Legal Compliance & Service Packaging

CAN-SPAM (United States)

The US operates on an opt-out model. You can email someone without prior permission, but you must follow specific rules and honor opt-out requests immediately.

Requirements

• Real sender name. The "From" field must accurately identify the person or business sending the email.
• Physical mailing address. Every email must include a valid physical postal address. A PO Box or registered agent address works.
• Unsubscribe mechanism. Every email must include a clear, conspicuous way to opt out. You must process opt-outs within 10 business days.
• Honest subject lines. Subject lines cannot be deceptive or misleading about the content of the email.
• Identify as an ad. If your email is primarily commercial, it must be identifiable as such (though B2B outreach with genuine relevance typically satisfies this).

GDPR (European Union)

GDPR is stricter than CAN-SPAM but does provide a pathway for B2B cold outbound through Legitimate Interest under Article 6(1)(f). This is not a blanket permission -- it requires a documented balancing test.

Requirements for Legitimate Interest

• Legitimate Interest Assessment (LIA). Document why your outreach serves a legitimate business purpose, why the recipient would reasonably expect it, and how the recipient's rights are protected.
• Professional emails only. Only contact people at their business email addresses. Never use personal email addresses for B2B outreach in the EU.
• Relevant content. Your email must be relevant to the recipient's professional role. Blanket mass emails to random contacts will not hold up.
• Disclose data source. If asked, you must be able to explain where you obtained the recipient's email address.
• Easy opt-out. Provide a simple, immediate way to unsubscribe, and honor it without delay.

CASL (Canada)

Canada's Anti-Spam Legislation is the strictest of the three. It requires express consent before sending commercial electronic messages, with very limited exceptions for implied consent.

Key Points

• Express consent required. Unlike CAN-SPAM, you generally cannot send unsolicited commercial email to Canadian recipients without prior consent.
• Implied consent is narrow. It exists for existing business relationships (within 2 years of a purchase, or 6 months of an inquiry), but cold outreach to strangers typically does not qualify.
• Penalties up to $10 million. Per violation for businesses, $1 million for individuals.
• Private right of action. Recipients can sue senders directly.

Universal Compliance Footer

Include a version of this footer in every cold email. It covers CAN-SPAM requirements and demonstrates good faith for GDPR Legitimate Interest.

{{sender_first_name}} {{sender_last_name}}
{{sender_title}}, {{sender_company}}
{{sender_physical_address}}

You're receiving this because of your role as {{prospect_title}} at {{prospect_company}}.
Not relevant? Reply "unsubscribe" and I'll remove you immediately.

Key elements: real sender identity, physical address, reason for contact (data source disclosure), and a frictionless opt-out. Keep it brief -- a long legal footer undermines the personal tone of your email.

Packaging as a Service

Once the system is built and proven, you can sell it as a managed service. Here are the four most common pricing models in the market.

Service Pricing Models

Internal Economics

Understanding your margins is critical for sustainable pricing.

Client Onboarding

A repeatable onboarding process is what separates an agency from a freelancer. Every new client follows the same path from signed contract to full launch.

The DevOps Agency Differentiator