Invental · Cold Email

European Cold Email Compliance Checklist

Not legal advice — we run outbound, we're not lawyers. This is what regulators say and what careful operators do, current as of July 2026. Most of it is four lines in a footer and one table. Work through it before your next campaign into Europe.

01 · Know which rule applies

GDPR decides if you may hold the data. National law decides if you may send.

List the countries you are sending into. The rule comes from national law, not one EU standard. Flag the strict ones. Germany, Italy, Spain and Austria require consent, with no real B2B exception. Decide: segment by country, or work to the strictest in your footprint. Both are valid. Drifting between them isn't. For the UK: screen out sole traders and ordinary partnerships. The corporate-subscriber exemption silently doesn't cover them.

02 · The first email footer

Four lines. This is the cheapest fix on the list and the most commonly skipped.

Your real identity and legal entity. No disguised or concealed sender. Why this person is being contacted. One line, specific to their role. Where you got their details. The part almost everyone omits — and it is required when the data didn't come from them. A link to a full privacy notice. Purposes, basis, retention, rights, right to object. A working way to stop. No street address needed in Europe, unlike the US.

03 · Suppression that survives everything

The easiest breach to commit and the easiest for a complainant to prove.

Objections suppress, never delete. Delete someone and they return with the next list you buy. Screening runs at send time, not just at import. Lists get re-enriched between campaigns. Suppression survives list purchases, tool migrations and client offboarding. No win-back email to anyone who objected. That message is itself a breach. Objections propagate across every channel and sequence, same day. Mailbox providers expect two days; aim for same-day and automate it.

04 · Data supplier questions

You are responsible for your own sending, whatever the vendor promised.

Where did each record come from — scraped, licensed, self-declared, inferred? Field level, not list level. When was it collected, and when last verified? If consent is claimed: were we named? Does it cover email? Can you show the record? "Our trusted partners" is not valid consent for you. Contract, warranties on lawful sourcing, and an audit right. "Publicly available" is not a lawful basis. Scrapability and permission are different things.

05 · Paperwork you should be able to produce

An afternoon of work. Worth far more than it costs if anyone ever asks.

A legitimate interests assessment, dated before the campaign started. Regulators publish templates. The privacy notice as served, with version history. Per-record provenance: source and acquisition date. Opt-out logs with timestamps — received and actioned. Contracts with the sending platform, any agency, and every data vendor.

06 · The constraint that actually bites

Regulators are slow and rare. Mailbox providers are fast and certain.

One-click unsubscribe headers on, plus a visible link in the body. Both, not either. Spam complaint rate under 0.10%. 0.30% is the ceiling; 0.10% gives you room. SPF, DKIM and DMARC aligned. Reply-based opt-outs honoured too — but never as the only route. Invisible to mailbox providers, and manual. Remember open-tracking pixels sit under the cookie rules. The B2B exemption gives you nothing there.

Where to start

If you only do three things: put the four lines in the first email, make suppression survive your next data purchase, and write the legitimate interests assessment before the campaign, not after the complaint. Those three hold up whichever national rule applies to you.

Don't want to research, write and follow up on every prospect yourself? That's the part we run for you.

Request a custom outbound plan ↗