#147 · Generating 7 real leads for AI agency services in 2hrs of work
GDPR and similar rules are low risk for small‑scale cold email because you’re not sending tens of millions of emails like spammers; you’re delivering value. Treat compliance like a stop sign—follow it when practical, but don’t let it block you. You can also incorporate in the US or sell to non‑EU clients to avoid the issue.
There is a GDPR equivalent in basically every major country. In Canada it’s the Personal Information Protection and Electronic Documents Act (PIPEDA). It specifically covers email communications, and you need clear opt‑in mechanisms and proper consent. I’m not a lawyer, so this isn’t legal advice, but it’s the main privacy law you’d need to follow.
You have to work within the regulations. If you follow GDPR and telecom rules exactly, you won’t be able to send cold emails, so you need to use alternative, lawful channels. Some people set up shell companies to route communications, but that’s a gray area and I wouldn’t recommend it. In practice, just be reasonable, stick to the letter of the law, and look for other outreach methods that comply with EU rules.
Yes, targeting U.S. companies is a solid tactical move if you want to avoid German restrictions. The idea that cold email is 'not allowed' in Europe is often overstated; it’s really a risk‑reward imbalance, not a hard ban—similar to jaywalking being illegal but still safe when no cars are around. You can also set up a U.S. entity and operate from there to minimize risk. All these tactics avoid the underlying risk‑reward misbalance, but they aren’t legal advice.
How do you handle cold email in the EU? It's really not all that difficult. One, and I'm not a lawyer and none of this is legal advice, but when's the last time you jaywalked? Congratulations, you have essentially contravened a law or a rule or a regulation. Cold email is a lot like jaywalking. If you're good at what you do, if you look left and look right and there's no cars oncoming, nobody's really going to care. These laws are also written in such a vague way that if you take their definitions at their vaguest, you're basically always going to be at the behest or at the whims of the legislators. And so if you send really high-quality customized cold emails that provide value to the people reading them, and they don't come across as spam and don't seem like a big issue, you're almost certainly going to be fine. And what's interesting is Germany, Spain, a lot of these other EU countries are starved for cold email right now. If you take the same campaign you're running in the United States, then localize it a little bit — the language is quite similar, but still respect cultural norms of deference and so on — and then run it in Germany, you'll get like a four to five x reply rate. Same thing in Spain, same thing in the Netherlands. These are all places where people are starved for this sort of outreach, and they want to connect and grow their businesses and network. They just don't currently have a way to, because regulation has a stranglehold on a lot of what previously would have been serendipitous. It's unfortunate that the EU has strangleholded people to that degree, but they definitely have. People now are so afraid to even send an email to somebody that they don't know, because they think SWAT teams are going to break in through their windows and get on the floor — 'this is the guy that sent the cold email, loser, I hate people like you.' Obviously that's ridiculous.