# Prospecting Compliance Reference The legal and platform-ToS constraints that apply to prospect list building. Read first, every engagement. > Operational guidance, not legal advice. For high-volume programs or programs touching EU/UK residents, run your setup past a privacy attorney. --- ## United States — CAN-SPAM (downstream) CAN-SPAM regulates the cold email **send**, not the list build. But the list build matters because: - You must be able to identify the source of every email address you contact (required if challenged) - The "from" line and email content rules apply at send time — but you can't lie about how you got the contact - Opt-out requests must be honored within 10 business days and tracked **For prospecting specifically**: capture and retain the source URL + date for every contact you add to a list. CAN-SPAM doesn't require it explicitly, but defending your sender practices does. --- ## EU / UK — GDPR The strictest applicable framework. Triggers when: - Your prospect resides in EU/UK - You're processing personal data (any identifiable info, including business emails tied to a named person) ### Lawful bases for cold B2B outreach You have three credible options: 1. **Legitimate interest** (most common for B2B). Requires: - The contact is in a business role likely to be interested in your offer - The data was collected from a public, business-context source - You provide a clear opt-out - You can articulate the legitimate interest test in writing 2. **Consent** — typically not feasible for cold outreach (you don't have consent before first contact) 3. **Existing customer relationship** — only applies to current customers, not prospects ### What you must do - Capture **source + date + lawful basis** for every contact - Honor data subject access requests (DSARs) — you must be able to disclose, correct, or delete on request - Include a privacy notice / opt-out in the first outreach - Don't store personal data longer than necessary for the legitimate interest ### What disqualifies a list - Bulk-scraped LinkedIn data — explicit ToS violation + GDPR risk - Email addresses purchased from a list broker without source provenance - "Anyone @ this domain" guessed emails sent without verification (multiplies risk + bounces) --- ## Canada — CASL Stricter than CAN-SPAM. Cold B2B outreach requires: - **Express consent** (explicit opt-in) — typically not present for cold prospecting - **OR implied consent** — existing business relationship within 24 months, OR business address publicly published on the company's own site for the purpose of receiving such communications **Practical implication for Canadian prospects**: relying on the publicly-published-address exception is the most defensible cold prospecting basis in Canada. You must include sender identification, mailing address, and an unsubscribe mechanism in every message. --- ## Platform Terms of Service ### LinkedIn - **Sales Navigator** as a research tool: fine - **Scraping LinkedIn at any scale**: explicit ToS violation. Banned accounts are permanent. Don't. - **Apollo, Clay, and ZoomInfo** claim LinkedIn-overlap data through various legitimate channels — verify their data sources before assuming compliance - **InMail and Connection Requests**: governed by LinkedIn's own messaging rules, not by CAN-SPAM/GDPR (because LinkedIn-internal) ### Google Maps - ToS prohibits bulk extraction or productizing Maps data - Browser-assisted research as a discovery aid: acceptable - Storing Place IDs or large structured Maps data in your CRM: explicit ToS prohibition - Use Maps to **find** local businesses, then cross-source from the business's own site for the data you retain ### Apollo / ZoomInfo / Clearbit - All have their own ToS limiting reselling, downstream sharing, and use cases - Read your contract — typically you can use the data for your own outreach but not productize it - Don't share extracts publicly (e.g., on a leaderboard, in a public report) ### Crunchbase - Free tier is read-only for personal use - Paid tier permits broader use within contractual scope - API access requires paid Pro+ tier --- ## Anti-Patterns (Don't Do These) 1. **Bulk-scraping LinkedIn / Google Maps / Yelp**. Browser-assisted research is OK; automated scrapers pointed at these platforms are not. **Firecrawl and Browserbase are fine for an individual prospect's own website** (the URL you found through manual discovery) — not for the platforms hosting prospects. 2. **Buying lists from random vendors** without source provenance. You inherit their legal exposure. 3. **Guessing emails and sending unverified**. Bounce rates over 2% destroy sender reputation; legally, you can't claim a "legitimate interest" basis for an email you fabricated. 4. **Harvesting personal email addresses** (Gmail, personal Outlook, etc.) from public profiles. Personal addresses raise GDPR risk significantly. 5. **Storing data you don't need**. Minimize retention. Don't keep prospect lists forever — GDPR right to deletion applies. 6. **Skipping the lawful basis documentation**. If challenged, you need to show your work. Capture source URL + collection date for every contact. 7. **Reselling prospect lists**. You may not have the right to share them downstream. Read your data provider contracts. 8. **CAPTCHA bypass / login wall bypass**. Even if technically possible, this signals bot behavior and violates virtually every ToS. --- ## Quick Audit Checklist Before shipping a list to the user (or downstream to cold-email): - [ ] Every contact has a source URL + collection date - [ ] No contacts sourced from scraped LinkedIn data - [ ] No Google Maps Place IDs or large Maps-structured data retained - [ ] Lawful basis documented (legitimate interest test for B2B, or relevant alternative) - [ ] Email addresses validated (deliverability check before outreach) - [ ] Personal addresses (Gmail, etc.) flagged or excluded - [ ] Source provider contracts permit the intended use case - [ ] Retention plan documented (when to delete) - [ ] First outreach will include unsubscribe + privacy notice (downstream concern for cold-email skill, but mention it now)