. - Rules differ across EU states, KSA, UAE and Pakistan; keep a global suppression list and bind vendors, including AI SDR tools. ## Try it Audit your outbound setup against the DNS and compliance checklists, fix the top three gaps, and set up a single suppression list shared across all sending tools. - [Previous: Personalised outreach at scale, without spam](https://optimizeall.com/learn/ai-for-sales-teams/personalised-outreach-at-scale) - [Next: AI SDR agents: what works and the risks](https://optimizeall.com/learn/ai-for-sales-teams/ai-sdr-agents-what-works-and-risks) - [All lessons of AI for Sales Teams: Prospecting, Conversations and Pipeline](https://optimizeall.com/learn/ai-for-sales-teams)