What compliance differences apply for B2B outreach?

Short answer, there are fewer B2B carve-outs than most senders assume, and the ones that exist have very specific conditions attached. Here's what actually changes by jurisdiction.

CAN-SPAM (US). No B2B exemption. Accurate headers, clear sender identification, working unsubscribe within ten business days. The law doesn't care if the recipient is a consumer or a procurement director. Read the CAN-SPAM basics if you're unsure you're covered.

GDPR (EU/UK). Here the "B2B loophole" shows up. Senders can often rely on legitimate interest instead of explicit consent. But only if three conditions line up. The message is relevant to the recipient's actual professional role, you've done a balancing test and written it down, and the recipient can object with one click. Legitimate interest doesn't mean "do whatever you want because it's a work email." It means you documented why this message serves a shared business purpose.

CASL (Canada). Explicit or implied consent required. Implied consent forms when there's a recent business relationship (typically 24 months after a transaction, 6 months after an inquiry), or when the recipient has published their business email publicly without a "no solicitation" disclaimer. See CASL basics. The fines are brutal. Up to ten million dollars per violation for organizations.

What "genuinely relevant" looks like in practice. You can send deliverability product info to an Email Marketing Manager. You can't send it to the accounts payable clerk at the same company just because they share a domain. Document the logic inside your segmentation rules, not in a post-hoc memo written when a regulator asks.

What you need on every B2B send, regardless of jurisdiction.

• Identifiable physical address in the footer.
• Working unsubscribe on the first page you click, not behind a login.
• Honest subject lines and from-names.
• Consent or legal basis documented per contact.
• A clean list with no harvested or scraped addresses.

That last one matters more than people realize. Harvesting addresses from websites is explicitly prohibited under CAN-SPAM and is hard to defend under GDPR. Validate your B2B list before you send, with Review My Emails, so you know you're not mailing stale role addresses or scraped contacts. Compliance and list hygiene are the same problem from two angles.