GDPR vs CAN-SPAM: Opt-In, Opt-Out and What Each Law Requires

They regulate different things

CAN-SPAM is a US federal law about commercial email messages. The Federal Trade Commission enforces it, and it sets rules for what a message must contain and how opt-outs work. It does not require consent before the first message, though harvesting addresses or registering accounts by false pretences are aggravated offences under the Act.

GDPR is an EU regulation about processing personal data, by any channel. National data protection authorities enforce it. It governs collecting, storing and using a prospect's name and work address, which is why it reaches cold email at all. The rule on whether you need consent before sending marketing email mostly comes from a third source: the ePrivacy Directive, as each EU country implemented it. In the UK the pair is UK GDPR and PECR, overseen by the ICO.

Opt-out versus opt-in

The FTC describes CAN-SPAM as an opt-out system: you may send commercial email without prior consent, provided every message is honest, identifies itself as an ad, includes a valid postal address, and offers a working opt-out that you honour within 10 business days.

In the EU, the ePrivacy Directive requires prior consent for direct marketing email to individuals, with a soft opt-in for existing customers who bought something similar. For business recipients, it leaves the rule to each member state, so some countries allow unsolicited B2B email with an opt-out and others require consent. Separately, GDPR requires a lawful basis for the processing itself, often legitimate interests or consent, plus a transparency notice.

Scope and reach

CAN-SPAM covers any message whose primary purpose is commercial. GDPR Article 3(2) applies to organisations outside the EU when they offer goods or services to people in the EU or monitor their behaviour there. A US company emailing a prospect in Germany therefore has to think about both: CAN-SPAM for the message, and GDPR plus German marketing law for the data and the decision to send.

How each treats B2B email

The FTC says plainly that the law makes no exception for business-to-business email. Under GDPR, a named work address such as firstname.lastname at a company is personal data, so B2B outreach is in scope. The UK shows how national rules diverge: the ICO says you can email any corporate body without prior consent, while sole traders and some partnerships are treated as individuals and need consent or the existing-customer exception.

Penalties

The FTC's compliance guide states that each separate email in violation of CAN-SPAM is subject to penalties of up to $53,088, a figure adjusted for inflation, and that some practices such as harvesting addresses or registering accounts with false information carry criminal penalties. GDPR Article 83 sets maximum fines of up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher, for infringements of the core principles, lawful basis and data subject rights, with a lower tier of 10 million euros or 2 percent. Penalties under national ePrivacy rules vary by country.

Running one process that satisfies both

Koryo encodes this split in its sending gate: every message is checked against the recipient's country before it leaves, and the stricter regimes require a recorded basis rather than an unsubscribe link. The point is not the product, it is that the rule belongs in the send path rather than in a policy document nobody reads at 4pm on a Friday.

This page summarises what the FTC, the GDPR text and the ICO state; it is not legal advice. National rules differ, so take advice on your own campaigns.