Cold email lists and compliance: who to email, and how to stay on the right side of the rules

Every cold email starts with a list, and most cold email problems start there too. A list of the wrong people produces complaints; a list of bad addresses produces bounces; a list you can't explain the source of is a legal problem waiting to happen. This guide covers choosing who to email, getting the list into shape, the rules that apply in the main markets, and handling opt-outs.

This guide is general information, not legal advice. The rules depend on where you and your recipients are; ask a lawyer about your situation.

Choose who to email

Start from relevance. The question every law and every recipient asks is the same: why is this person getting this email? A good answer is specific — their role, their company's situation, something they published — and you should be able to say it in the email itself.

Practical rules:

• Email people at work, about their work. Business addresses, for a reason tied to the person's role.
• Prefer named people to shared inboxes. info@ and sales@ rarely reply, and complaints from them still count.
• Know where every row came from. Your own research, a sourcing tool, an event, a referral — keep a note. Data protection law expects you to be able to tell people where you got their details.
• Don't buy lists. Bought lists tend to contain dead addresses and spam traps, usually break your email provider's terms, and come with no answer to "where did you get my address?".

Get the list into shape

Before importing, clean the file:

• One row per person, with the email address in its own column.
• First name, company and any field your emails use, filled in where you can — and a fallback planned for where you can't.
• Duplicates removed, or a plan for what happens to people who are already in your prospects. See importing prospects from a CSV.

Then check the addresses. A domain with no mail server can't receive email; misspelt domains like gmial.com and disposable-inbox services never need to be emailed. Verify addresses from guessed or older sources, and re-check anything older than about a month: people change jobs, and their old address starts bouncing.

Bounces are the price of a dirty list, and they cost the whole domain. Under 2% is healthy; above 5%, stop. How to read bounce codes and what to do when the rate climbs: what's a safe bounce rate for cold email.

Know the rules where your recipients are

The main regimes, in brief:

Two things are true everywhere. You must say who you are. And when someone asks you to stop, you must stop — within 10 business days at the latest under CAN-SPAM and CASL, and immediately under the GDPR, where an objection to direct marketing has no exceptions.

The detail, including what "legitimate interest" means in practice and what the mailbox providers add on top, is in unsubscribes in cold email.

What the mailbox providers add

Laws set the minimum; Gmail, Yahoo and Outlook set the practical bar. Since 2024 Google and Yahoo require bulk senders to authenticate their domain, support one-click unsubscribe and honour it within two days, and keep spam complaints low. Even below the bulk threshold, these are the signals their filters use. Authentication is covered in the cold email deliverability guide.

Handle opt-outs properly

An opt-out is the end of the relationship, and it has to stick:

• Stop everywhere. An unsubscribe from one campaign stops every campaign, including your colleagues' and next month's.
• Read replies. "Please remove me" is an unsubscribe, whatever words it uses.
• Block domains when asked. If a company asks you to stop contacting its people, suppress the domain.
• Keep a suppression list of every address and domain you must never email, including hard bounces, and check every import against it. Keep it even after deleting the prospects: it's your record of who said no.

The most common way someone gets emailed after opting out is a fresh CSV that includes them again. Your tool should catch that on import.

A list checklist

1. Every prospect has a reason to hear from you, and you know their source.
2. No bought lists; few shared inboxes.
3. Duplicates handled, fields filled or given fallbacks.
4. Addresses checked before the first email and re-checked after a month.
5. You know which rules apply where your recipients are.
6. Every email says who you are and how to stop.
7. Opt-outs and hard bounces are suppressed everywhere, permanently, and checked on every import.

How Outsquid helps

Outsquid's prospects import handles duplicates the way you choose, checks every address before a campaign emails it — skipping dead domains, typos and disposable inboxes, flagging shared ones — and re-checks addresses whose last check is over a month old. Every campaign email carries a one-click unsubscribe header; an unsubscribe, a hard bounce or a blacklist entry stops the prospect in every campaign, and blacklisted addresses stay blocked when they appear in a later import. See safeguards and unsubscribes, the blacklist and bounce protection.