GDPR vs CASL vs CAN-SPAM: B2B email rules for European teams selling into North America

We see two mistakes. Some European teams apply GDPR habits to the US and refuse to email anyone who has not opted in, which leaves pipeline on the table where US law allows a well-run outbound program. Others assume North America is permissive and send the same sequences to Toronto as to Texas, which creates real exposure under CASL. Website tracking has its own rules, covered in our guide to cookie consent in the US and Canada.

The three regimes start from different questions. CAN-SPAM asks whether the message is honest and lets people leave. CASL asks whether you had permission before you sent it. GDPR asks whether you had a lawful basis to process the person’s data at all, and lets them stop marketing use at any time.

This comparison covers commercial email to business contacts. It is a working summary for marketers, not legal advice; confirm your program with counsel in each market.

The FTC is clear that the law makes no exception for business-to-business email. Every commercial message needs accurate header information, a subject line that reflects the content, a clear statement that it is an advertisement where that applies, a valid physical postal address and an easy way to opt out. Opt-outs must be honored within 10 business days, and the mechanism must keep working for at least 30 days after you send.

What CAN-SPAM does not require is permission before the first message. That is why US outbound programs exist at the scale they do. Deliverability, sender reputation and your brand are the real limits, so the US program still needs tight targeting and low volume per account.

The CRTC explains that CASL covers commercial electronic messages sent to an electronic address, including email and text messages, and that it does not apply to live voice or automated telemarketing calls. Consent can be express, which does not expire until withdrawn, or implied, for example for two years after a purchase or six months after an inquiry. Silence and pre-checked boxes do not count as express consent.

The B2B exemption is narrower than most European teams expect. It covers messages from an employee or representative of one organisation to an employee or representative of another when the organisations have a relationship and the message concerns the recipient organisation’s activities. A personal connection between two employees does not create that relationship. Conspicuous publication, a business address published without a no-spam statement and a message relevant to the person’s role, is also limited. Our CASL guide for B2B email covers the day-to-day rules in more depth.

Under GDPR, a named person’s work email is personal data. The UK Information Commissioner’s Office says this plainly: an individual employee’s business address is personal data even when they act in a business capacity, and their right to stop direct marketing is absolute. Article 21 of GDPR gives every data subject the right to object at any time to processing for direct marketing, after which the data must no longer be processed for that purpose.

On top of GDPR, national rules implementing the ePrivacy Directive govern electronic marketing and differ between countries. The UK, for example, does not require PECR consent to email corporate subscribers, but treats sole traders and some partnerships like individuals. That variation is why European teams tend to build conservative consent records, and those records are an asset when you move into Canada.

Do not run three programs with three rulebooks. Build one model in the CRM that every email tool reads. These are the fields we set up first.

1. Country of the recipient, taken from the company or contact record and validated, because it decides which rule applies.
2. Consent type: express, implied by purchase, implied by inquiry, conspicuous publication, B2B relationship exemption, or none.
3. Consent date and expiry date, so CASL implied consent ends automatically after two years or six months.
4. Source and evidence: form, event scan, contract or conversation, with a link to the record.
5. Objection and unsubscribe status, synced across every sending tool within the shortest deadline that applies, which is 10 business days in both the US and Canada.

With these fields in place, a Canadian contact without valid consent is excluded from outbound sequences automatically, a US contact can receive a compliant first email, and a European contact who objects is suppressed everywhere. Our RevOps team builds this as part of CRM setup.

Collecting consent that stays usable is the other half of the work; our Law 25 and CASL consent guide explains how to ask for it and record it.

Each of these is avoidable with the model above and an hour with counsel.

• Treating Canadian contacts bought from a data vendor as emailable because the same list is fine in the US.
• Letting the CASL implied consent clock run out without asking for express consent during the two-year window.
• Using a European entity’s postal address on US emails without checking it is valid for receiving mail.
• Keeping unsubscribes in the email tool but not in the CRM, so sales sequences keep sending.
• Assuming tracking pixels in emails are covered by the same rules as the email itself; tracking has its own consent questions.

We are a Canadian agency that runs demand generation for clients across Canada and the US, so CASL and CAN-SPAM are part of every program we build.

If your European marketing operations need a North American consent model before outbound or nurture starts, talk to our team.