B2B Data Compliance: GDPR, CCPA, and CAN-SPAM
Compliance scares most sales teams into either ignoring the rules or being so cautious they can't prospect effectively. Neither works. GDPR, CCPA, and CAN-SPAM have specific requirements that are manageable once you understand them. This guide covers what B2B sales and marketing teams need to do, without the legal jargon.
A practical guide to B2B data compliance covering GDPR, CCPA, and CAN-SPAM. What you can and can't do with prospect data, and how to stay compliant while selling.
GDPR: What B2B Teams Need to Know
The General Data Protection Regulation applies to anyone processing data of EU/EEA residents. If you sell to European companies or have European contacts in your CRM, GDPR applies to you regardless of where your company is based.
Legal basis for B2B outreach: GDPR requires a legal basis for processing personal data. For B2B sales outreach, the two relevant bases are consent and legitimate interest.
Consent means the person explicitly opted in to receive your communications. This is the safest legal basis but the hardest to scale. You can't cold email someone under a consent-only approach because they haven't consented yet.
Legitimate interest means you have a genuine business reason to contact someone, and their privacy rights don't override that interest. Most B2B cold outreach operates under legitimate interest. The key requirements: the outreach must be relevant to the person's professional role, you must have assessed the privacy impact, and you must provide an easy opt-out mechanism.
The legitimate interest assessment (LIA) is the critical document. It should answer: what is our legitimate interest (selling a relevant product)? Is the processing necessary (can we achieve this without the personal data)? Does it override the individual's rights (is this reasonable and expected)? Document this assessment and keep it on file.
Practical requirements for GDPR-compliant B2B outreach: Include your company name and contact information in every email. Provide a clear unsubscribe mechanism. Honor opt-out requests within 72 hours. Don't process data beyond what's necessary (you need their email and name, not their home address). Maintain records of your data processing activities. Have a data processing agreement (DPA) with every vendor that handles EU personal data. The <a href="https://gdpr.eu/" target="_blank" rel="noopener noreferrer">official GDPR guide</a> is the primary reference for EU data protection requirements.
CCPA/CPRA: California's Privacy Framework
The California Consumer Privacy Act (amended by CPRA) gives California residents rights over their personal data. Unlike GDPR, CCPA applies based on the individual's location (California) and your business size/revenue, not where you're based.
CCPA applies to your business if you meet ANY of these thresholds: annual gross revenue over $25 million, buy/sell/share personal information of 100,000+ California residents, or derive 50%+ of revenue from selling personal data.
B2B exemption: CCPA originally exempted B2B contact data (business contact information used for B2B transactions). This exemption expired on January 1, 2023, with the CPRA taking effect. B2B contacts now have the same rights as consumers under California privacy law.
Key rights under CCPA/CPRA that affect B2B sales: Right to know what personal data you've collected about them. Right to delete their personal data from your systems. Right to opt out of the sale or sharing of their personal data. Right to correct inaccurate personal data.
Practical compliance steps: Update your privacy policy to disclose B2B data collection practices. Implement a mechanism for California residents to submit data requests (typically a web form or email address). Respond to data requests within 45 days. Add Do Not Sell/Share links if you share data with third parties. Train your sales team on how to handle data requests from prospects.
The operational impact is smaller than it sounds. Most B2B companies already have privacy policies and opt-out mechanisms for GDPR. Extending these to cover CCPA requires updating documentation and processes, not rebuilding your outreach program.
CAN-SPAM: Email Compliance Basics
The CAN-SPAM Act is the US federal law governing commercial email. It's less restrictive than GDPR but carries penalties of up to $50,120 per violation. Every commercial email your company sends must comply.
CAN-SPAM does NOT require opt-in consent for B2B email. You can send unsolicited commercial email in the US as long as you follow these rules. This is the fundamental difference from GDPR. Cold email is legal under CAN-SPAM.
Requirements for every commercial email: Don't use deceptive subject lines. The subject must relate to the email content. Identify the message as an ad or solicitation (this requirement is loosely enforced for B2B). Include your physical mailing address. Provide a clear opt-out mechanism. Honor opt-out requests within 10 business days. Don't use harvested email addresses from websites that prohibit it.
The opt-out requirement is the one most teams get wrong. Your unsubscribe mechanism must work. It can't require the recipient to log in, pay a fee, or provide information beyond their email address. And once someone unsubscribes, you cannot email them again for any commercial purpose from any email address at your company.
Transactional emails are exempt from most CAN-SPAM requirements. Order confirmations, shipping notifications, and account updates don't need unsubscribe links or physical addresses. But if a transactional email also contains marketing content, the primary purpose determines whether CAN-SPAM applies.
State laws layer on top of CAN-SPAM. Some states have additional email regulations. California, for example, has stricter rules about email advertising. When in doubt, comply with the strictest applicable law.
Phone Outreach Compliance
The Telephone Consumer Protection Act (TCPA) governs phone outreach and is where compliance penalties hit hardest. TCPA violations carry penalties of $500-$1,500 per call.
B2B cold calling is legal under TCPA with these restrictions: Check the National Do Not Call Registry before calling. Maintain your own internal do-not-call list. Don't call before 8 AM or after 9 PM in the recipient's time zone. Don't use auto-dialers or pre-recorded messages to mobile numbers without prior express consent.
The auto-dialer restriction is the landmine. If you use software that automatically dials numbers from a list (most sales dialers), and you're calling mobile numbers, you need prior express consent. Manual dialing to mobile numbers is not restricted. The legal definition of 'auto-dialer' has been narrowed by recent court decisions, but the safest approach is to get consent for automated calls to mobile numbers.
For B2B calls to business landlines, TCPA restrictions are minimal. The DNC registry applies, but auto-dialer restrictions generally don't apply to business landlines. The challenge is that mobile numbers and business numbers are increasingly the same, especially for remote workers.
Practical compliance for sales teams: Scrub all call lists against the DNC registry before calling. Use a dialer that supports DNC compliance. Log all opt-out requests and add them to your internal DNC list. If using an auto-dialer, obtain consent for mobile numbers. Train reps on time-zone calling windows.
Data Vendor Compliance
Your compliance obligations extend to the data vendors you use. If a vendor provides you with illegally collected data, using that data exposes you to liability.
Due diligence questions for data vendors: Where does your data come from? (Sources should be transparent and legal.) Do you have data processing agreements in place? How do you handle opt-out requests? (Do they propagate to your systems?) Do you comply with GDPR for EU data? Do you maintain CCPA compliance? When was your last privacy audit? Can you provide a DPA (Data Processing Agreement)?
Key vendor compliance flags: A vendor that won't disclose their data sources is risky. A vendor that can't provide a DPA is not GDPR-compliant. A vendor that doesn't honor opt-out requests exposes you to CAN-SPAM and GDPR violations.
Shared responsibility model: Under GDPR, both the data controller (you) and the data processor (your vendor) are liable for compliance violations. Under CCPA, you're responsible for ensuring your service providers comply with your privacy obligations. Under CAN-SPAM, you're responsible for the emails you send regardless of where the data came from.
Review your vendor agreements annually. Privacy regulations evolve, and your vendors' compliance posture should evolve with them. If a vendor can't keep up with regulatory changes, they're a liability.
Building a Compliant Outreach Program
Step 1: Document your legal bases. For each outreach channel (email, phone, LinkedIn, direct mail), document your legal basis for processing personal data. For US contacts: CAN-SPAM compliance for email, TCPA compliance for phone. For EU contacts: legitimate interest assessment for email and phone.
Step 2: Implement opt-out infrastructure. Every email needs an unsubscribe link. Every phone call script needs an opt-out offer. Every direct mail piece needs a reply mechanism. All opt-outs must flow into a centralized suppression list that all outreach tools respect.
Step 3: Set up data retention policies. Define how long you keep prospect data. GDPR requires that you don't keep data longer than necessary. A reasonable B2B policy: delete prospect data after 24 months of no engagement. Archive customer data according to your contractual and legal obligations.
Step 4: Train your team. Sales reps need to understand the basics: honor opt-outs, don't lie in subject lines, don't call DNC numbers, and escalate data requests to your legal or compliance team. Annual training is sufficient for most teams.
Step 5: Audit quarterly. Check that suppression lists are being respected across all tools. Verify that opt-out mechanisms work. Review data vendor compliance. Spot-check outreach emails for CAN-SPAM requirements (physical address, unsubscribe link, honest subject lines).
The bottom line: compliance isn't a barrier to effective B2B sales. It's a set of rules that, once operationalized, run in the background. The teams that struggle with compliance are the ones that never set up the infrastructure. Invest 20-30 hours upfront in documentation, training, and process setup. Then maintain with quarterly audits. For US-specific rules, the <a href="https://oag.ca.gov/privacy/ccpa" target="_blank" rel="noopener noreferrer">California Attorney General's CCPA page</a> and the <a href="https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act" target="_blank" rel="noopener noreferrer">FTC's Fair Credit Reporting Act</a> outline the key federal and state regulations.
Tools Mentioned in This Guide
Related Categories
Frequently Asked Questions
Can I send cold emails to B2B prospects in the US?
Yes. CAN-SPAM does not require opt-in consent for commercial email. You can send unsolicited B2B emails as long as you include your physical address, provide an unsubscribe mechanism, use honest subject lines, and honor opt-out requests within 10 business days.
Can I send cold emails to B2B prospects in Europe?
Yes, but with more restrictions. Under GDPR, you need a legal basis. Most B2B cold email operates under legitimate interest. The outreach must be relevant to the recipient's professional role, and you must provide a clear opt-out mechanism. Document your legitimate interest assessment.
Do I need consent to cold call B2B prospects?
For business landlines, no (but check the DNC registry). For mobile numbers using an auto-dialer, yes, you need prior express consent under TCPA. For manual dialing to mobile numbers, TCPA restrictions are minimal but DNC still applies.
What happens if a prospect submits a CCPA data deletion request?
You must delete their personal data from your systems within 45 days. This includes CRM records, email lists, and any other systems storing their data. You can retain data required for legal compliance or completing an existing transaction.
Am I liable for compliance violations by my data vendors?
Partially, yes. Under GDPR, both controller and processor share liability. Under CCPA, you're responsible for ensuring service providers comply. Under CAN-SPAM, you're responsible for the emails you send regardless of data source. Always have a Data Processing Agreement with every vendor.