Key takeaways
- How you contact people matters more than buying the data.
- Email, calls and texts each have their own rules.
How do you stay within the rules?
- Know where people are. The rules follow the recipient's location.
- Pick the channel. In the US, one-to-one emails and calls dialed by hand to business contacts carry the least risk.
- Keep a suppression list. Record every opt-out and never contact that person again.
- Ask your provider. Where the data comes from and how people opt out.
| Region | Main rules | In short |
|---|---|---|
| United States | CAN-SPAM, TCPA, state privacy laws | Opt-out for email, consent for automated calls and texts |
| EU and UK | GDPR, ePrivacy rules | Needs a lawful basis |
| Canada | CASL | Consent-based, narrow exceptions |
What does US law require?
For email, CAN-SPAM requires honest sender details, a subject line that does not mislead, a postal address and a working opt-out you honor promptly. Source: FTC For phones, the TCPA limits automated and recorded calls and texts to mobiles without consent, and do-not-call rules cover marketing texts too. Source: 47 CFR 64.1200 State privacy laws, such as California's, let people opt out of the sale of their information. This is general information, not legal advice.
Sources
Checked October 9, 2026. Rules change, so read the source before you rely on it. This is general information, not legal advice.
