Cold outreach lives or dies on where your data came from and whether you can prove a lawful basis for using it. These are the privacy red flags a team should review before the next campaign goes out.

Cold outreach feels like a numbers game until a regulator or an angry recipient turns it into a legal one. The uncomfortable truth is that most compliance problems are baked in before a single email is sent, sitting in the list you bought, the tool that scraped it, or the opt-out you never wired up. Reviewing a few specific red flags as a team, rather than trusting that the vendor handled it, is what keeps a campaign from becoming a liability.

What Matters Most: the single biggest red flag is data you cannot account for, since scraped lists and purchased CSVs with no provenance drive the majority of privacy enforcement. Before you send, confirm you can document where each contact came from and that you have a lawful basis to use it, which for B2B usually means a genuine, written Legitimate Interest Assessment rather than a boilerplate one. Then check the basics people skip: an honest sender identity and a real postal address, an easy opt-out you honor promptly, an accessible privacy notice, and a plan to store only necessary data and delete it on request. Review those as a team, not an afterthought.

So what should teams review first?

Start with provenance, because it is where the real exposure lives. If you cannot say where a contact’s email came from and why you are allowed to use it, nothing downstream fixes that, and roughly seventy percent of GDPR enforcement actions involve improper sourcing. Once provenance is solid, work outward: your lawful basis and its documentation, then the transparency and opt-out mechanics that laws like CAN-SPAM demand, then how you store and eventually delete the data. Reviewing them in that order matters, since a beautiful unsubscribe link on a scraped list is still a scraped list. Treat this as a short team checklist run before each campaign, not a legal project you do once and forget.

Where the data came from

Unsourced data is the red flag that outranks all the others. Scraped lists, purchased CSVs from unknown vendors, and contact files recycled between teams are the classic sources of violations, because you cannot verify how the data was gathered or prove you may lawfully contact anyone on it. The working rule is simple: if you cannot document where an address came from and confirm a legal basis, do not send to it. Lean instead on sources you can defend, publicly available business contact details, opt-in forms, connections from events, and reputable professional databases. A prospecting tool that will not tell you how it collects data is itself the warning sign, and it puts the legal risk on you, not the vendor.

Do you have a lawful basis, and can you prove it?

Under GDPR, most B2B teams rely on legitimate interest rather than explicit consent, but that basis only holds if you have done the work behind it. That means a documented Legitimate Interest Assessment with a stated purpose, a necessity test, a balancing test against the recipient’s rights, a description of your safeguards, and a conclusion, each specific to your outreach rather than copied from a template. Regulators routinely treat boilerplate assessments as evidence of bad faith, so a generic one is worse than useless. The UK ICO’s guidance on legitimate interests lays out what a defensible assessment contains. Keep it on file, because if a complaint arrives, your first move is showing you followed a documented process.

The CAN-SPAM essentials teams skip

In the US, the rules are lighter on consent but strict on transparency, and the details are easy to miss. Every message needs a truthful sender identity and subject line, a valid physical postal address for your business, and a clear, working opt-out that you honor promptly, within ten business days under the law. Skipping any of these is not a minor formatting slip, since penalties can reach tens of thousands of dollars per email under the FTC’s rules, as its CAN-SPAM compliance guide spells out. For California residents, the CCPA adds a duty to provide a clear privacy notice and to honor requests about their data, which the state’s CCPA resource covers. Review each of these as a checklist item, since they are the parts that get quietly dropped when a campaign is rushed.

Opt-out, retention, and how you store the data

The last cluster of red flags is about what happens after the send. Your opt-out has to actually work and stick, which means a suppression list that every future campaign respects, not a link that resets each month. Store only the data you need, a name, a business email, a company, rather than hoarding every field a tool offers, and keep an accessible privacy notice that explains what you hold and how someone can have it removed. Then honor deletion requests promptly and log that you did. Prospect data sitting in an unsecured spreadsheet with no retention limit is a breach waiting to happen, and it undercuts the reputation work covered in our cold outreach domain burn checklist. Tightening this also improves results, a theme our roundup of cold email mistakes keeps returning to.

Red flag	Why it matters	What to review
Scraped or purchased list	No provenance drives most enforcement	Document each source and legal basis
Boilerplate or missing LIA	Legitimate interest fails without it	Write a specific, documented assessment
No physical address or honest headers	Breaches CAN-SPAM transparency rules	Add a real address and truthful identity
Opt-out that does not stick	Repeat contact after opt-out is illegal	Maintain a permanent suppression list
Unlimited retention, loose storage	Excess data raises breach and rights risk	Keep only what you need; delete on request

Most cold outreach compliance problems are decided before the first send, in the list’s provenance and your documentation, so review them as a team rather than trusting the vendor.

This article is general information, not legal advice. Privacy laws including GDPR, CAN-SPAM, CCPA, and others differ by jurisdiction and change over time, and how they apply depends on your specific situation, so consult a qualified attorney or your data protection officer before relying on any point here.

Frequently Asked QuestionsIs cold email legal in 2026?

It can be, but legality depends on where your recipients are and how you handle their data. In the US, CAN-SPAM permits cold B2B email if you use honest headers, a physical address, and a working opt-out. In the EU and UK, GDPR requires a lawful basis, usually documented legitimate interest for B2B, plus transparency and an easy opt-out. The recurring failure is data with no provenance, so the legal question often comes down to whether you can prove where your list came from.

Can I use a purchased or scraped email list?

It is the riskiest thing you can do, because you cannot verify how the data was collected or prove a lawful basis to contact anyone on it, and improper sourcing drives most GDPR enforcement. Regulators and courts treat data provenance as a legal requirement, not a nicety. Favor sources you can defend, publicly listed business contacts, opt-in forms, event connections, and reputable databases, and treat any vendor that will not explain its collection method as a red flag.

What is a Legitimate Interest Assessment and do I need one?

A Legitimate Interest Assessment is the written justification that lets a B2B team rely on legitimate interest under GDPR instead of explicit consent. A defensible one states your purpose, tests whether the outreach is necessary, balances it against the recipient’s rights, describes your safeguards, and reaches a conclusion, all specific to your campaign. A copy-pasted template can be worse than none, since regulators read boilerplate as bad faith. If you contact EU or UK recipients on this basis, you need one on file.

What does CAN-SPAM actually require?

Four practical things: truthful sender identity and subject lines, a valid physical postal address in every message, a clear and working opt-out, and honoring that opt-out promptly, within ten business days. It does not require prior consent for B2B email, which makes it lighter than GDPR, but the penalties for ignoring the basics are steep, reaching tens of thousands of dollars per email. These are the items teams most often drop when a campaign is rushed, so review them every time.

How long can we keep prospect data?

Only as long as you have a genuine, documented reason to, and no longer. Storing prospect data indefinitely, especially in unsecured spreadsheets, raises both breach risk and data-rights exposure, since individuals can ask what you hold and request deletion. Collect only what you need, a name, a business email, a company, keep a retention limit, honor deletion requests promptly, and log that you did. Keeping your sourcing records, assessments, and opt-out logs in one place makes any inquiry far easier to answer.

What To Review

• Provenance first: document where every contact came from, and drop anything scraped or purchased that you cannot source.
• Lawful basis: for B2B under GDPR, keep a specific, written Legitimate Interest Assessment, never a boilerplate one.
• CAN-SPAM basics: honest headers, a valid physical address, and an opt-out honored within ten business days.
• Opt-out and privacy notice: a permanent suppression list and an accessible notice explaining your data use.
• Storage and retention: hold only necessary data, secure it, set a retention limit, and delete on request.

Final Takeaway

Cold outreach compliance comes down to the data and the paperwork behind it, and both are decided before you hit send. The campaigns that get teams in trouble almost always start with a list nobody can source, then compound it with a missing assessment, a dropped opt-out, or data hoarded in a loose spreadsheet. Run the review as a team on every campaign: prove where the data came from, document your lawful basis, cover the CAN-SPAM essentials, and store only what you need with a way to delete it. Do that and outreach stays a growth channel rather than a legal exposure, and you can move fast without leaving a trail of violations behind you. For more on outreach that performs without cutting corners, browse Venture-Lab’s Growth Hacking section.