Is cold outreach legal under GDPR and CAN-SPAM?
Talk to counsel for your facts. The rest of this page is a map of what people mix up, not a permission slip.
CAN-SPAM (US) is built for commercial email: truthful headers, honest subject lines, a physical postal address, and a working opt-out you honor quickly. It is generally treated as not covering a LinkedIn DM, because a LinkedIn message is not mail to an email address. If your sequence hops to email, that email step is in CAN-SPAM's world.
GDPR (EU/EEA, and extra-territorial in practice) applies when you process personal data: a name, a title, an employer, a profile URL sitting in your tool. B2B cold contact often relies on legitimate interest, not prior consent, and that still needs a documented assessment, data minimization, transparency, and a real way to object. Scraping a giant EU list into a sequencer without a story is the version that goes badly.
Canada's CASL is stricter than CAN-SPAM and leans toward consent for commercial electronic messages. If you sell into Canada, do not assume a US email playbook is enough.
Platform rules sit on top of all of this. A campaign can be fine under CAN-SPAM and still get a LinkedIn restriction. Honor opt-outs on every channel you used. Do not buy mystery lists. Keep a record of where a contact came from. That is the unglamorous half of outbound that keeps you in business.
Frequently asked questions
GDPR does not always require consent for relevant B2B contact if legitimate interest holds and they can object. LinkedIn's own rules still apply. When someone asks you to stop, stop.
Sometimes, if the source is lawful and you can still meet GDPR, CAN-SPAM, or CASL. In practice, purchased lists are how bounce rates and complaints spike. Prefer lists you can explain.
A simple "happy to close the loop if this is not useful" is human. A legal footer in a DM looks like email. On email, include a real unsubscribe. On LinkedIn, honor "please stop" without arguing.
No product can. We can pace sends and keep replies in one place. You still own targeting, data sources, and how you respond when someone objects. Read our privacy policy and terms.
Run the outreach from your own LinkedIn account
Omentir finds ICP-fit buyers, drafts connection notes and messages, and keeps replies in one inbox. You still choose the daily send limits.
Try Omentir