The rules for B2B contact data, in plain language.

This is general information, not legal advice. Laws change and depend on your facts, so talk to a lawyer about your own situation.

This guide is a map of the main rules people run into when they find, verify and contact business people. It explains what each law is for and what it usually asks of you, so you know which questions to ask.

CAN-SPAM is the US federal law for commercial email. It does not require consent before the first message, but it sets rules for every message:

• Header and "from" information must be accurate.
• Subject lines must not be misleading.
• The message must be identifiable as an ad where it is one.
• It must include a valid physical postal address.
• It must offer a clear way to opt out, and you must honour opt-outs promptly and stop mailing that person.

It applies to business-to-business email too. Using a contractor or tool to send does not move the responsibility off you.

Canada's anti-spam law, CASL, is stricter. It generally requires consent before you send a commercial electronic message. Consent can be express (the person said yes) or implied in limited cases, such as an existing business relationship, or when someone has published their business address without saying they do not want messages and your message is relevant to their role. Implied consent has limits and can expire.

Every message must identify the sender, give contact details, and include an unsubscribe mechanism. If you email people in Canada, plan for consent first.

The GDPR treats a named person's work email as personal data. To use it you need a lawful basis. For B2B marketing that is often legitimate interests, which requires a real balancing test: is the outreach relevant to the person's role, would they reasonably expect it, and have you minimised what you hold?

Other duties come with it. When you get someone's data from a source other than them, you generally have to tell them where it came from and how you use it, usually in your first message or within a month. People can object to direct marketing at any time, and that objection is absolute. Separate e-privacy rules in many EU countries and the UK also govern electronic marketing, and some require consent even for business addresses.

California's privacy law, the CCPA as amended by the CPRA, gives residents rights to know what personal information a business holds, to delete it, to correct it, and to opt out of its sale or sharing. Since the start of 2023, the temporary exemption for business-to-business contact data has ended, so these rights cover work contact details too.

If you hold or pass on California residents' data and meet the law's thresholds, you need a privacy notice, a way to take requests, and a working "do not sell or share" opt-out. Other US states have passed similar laws with their own details.

A data broker is a business that collects and sells or licenses personal information about people it has no direct relationship with. Several states require brokers to register. California's Delete Act created DROP, the Delete Request and Opt-out Platform, where a resident can send one deletion request that registered brokers must process.

When you buy or license contact data, ask your supplier how it handles opt-outs and deletions. Ravn stores no people data of its own and resells no one's records: people and company lookups run on your own data-provider account (such as People Data Labs), and Ravn makes the call without keeping the result. It still removes opted-out people and runs an opt-out page that stores a one-way fingerprint so that person is never returned again. Because it holds no people data of its own, Ravn isn't a data broker and has nothing to register with California's DROP. It does not scrape LinkedIn. The data page has more on the model.

The Fair Credit Reporting Act governs "consumer reports": information used to decide whether someone gets credit, a job, insurance or housing. Data used for those decisions must come from a consumer reporting agency that follows strict accuracy, dispute and notice rules.

Marketing contact data is not built for that, and using it that way can turn you, or your supplier, into a party to a consumer report without any of the safeguards. Ravn's terms forbid FCRA uses outright: no screening for credit, employment, insurance or housing. They also forbid contacting opted-out people and reselling the data.

• Know where each contact came from, and keep that record.
• Decide your lawful basis per region before you send, and do not mail Canada or the EU on US rules.
• Keep messages honest, relevant to the person's job, and easy to opt out of.
• Keep one suppression list and check it before every send, across every tool.
• Verify addresses before sending so you are not mailing people who have left. See the bounce rate guide.
• Never use marketing data for eligibility decisions.

The compliance page sets out how Ravn handles these rules on its side.