junipry.com

Cold Email Compliance Checklist

Target markets: US, UK, Canada, Australia. Each has its own rules, and Canada’s are the strictest. This is a practical checklist, not legal advice — get a lawyer’s review before you scale volume.

1. Physical Address Requirement

Every marketing email must include a valid physical postal address. This is mandatory under US CAN-SPAM and Canadian CASL, and it is one of the strongest deliverability signals for inbox providers.

Your options:

OptionCostNotes
Your real home/office address in BangladeshFreeFully compliant. Downside: address is public
Virtual business address (US)$10–30/moAnytime Mailbox, PostScan Mail, iPostal1
Registered agent / virtual office (UK)£10–25/moAdds credibility for UK recipients
Coworking space addressVariesIf you have local access

A PO Box is acceptable under CAN-SPAM if it is registered to you with the postal service.

Do not invent an address or use one you have no right to use. That converts a compliance measure into a fraud issue.

2. Required Elements in Every Marketing Email

3. Rules by Country

United States — CAN-SPAM

Opt-out regime. You may send unsolicited commercial email to business addresses provided you meet the requirements in Section 2. Penalties run to tens of thousands of dollars per violating email.

Canada — CASL (strictest)

Opt-in regime. Unsolicited commercial email is generally prohibited without express or implied consent.

Implied consent exists where the recipient has conspicuously published their business email address publicly, without a statement refusing unsolicited messages, and your message is relevant to their role or business. This is the basis most cold outreach to Canadian businesses relies on.

Requirements: identify yourself, provide contact information valid for 60 days, and include unsubscribe. Penalties reach CAD 1 million for individuals, CAD 10 million for organisations. Keep records of where you sourced each address.

United Kingdom — PECR + UK GDPR

B2B email to corporate subscribers (limited companies, LLPs, public bodies) does not require prior consent. Sole traders and unincorporated partnerships are treated as individuals and require consent — this matters, because many salons, coaches, and small clinics are sole traders.

You must identify yourself, provide a valid address, and allow opt-out at any time.

Australia — Spam Act 2003

Consent-based, but inferred consent applies where a business address is conspicuously published and the message relates to that role. Must include sender identification and a functional unsubscribe. No exemption for B2B.

4. Practical Rules for Your Outreach

  1. Only use publicly published business contact addresses. Never use scraped personal addresses, guessed patterns like firstname@, or purchased lists.
  2. Log the source of every address — Google Business Profile, the business’s own website, their public Facebook page. Keep the URL and date in your spreadsheet. This is your consent record if challenged.
  3. Keep messages relevant to the recipient’s business role. Relevance is a legal element in Canada and Australia, not just a conversion tactic.
  4. Honour opt-outs immediately and permanently. Maintain a global suppression list across all sending tools.
  5. Skip anything ambiguous. If you cannot tell whether an address is a published business address, do not send.

5. Domain and Deliverability Setup

Compliance protects you legally; authentication gets you into the inbox.

6. Listing Removal and Data Requests

Because you are publishing business information you collected yourself, expect removal requests. Handle them properly:

Fast, unconditional removal is what keeps this model out of trouble. Resisting a removal request is what turns a complaint into a legal problem.

7. Before You Send the First Campaign