Adding channels multiplies your compliance surface. Email has one set of rules, calling another, WhatsApp a third, and LinkedIn is governed by contract rather than statute.
This is the map. It is general information rather than legal advice, and if you run outbound at volume into regulated markets, the cost of an hour with a qualified lawyer is trivial against the alternative.
Cold email
United States — CAN-SPAM
Permissive by international standards, and opt-out rather than opt-in.
Required: accurate header and sender information, a subject line that reflects the content, a valid physical postal address, a functioning unsubscribe mechanism, and honouring opt-outs within ten business days.
Not required: prior consent. This is why US cold email is straightforward and why advice written from the US travels badly.
European Union and UK — GDPR
Stricter, and frequently misunderstood in both directions.
GDPR does not ban cold email. It requires a lawful basis for processing personal data, and legitimate interest is generally available for B2B outreach. What it requires in practice:
- A legitimate interest assessment, written down. Most teams claim legitimate interest and have never documented the balancing test, which is the part that matters if anyone asks.
- Transparency about where you obtained the data, on request and ideally in the message.
- Honouring objections immediately, not within ten days.
- Data minimisation — holding only what you need.
- Recognising that role addresses (info@, sales@) are generally not personal data, while named addresses are.
The ePrivacy Directive sits alongside GDPR and is implemented differently by each member state. Germany is notably stricter than most.
Canada — CASL
The strictest of the major regimes. Consent-based rather than opt-out, with implied consent available in defined circumstances — an existing business relationship, or a business email address published without a statement refusing unsolicited mail and where the message is relevant to that role.
That last route is the one most B2B cold email into Canada relies on, and it is narrower than people assume. It requires the address to be published, the message to be relevant to the person’s role, and no disclaimer refusing unsolicited messages.
Practical baseline for email
Identify yourself honestly, include a real postal address, provide an unsubscribe on every message, honour opt-outs immediately across every channel, and keep a documented basis for why you hold the data. That satisfies most regimes most of the time.
Cold calling
Covered fully in the calling compliance piece. The headlines:
- US: federal DNC covers residential subscribers, so B2B calls are generally exempt. Mobile numbers are murkier and automated dialling to mobiles carries additional restrictions. Some states are stricter than federal law.
- UK: business numbers must be screened against CTPS. Sole traders are treated as individuals, so TPS applies to them.
- EU: GDPR for the data, ePrivacy for the call, implemented differently per state.
- Canada and Australia: business-to-business calls generally exempt from the national registers.
The rule that catches most teams is call recording. Most US states are one-party consent; a significant minority require all parties. On an interstate cold call you usually do not know where the prospect is, so announcing recording on every call is the only workable policy.
Two separate risks, and conflating them causes confusion.
Legal risk. A mobile number attached to a named person is personal data under GDPR, and legitimate interest is harder to argue for a personal messaging app than for a work email address. Several markets have specific rules on unsolicited commercial messaging.
Platform risk. WhatsApp’s terms restrict automated and bulk messaging, and enforcement is behavioural — block rate primarily. This is not a legal question, it is an account-survival question, and it is covered in the WhatsApp guide.
The practical position: earn the number where you can, treat the destination market’s expectations as the constraint, and never send WhatsApp to someone with no prior context. Both risks reduce with the same behaviour.
Governed by contract, not statute. LinkedIn’s User Agreement prohibits automated access and account sharing. There is no compliant way to automate LinkedIn outreach, and enforcement is account restriction rather than legal action.
What varies is exposure, not permission — detailed in the risk piece.
Separately, the data you collect from LinkedIn is still personal data under GDPR. Scraping profile information and using it for outreach engages the same lawful basis question as any other source, regardless of it being publicly visible.
By region, briefly
| Region | Calls | ||
|---|---|---|---|
| US | Opt-out, CAN-SPAM | B2B exempt from federal DNC | Low adoption, low risk |
| Canada | CASL, consent-based | B2B exempt from DNCL | Low adoption |
| UK | UK GDPR, legitimate interest | CTPS screening required | Moderate |
| EU | GDPR + ePrivacy, varies by state | Varies, Germany strict | Varies, Germany very restrictive |
| Australia | Spam Act, consent-based | B2B generally exempt | Low adoption |
| India | Lighter regime, evolving | Preference register | Very high adoption, normal practice |
| Brazil / LATAM | LGPD in Brazil, GDPR-influenced | Varies | Very high adoption |
The eight practices that cover most of it
Rather than tracking every rule, these eight satisfy most regimes across most channels.
- Identify yourself honestly. Real name, real company, real contact details. Almost every rule in this space starts here.
- Provide an opt-out on every channel. Email unsubscribe, a verbal opt-out on calls, and honouring “stop” on WhatsApp.
- Honour opt-outs immediately and across every channel. Someone who unsubscribes from email should not get a WhatsApp message. This is both a legal and a basic-decency point, and it fails most often when channels live in separate tools.
- Keep a global suppression list. Workspace-wide, not per campaign.
- Document your lawful basis. A written legitimate interest assessment takes an afternoon and is the difference between a defensible position and an assertion.
- Know where the data came from. If a prospect asks, you should be able to answer. “A data provider” is weak; naming it is better.
- Announce call recording, always. Three seconds, removes a whole category of problem.
- Log consent and opt-out events with timestamps. The record is the defence.
Where teams actually get caught
Not usually the dramatic failures. Three mundane ones:
Opt-outs not syncing across channels. Someone unsubscribes from email and receives a LinkedIn message the following week, because the two systems do not share a suppression list.
Suppression at campaign level. The person is suppressed in one campaign and enrolled in another.
No record of the basis. Somebody asks where you got their details and nobody can answer, which turns a routine question into an escalation.
All three are operational rather than legal problems, and all three are fixed by one global suppression list and a written basis.
The short version
US email is opt-out and permissive. EU and UK email needs a documented lawful basis. Canada is consent-based and stricter than either. Calling has B2B carve-outs in most markets, requires CTPS screening in the UK, and the recording rules catch more people than the dialling rules. WhatsApp carries both a legal and a platform risk. LinkedIn is contractual, and automating it is never compliant.
Eight practices cover most of it, and the one that matters most operationally is a single global suppression list that every channel honours immediately.
General information, not legal advice. Get anything material reviewed by someone qualified in the markets you sell into.
Frequently asked questions
Is cold email legal under GDPR?
Yes, with a documented lawful basis. Legitimate interest is generally available for B2B outreach, but it requires a written balancing assessment, transparency about where the data came from, and honouring objections immediately.
Do I need consent to send cold email?
In the US, no — CAN-SPAM is opt-out. In Canada, generally yes, though implied consent covers published business addresses where the message is relevant to the role. In the EU and UK, you need a lawful basis rather than consent specifically.
Is LinkedIn automation compliant?
No. LinkedIn’s User Agreement prohibits automated access, so there is no compliant version. Enforcement is account restriction rather than legal action, and exposure varies with how the automation behaves.
What is the most common compliance mistake in outbound?
Opt-outs that do not sync across channels. Someone unsubscribes from email and then receives a LinkedIn or WhatsApp message, because suppression lives in separate tools or at campaign level rather than workspace level.