Outbound Compliance Basics: GDPR, CAN-SPAM, and TCPA in Plain English

GDPR, CAN-SPAM, and TCPA are frequently mentioned in the same breath as if they form a single compliance checklist, but they cover different territory, different channels, and different jurisdictions, and conflating them leads teams to either over-restrict themselves unnecessarily or miss a real requirement entirely. GDPR governs how personal data is processed for anyone in the EU or UK, regardless of where your company is based, and it applies to how you collect, store, and act on contact information generally, not just to the moment you hit send. CAN-SPAM is a US law specific to commercial email that sets requirements for the message itself, not for whether you were allowed to obtain the address in the first place. TCPA is a US law specific to telephone calls and text messages, with rules around consent for certain call types that are considerably stricter than the email rules.

Treat these as three overlapping but distinct compliance surfaces: one about data handling broadly, one about email content and mechanics, one about phone and text consent. A B2B outbound program selling into the US and the EU needs to satisfy all three where applicable, and none of them substitutes for the others. In practice, this typically hedges toward the stricter standard where jurisdictions blend, since a contact list rarely sorts itself cleanly by region.

A common misconception is that GDPR bans cold outreach outright. It does not, but it does require a documented lawful basis for processing someone's personal data, and for B2B outreach the basis most teams rely on is legitimate interest rather than explicit consent. Legitimate interest generally requires that the outreach is relevant to the person's professional role, that you can reasonably justify why reaching them serves a legitimate business purpose, and that you have weighed that interest against the person's own rights and expectations, documented in a way you could show if asked.

In practice this means B2B outreach using publicly available business contact information, sent to someone whose role is plausibly relevant to what you are offering, sits on firmer ground than outreach using personal, non-business data or targeting someone in a role with no plausible connection to your offer. Every outreach email also needs a clear way to object or opt out, and that objection has to be honored promptly and completely, not partially. Consumer-facing, B2C-style outreach carries a meaningfully higher bar and should not be treated the same as professional B2B contact under this framework.

CAN-SPAM does not require opt-in consent before you email someone, which surprises people who assume it works like GDPR. What it requires instead is that the message itself follow specific mechanical rules: an accurate, non-deceptive subject line, clear identification that the message is a commercial communication, your true physical postal address included somewhere in the message, and a functioning, honored opt-out mechanism that has to be processed within a defined window, not indefinitely delayed.

The most common CAN-SPAM violations are not exotic, they are mundane failures to include a working unsubscribe link, a subject line that misleads about the content of the message, or an opt-out request that gets ignored because it went to an inbox nobody monitors. Any sequencing or automation tool used for cold email outreach should have unsubscribe handling built in and tested, and opt-outs should suppress the contact across the entire sequence immediately, not just from the specific message they clicked from.

TCPA is the strictest of the three for the channels it covers, and it applies specific rules to automated or prerecorded calls and to text messages that are meaningfully different from the rules for a live, manually dialed call. Automated dialing systems and prerecorded messages generally require prior express consent, and the standard is stricter for calls to mobile numbers than landlines. A live rep manually dialing a business number for a B2B call is on different, generally lower-risk ground than an autodialer blasting a list, but the specifics depend on the call type and the number being called, and this is an area where getting current legal guidance for your specific setup matters more than relying on a general summary.

Text messaging for outbound prospecting carries its own consent requirements that are stricter than most teams assume, and unsolicited B2B cold texting sits in genuinely risky territory in a way cold email generally does not. Do-not-call registries also apply in relevant jurisdictions and should be checked against any calling list as a matter of course. The safest operating posture treats phone and text outreach as the highest-compliance-risk channel in the mix and applies the most caution there, rather than assuming the relatively looser rules around email extend to the phone.