Why cold email cannot be labelled legal in advance
A single campaign may fall under both advertising rules and personal-data rules. An invitation to buy, request a quote or book a meeting will usually have a promotional purpose. And a work address combined with a name and job title can identify a specific person, so it is not merely an anonymous company record.
A neutral subject line does not remove this risk. Calling a message a “business proposal” changes little if it promotes a service and the recipient asks where their data came from. If you cannot explain the basis for contact, the record of consent where required, and the removal route, the dispute is about missing controls rather than wording.
The line between a personal business contact and a general corporate inbox depends on the data and the circumstances. For uncertain segments, obtain a legal review before launch rather than relying on a sales-team assumption.
What a provider should be able to show before launch
Do not accept a general promise of compliance. Check the documents and operating process: who determines the purpose of processing, who acts on instructions, where recipient requests are recorded, and who is responsible for deletion. Align these points with your own privacy policy and contract documents.
| What to check | Sign of a working process | Red flag |
|---|---|---|
| Basis for contact | It is defined for each recipient category | A generic claim that the contact was publicly available |
| Do-not-contact requests | One exclusion list and a named owner | Opt-outs remain only in an individual manager’s inbox |
| Data transfer | Access, retention and deletion are defined | Lists are passed between contractors without rules |
| Outreach copy | Its promotional nature and claims have been reviewed | The email promises something that cannot be substantiated |
- Document the campaign purpose and recipient categories.
- Define the basis for processing each contact set.
- Agree how requests for deletion will be handled.
- Assign a client representative for disputed requests.
- Review the contract, processing instructions and CRM access.
How to review a list without creating a legal weakness
Start with a simple question: why is each record needed? A company name, a shared departmental inbox and a named employee’s contact details require different treatment. Do not combine them into one file and assume they are equally suitable for promotion. Review whether the role is current, whether the contact is relevant to the task and whether any additional data needs to be retained.
- Identify the data genuinely needed for the business contact.
- Separate shared corporate details from named employees’ data.
- Exclude people who have already asked not to be contacted.
- Set retention periods, access rights and deletion steps.
- Pass only a reviewed and documented list into the campaign.
A common mistake is adding new records to an old CRM export and sending the combined file to a provider without status markers. It may contain former employees, personal addresses or people who previously asked not to hear from you. List verification is not only about delivery: it also reduces the number of contacts that should not enter communication at all.
What must happen after a recipient opts out
An opt-out is not an objection to overcome. “Delete my address” or “do not contact me again” should trigger a short process: record the request, stop future touches, update exclusions across every relevant system and confirm the outcome where appropriate. Do not promise deletion while retaining the contact in a reserve spreadsheet for a later campaign.
For example, a director may reply that they are not interested. If a manager treats this as an ordinary no and does not record it, another colleague may send a new offer a month later. To the recipient, that is evidence of poor control, not two isolated emails. A sound process distinguishes an opt-out from silence and makes the status available to everyone handling replies, including a reply-handling team.
An unsubscribe link is useful, but it does not replace handling a free-form reply. The stop request must take effect regardless of how the recipient expresses it.
When cold outreach is not the right route
Do not build a cold campaign if the product needs extensive explanation before its value is clear, the offer targets a broad consumer audience, or your team cannot handle requests quickly and accurately. It is also a poor fit when the only plan is to send identical promotional copy to a large list and expect recipients to infer its relevance.
For complex B2B sales, first decide which companies genuinely fit your task and who inside them can appropriately receive the conversation. In focused cases, account-based marketing is a better fit: value comes from a reasoned selection of a limited account list, not contact volume.
OT9 does not replace legal advice with a generic checklist. In full-service outreach, we review the task, data boundaries, contact logic and opt-out handling; where legal risk is elevated, involve your specialist legal counsel before launch.