Legal Ground You Must Know
CAN-SPAM (US)
Business email is legal to send without prior consent if you: identify yourself, include a physical address, honor unsubscribes within 10 days, and don't use deceptive subjects.
GDPR (EU/UK)
B2B cold email is allowed under legitimate interest, but you must be able to demonstrate the interest, offer easy opt-out, and honor data subject requests.
CASL (Canada)
Stricter. Requires express or implied consent for commercial email. Prior business relationship, publicly listed business email, or explicit opt-in all qualify.
Sources That Work — Ranked by Quality
Your Own Network + Referrals
Highest quality. Warm intros convert 5–10x cold outreach. Always start here.
Public Company Websites
"Contact us", team pages, published PR. Free, legal everywhere, and signals recent hiring/priorities.
LinkedIn Sales Navigator
Filter by role, seniority, industry. Export or manually collect. Respect LinkedIn's ToS — no scrapers.
Reputable B2B Databases (Apollo, ZoomInfo, Clay)
Legally sourced. Verify addresses before sending; not all data is fresh.
Industry Directories and Event Lists
Conference attendees, association members, published rosters. Almost always fair game if the emails are public.
Sources That Will Burn You
Purchased lists from unknown vendors — full of dead addresses, spam traps, and previously-complained recipients. One import can permanently damage your domain.
Scraped lists from web crawlers — mixes personal and business addresses, ignores consent, and often includes catch-all traps that immediately blacklist you.
"Leaked" databases — beyond illegal in most jurisdictions, they're littered with honeypot addresses maintained by spam filter vendors specifically to catch anyone who uses them.
Verification — the Two-Step Process
Syntax + MX Check
Confirms the format is valid and the domain accepts mail. Catches 30–40% of bad addresses. Free tier of most verification tools.
SMTP Verification
Attempts to validate the mailbox exists without sending. Catches another 30–40%. Paid verification tools (NeverBounce, ZeroBounce, Bouncer) do this reliably.
Reject Catch-Alls
Domains that accept every address exist to trap senders. Verification tools flag them — remove or quarantine before sending.
Remove Role Accounts for Cold
info@, sales@, support@ rarely convert and often trigger complaint filters.
Record-Keeping That Protects You
Log where each contact came from (source URL or database name), when you collected them, and the legitimate interest reason. Store this alongside the contact record.
Under GDPR, you must be able to produce this if asked. Under CAN-SPAM, it's your defense against complaints. Under CASL, it's mandatory.
MyProspectPro's CSV import lets you attach a source column that persists on every contact.
Do
- Verify every list before importing — spend the money.
- Record source and collection date for every contact.
- Remove role accounts and catch-alls before sending.
- Honor opt-outs within 24 hours (regulations allow 10 days, but reputation demands faster).
- Include your physical mailing address in every send.
Don't
- Never buy lists from unverified brokers.
- Don't scrape LinkedIn or personal email addresses.
- Skip catch-all domains — they're spam traps in disguise.
- Never contact anyone who unsubscribed, ever.
- Don't email personal Gmail/Yahoo/Hotmail for B2B outreach — treat those as consumer contacts.
Pre-Send Checklist
- 1Source documented for every contact.
- 2Every address run through syntax + SMTP verification.
- 3Catch-alls and role accounts removed or quarantined.
- 4Physical mailing address in signature.
- 5Unsubscribe link present (auto-added).
- 6GDPR legitimate interest reason logged for EU contacts.
Frequently Asked Questions
Is B2B cold email legal in the EU?
Yes, under GDPR's legitimate interest basis — provided you can demonstrate the interest, offer easy opt-out, and honor deletion requests. Consumer email (B2C) is stricter.
Can I use LinkedIn to find emails?
Yes — using LinkedIn to identify the right person is fine. Scraping LinkedIn for email addresses violates their ToS. Use it for research; use verified databases for actual email discovery.
How often should I re-verify a list?
Every 60–90 days for active outreach lists. Emails go stale as people change jobs — a 6-month-old list can have 20%+ dead addresses.
Do I need consent for B2B in the US?
No — CAN-SPAM allows cold B2B email without prior consent, provided you follow its rules (identify yourself, include address, honor unsubscribes).
Build a List That Delivers — Legally
MyProspectPro handles the sending, tracking, and follow-ups so you can focus on the message.