---
title: "Email Compliance: GDPR & CAN-SPAM (2026)"
description: "Email compliance guide for GDPR and CAN-SPAM in 2026. What is legal, what is not, opt-out requirements, and how to stay compliant at scale."
canonical: "https://www.inboxkit.com/learn/email-compliance-gdpr-can-spam"
author: "Rahul Lakhaney"
published: "2026-03-30"
updated: "2026-07-29"
category: "Educational"
---

# Email Compliance: GDPR & CAN-SPAM Guide (2026)

Email is legal under both GDPR and CAN-SPAM when done correctly. Here are the exact requirements, common misconceptions, and how to stay compliant at scale.

## Is Email Legal?

**Yes, cold B2B email is legal** in most jurisdictions when done correctly.

**CAN-SPAM (US):** Email is explicitly permitted. Does not require prior consent. Must include opt-out mechanism, physical address, and accurate sender information.

**GDPR (EU/UK):** B2B email is generally permitted under the "legitimate interest" basis. Must be relevant to the recipient's professional role, include opt-out, and process data minimally.

**CASL (Canada):** Stricter. Requires implied or express consent. B2B is possible under the "conspicuously published" exception for publicly listed business contacts.

Here is how the major regulations compare:

| Regulation | Region | Cold B2B Allowed | Consent Required | Max Penalty |
| --- | --- | --- | --- | --- |
| CAN-SPAM | US | Yes | No | $50,120/violation |
| GDPR | EU/UK | Yes (legitimate interest) | No for B2B | 4% revenue or 20M EUR |
| CASL | Canada | Restricted | Implied or express | $10M CAD/violation |
| PECR | UK | Yes (B2B) | No for B2B | Varies |

The key: email is legal. Spam is not. The difference is compliance and relevance.

## CAN-SPAM Requirements

All emails to US recipients must:

1. **Accurate From line**. Sender name and email must identify your business
2. **Honest subject line**. Cannot be deceptive or misleading
3. **Physical address**. Include a valid physical postal address
4. **Unsubscribe mechanism**. Clear, one-click opt-out that works within 10 business days
5. **Honor opt-outs**. Process within 10 business days, no re-emailing opted-out contacts
6. **Identify as ad**. If the email is primarily promotional, it must be identifiable as such

**Penalty:** Up to $50,120 per violation.

## GDPR Requirements for B2B Email

Under GDPR, B2B email is permissible under legitimate interest if:

1. **Relevant to recipient's role**. You are contacting them about something related to their professional function
2. **Data minimization**. Only collect and use necessary data (name, business email, company)
3. **Easy opt-out**. Clear unsubscribe in every email
4. **Privacy notice accessible**. Link to your privacy policy
5. **Legitimate interest assessment**. Document why your outreach serves a legitimate business purpose
6. **Right to erasure**. Delete contact data upon request

**Key distinction:** GDPR applies to personal data of EU/UK individuals, even in B2B contexts.

## Compliance at Scale

Use this checklist for every email campaign. Each item is a legal requirement under at least one regulation:

| Requirement | CAN-SPAM | GDPR | CASL | How to Implement |
| --- | --- | --- | --- | --- |
| Unsubscribe link in every email | Required | Required | Required | Built into sequencer templates |
| Process opt-outs within 10 days | Required | Required | Required | Automate via suppression list |
| Physical postal address | Required | Recommended | Required | Email footer |
| Accurate sender name and email | Required | Required | Required | Real names, business addresses |
| Relevant to recipient's role | Best practice | Required | Required | Segment by industry/role |
| Privacy policy link | Not required | Required | Recommended | Email footer |
| Legitimate interest documentation | Not required | Required | N/A | Internal records |
| Geographic segmentation | Not required | Required | Required | Separate EU/CA from US lists |
| Data deletion on request | Not required | Required | Required | CRM process |
| List cleaning (bounces, complaints) | Best practice | Required | Required | Automated via InfraGuard |

**Automate as much as possible.** At scale, manual compliance is error-prone. Your sequencer should handle unsubscribes, and InfraGuard monitors for complaint-based issues automatically.

## Common Misconceptions

**"Email is illegal under GDPR."** False. B2B email under legitimate interest is permitted. Personal (B2C) email requires consent.

**"I need consent for every email."** False under CAN-SPAM. True for CASL. Depends on jurisdiction.

**"Unsubscribe links hurt deliverability."** False. They are required by law and actually improve deliverability by reducing spam complaints.

**"If they do not reply, I can keep emailing."** Technically legal under CAN-SPAM (until they opt out), but harmful to reputation. Limit follow-ups to 3-4 per contact.

## Frequently asked questions

### Is cold B2B email legal?

Yes, in most jurisdictions. CAN-SPAM (US) explicitly allows it. GDPR (EU) permits it under legitimate interest for B2B. Always include opt-out mechanism.

### Do I need an unsubscribe link in emails?

Yes. Required by CAN-SPAM and best practice under GDPR. It also reduces spam complaints, which helps deliverability.

### What is the penalty for non-compliance?

CAN-SPAM: up to $50,120 per violation. GDPR: up to 4% of annual revenue or 20 million euros.

## Sources

- [CAN-SPAM Act: A Compliance Guide for Business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) (2023)
- [GDPR Official Text - Regulation (EU) 2016/679](https://gdpr-info.eu/) (2016)
- [CASL - Canada's Anti-Spam Legislation](https://crtc.gc.ca/eng/internet/anti.htm) (2014)
- [ICO Guide to PECR - Privacy and Electronic Communications Regulations](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/) (2026)
- [FTC Enforcement Actions Under CAN-SPAM](https://www.ftc.gov/legal-library/browse/cases-proceedings?search_api_fulltext=CAN-SPAM) (2026)
- [InboxKit Compliance Documentation](https://docs.inboxkit.com) (2026)

## Related

- https://www.inboxkit.com/learn/why-emails-go-to-spam
- https://www.inboxkit.com/learn/email-infrastructure-setup-guide
- https://www.inboxkit.com/learn/email-bounce-rate-benchmarks