Key Takeaways

• Business email addresses are not exempt from B2B email compliance.
• The contact’s location, not yours, decides which law applies.
• CAN-SPAM allows sending first; CASL and GDPR usually need permission first.
• CCPA governs the data behind the send, not the send itself.
• Opt-outs must reach every connected system, not just your platform.
• If you cannot prove consent, regulators treat it as missing.

Your next campaign will probably reach a buyer in Chicago, an IT lead in Toronto, a procurement manager in Munich and an analyst in London. One send, one unsubscribe link, four sets of rules. B2B email compliance is the work of meeting all of them at once, and most marketing databases were never built to tell those contacts apart.

Many teams still assume business email sits outside privacy and anti-spam law. It does not. CAN-SPAM, CASL, GDPR and CCPA each cover professional contacts, and each defines permission, opt-out timing and record keeping differently. A setup that satisfies one can quietly break another.

This guide explains what B2B email compliance requires, which law applies to which contact, the five requirements every program shares, and how to run them inside the platform you already use.

This post is for educational purposes only and does not constitute legal advice.

What Is B2B Email Compliance?

B2B email compliance is the practice of sending commercial email to business contacts in line with the anti-spam and privacy laws that cover each recipient. It spans permission to send, honest sender details, working opt-outs, provable consent records and the data rights people hold over their information.

The common myth is that a work address belongs to a company, so the rules do not apply. The US Federal Trade Commission states in its CAN-SPAM compliance guide for business that the law makes no exception for business-to-business email. Canada’s law covers any commercial electronic message sent to a Canadian address. Under GDPR, a named work address such as jane.smith@company.com is personal data.

Why it matters: B2B email compliance is not a legal side project. It decides who you can email, how fast you must stop, and what you must prove when someone asks.

What is at stake: Fines get the headlines, but the day-to-day cost of weak B2B email compliance is operational. Campaigns get paused while someone traces where a list came from. Sales loses access to contacts it relied on. A single complaint from a prospect who opted out and kept receiving email can damage a deal that took months to build.

Which Email Law Applies to Which Contact?

The recipient’s location decides which email marketing laws apply, not where your company is based. A US company emailing a contact in Germany is subject to GDPR, because the regulation covers organizations outside the EU that offer goods or services to people in the EU.

Where the contact is	Main law for the send	Permission model	Opt-out deadline
United States	CAN-SPAM	Send first, honor opt-outs	10 business days
Canada	CASL	Express or implied consent before sending	10 business days
European Union	GDPR plus national email rules	Lawful basis, often consent	Stop direct marketing once the person objects
United Kingdom	UK GDPR plus PECR	Depends on contact type	Stop once the person objects
California residents	CAN-SPAM for the send, CCPA for the data	CAN-SPAM rules apply to the email itself	CCPA covers data rights, not unsubscribes

For a law-by-law breakdown of consent models, penalties and scope, see our full comparison of CAN-SPAM, CASL and GDPR.

Some contacts fall under more than one law, such as a Canadian resident working for a company with EU offices. The safest approach to B2B email compliance is to apply the strictest rule that could cover the contact. In practice, many teams treat their whole database as opt-in, because one consistent standard is easier to run than five exceptions.

United States: CAN-SPAM

CAN-SPAM lets you send commercial email without prior permission, provided every message identifies the sender, includes a valid postal address and offers a working opt-out. The FTC states that each separate email in violation can carry a penalty of up to $53,088.

Canada: CASL

CASL is consent-first. You need express or implied consent before the first commercial message. Under the text of Canada’s Anti-Spam Legislation, implied consent from an existing business relationship is generally limited to two years after a purchase and six months after an inquiry. Penalties can reach $10 million per violation for a business. The CRTC’s CASL guidance explains how the regulator applies these rules.

European Union and United Kingdom: GDPR and Local Email Rules

The official GDPR text requires a lawful basis, such as consent or legitimate interest, for processing personal data, and it sets fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher. Each EU country also has its own rules on electronic marketing, so email consent requirements can differ by country. Our guide on how GDPR applies to B2B campaigns covers lawful basis and legitimate interest in detail.

In the UK, the ICO’s electronic mail marketing guidance explains that companies and other corporate bodies can generally receive marketing email without prior consent, while sole traders and some partnerships are treated like individuals and need consent.

Where CCPA Fits

CCPA is a privacy law, not an anti-spam law. It does not decide whether you may send an email to a California contact; CAN-SPAM still does that. CCPA governs the personal data behind the send: what you collect, why, and what happens when a California resident asks to see or delete it.

The California Attorney General’s CCPA guidance confirms that the temporary exemptions for business-to-business data expired on December 31, 2022. California business contacts now hold the same data rights as consumers. If your database spans several US states, read what US state privacy laws change inside your platform.

The Five Requirements Every B2B Email Program Must Meet

The laws disagree on details, but they converge on five requirements. Meet all five and your B2B email compliance holds up in every market you send to.

1. Permission or a Lawful Basis Before You Send

Know, for every contact, why you are allowed to email them. Under CAN-SPAM that may simply be a valid business purpose. Under CASL it must be express or implied consent. Under GDPR it must be a documented lawful basis.

Protect that permission once you have it. A common failure is a registration form that writes a blank opt-in box to the consent field and erases valid consent. Our Eloqua Office Hours session shows how form logic can overwrite valid consent and how to stop it.

2. Accurate Sender Details and Honest Subject Lines

Every law expects the recipient to know who is emailing them. Use a real sender name, accurate routing information and a subject line that matches the content. CAN-SPAM requires a valid postal address in every message, and CASL requires sender identification and contact information.

3. Unsubscribe Requirements and Opt-Out Deadlines

Unsubscribe requirements are where the laws line up most closely. Every commercial email needs a free, working way to opt out. CAN-SPAM and CASL both set a maximum of 10 business days to act on the request, and CASL requires the unsubscribe mechanism to stay valid for at least 60 days after sending.

GDPR is stricter in practice. Once a person objects to direct marketing, their data can no longer be processed for that purpose. Build email opt-out requirements around the fastest standard, not the slowest, and process opt-outs in hours, not days.

4. Consent Records You Can Prove

Under CASL and GDPR, a consent you cannot prove is treated as one you never had. For each contact, record the source of the consent, the date, the wording shown, the method of capture and which law applies. Store it on the contact record, not in a spreadsheet nobody can find during an audit.

Treat list imports with the same care. A purchased or event list does not carry the vendor’s consent over to you, and email consent requirements still apply to every record you load. If a list arrives without source and consent data, hold it back until it has them. Good records are what turn B2B email compliance from a claim into evidence.

5. Data Subject Rights

GDPR and CCPA give people the right to access, correct or delete their data. GDPR expects a response within one month, extendable by two further months for complex requests. CCPA allows 45 calendar days, extendable by another 45. A request handled in one system but not the others is not fulfilled. Our guide to automating data subject requests walks through the intake, verification and fulfillment steps.

How to Run B2B Email Compliance Inside Eloqua or Marketo

Email marketing compliance becomes real inside your marketing automation platform. Policies written by legal only work when the platform enforces them on every send.

Consent fields on every contact: Store consent status, source, date and applicable regulation as fields on the contact record. Without them, you cannot segment by law or prove permission later.

Location-based rules: Capture country, and state for US contacts, at the point of entry. That single field decides which rules apply to the contact.

Suppression checked before the send: Evaluate permission at send time, not only at import. In Eloqua that check belongs on the campaign canvas; in Marketo it belongs in the smart list and flow logic of the program.

Opt-outs and deletions everywhere: An unsubscribe recorded in your platform must also reach your CRM, webinar tools and ad audiences. Test the sync, do not assume it.

Regular audits: Review your B2B email compliance setup at least once a quarter. Check which forms write to consent fields, confirm that opt-outs reached every system, and sample a handful of contacts to see whether you could prove their consent today.

Running this manually across four laws breaks as your database grows. 4Comply records when and how each consent was collected, checks permission in real time before a communication goes out, automates data subject requests and keeps an immutable audit trail. It integrates natively with both Eloqua and Marketo, so the rules run inside the platform your team already operates.

Conclusion

B2B email compliance is not four separate projects. It is one operating model that knows where each contact is, what permission you hold, and how fast you must act when that permission changes. The teams that get it right treat consent as data, check it before every send, and make opt-outs reach every system. If you want a second set of eyes on how your platform handles consent today, contact us and ask how 4Comply can support your B2B email compliance program.

About 4Thought Marketing
We're a B2B marketing automation and AI consultancy with a thing for getting complex tech to actually work. Since 2008, we've helped hundreds of organizations across financial services, technology, manufacturing, and real estate get more from Eloqua, Marketo, and their CRM integrations. We serve our clients across marketing automation strategy, lead lifecycle, AI, compliance, preference management, and more. Explore our services or get in touch.

Frequently Asked Questions