prospecting · compliance

Prospecting Compliance Reference

The legal and platform-ToS constraints that apply to prospect list building. Read first, every engagement.

Operational guidance, not legal advice. For high-volume programs or programs touching EU/UK residents, run your setup past a privacy attorney.

United States — CAN-SPAM (downstream)

CAN-SPAM regulates the cold email send, not the list build. But the list build matters because:

You must be able to identify the source of every email address you contact (required if challenged)
The "from" line and email content rules apply at send time — but you can't lie about how you got the contact
Opt-out requests must be honored within 10 business days and tracked

For prospecting specifically: capture and retain the source URL + date for every contact you add to a list. CAN-SPAM doesn't require it explicitly, but defending your sender practices does.

EU / UK — GDPR

The strictest applicable framework. Triggers when:

Your prospect resides in EU/UK
You're processing personal data (any identifiable info, including business emails tied to a named person)

Lawful bases for cold B2B outreach

You have three credible options:

Legitimate interest (most common for B2B). Requires:
- The contact is in a business role likely to be interested in your offer
- The data was collected from a public, business-context source
- You provide a clear opt-out
- You can articulate the legitimate interest test in writing
Consent — typically not feasible for cold outreach (you don't have consent before first contact)
Existing customer relationship — only applies to current customers, not prospects

What you must do

Capture source + date + lawful basis for every contact
Honor data subject access requests (DSARs) — you must be able to disclose, correct, or delete on request
Include a privacy notice / opt-out in the first outreach
Don't store personal data longer than necessary for the legitimate interest

What disqualifies a list

Bulk-scraped LinkedIn data — explicit ToS violation + GDPR risk
Email addresses purchased from a list broker without source provenance
"Anyone @ this domain" guessed emails sent without verification (multiplies risk + bounces)

Canada — CASL

Stricter than CAN-SPAM. Cold B2B outreach requires:

Express consent (explicit opt-in) — typically not present for cold prospecting
OR implied consent — existing business relationship within 24 months, OR business address publicly published on the company's own site for the purpose of receiving such communications

Practical implication for Canadian prospects: relying on the publicly-published-address exception is the most defensible cold prospecting basis in Canada. You must include sender identification, mailing address, and an unsubscribe mechanism in every message.

Platform Terms of Service

Sales Navigator as a research tool: fine
Scraping LinkedIn at any scale: explicit ToS violation. Banned accounts are permanent. Don't.
Apollo, Clay, and ZoomInfo claim LinkedIn-overlap data through various legitimate channels — verify their data sources before assuming compliance
InMail and Connection Requests: governed by LinkedIn's own messaging rules, not by CAN-SPAM/GDPR (because LinkedIn-internal)

Google Maps

ToS prohibits bulk extraction or productizing Maps data
Browser-assisted research as a discovery aid: acceptable
Storing Place IDs or large structured Maps data in your CRM: explicit ToS prohibition
Use Maps to find local businesses, then cross-source from the business's own site for the data you retain

Apollo / ZoomInfo / Clearbit

All have their own ToS limiting reselling, downstream sharing, and use cases
Read your contract — typically you can use the data for your own outreach but not productize it
Don't share extracts publicly (e.g., on a leaderboard, in a public report)

Crunchbase

Free tier is read-only for personal use
Paid tier permits broader use within contractual scope
API access requires paid Pro+ tier

Anti-Patterns (Don't Do These)

Bulk-scraping LinkedIn / Google Maps / Yelp. Browser-assisted research is OK; automated scrapers pointed at these platforms are not. Firecrawl and Browserbase are fine for an individual prospect's own website (the URL you found through manual discovery) — not for the platforms hosting prospects.
Buying lists from random vendors without source provenance. You inherit their legal exposure.
Guessing emails and sending unverified. Bounce rates over 2% destroy sender reputation; legally, you can't claim a "legitimate interest" basis for an email you fabricated.
Harvesting personal email addresses (Gmail, personal Outlook, etc.) from public profiles. Personal addresses raise GDPR risk significantly.
Storing data you don't need. Minimize retention. Don't keep prospect lists forever — GDPR right to deletion applies.
Skipping the lawful basis documentation. If challenged, you need to show your work. Capture source URL + collection date for every contact.
Reselling prospect lists. You may not have the right to share them downstream. Read your data provider contracts.
CAPTCHA bypass / login wall bypass. Even if technically possible, this signals bot behavior and violates virtually every ToS.

Quick Audit Checklist

Before shipping a list to the user (or downstream to cold-email):

Every contact has a source URL + collection date
No contacts sourced from scraped LinkedIn data
No Google Maps Place IDs or large Maps-structured data retained
Lawful basis documented (legitimate interest test for B2B, or relevant alternative)
Email addresses validated (deliverability check before outreach)
Personal addresses (Gmail, etc.) flagged or excluded
Source provider contracts permit the intended use case
Retention plan documented (when to delete)
First outreach will include unsubscribe + privacy notice (downstream concern for cold-email skill, but mention it now)