# B2B contact data compliance basics — Ravn

Canonical: https://askravn.com/blog/b2b-contact-data-compliance

Guide

# The rules for B2B contact data, in plain language.

Using business contact data is legal in most places, but each law sets conditions: honest emails with a working opt-out in the US, consent first in Canada, a lawful basis and transparency in Europe, and opt-out rights in California. Some uses, such as credit or employment decisions, are off limits for marketing data entirely.
By Ravn · 3 November 2026
[Start free: 1,000 lookups](https://askravn.com/#start) [Read the docs](https://askravn.com/docs)

Read this first
## Is this legal advice?
This is general information, not legal advice. Laws change and depend on your facts, so talk to a lawyer about your own situation.This guide is a map of the main rules people run into when they find, verify and contact business people. It explains what each law is for and what it usually asks of you, so you know which questions to ask.
United States
## What does CAN-SPAM require?
CAN-SPAM is the US federal law for commercial email. It does not require consent before the first message, but it sets rules for every message:
- Header and "from" information must be accurate.
- Subject lines must not be misleading.
- The message must be identifiable as an ad where it is one.
- It must include a valid physical postal address.
- It must offer a clear way to opt out, and you must honour opt-outs promptly and stop mailing that person.It applies to business-to-business email too. Using a contractor or tool to send does not move the responsibility off you.
Canada
## How is CASL different?
Canada's anti-spam law, CASL, is stricter. It generally requires consent before you send a commercial electronic message. Consent can be express (the person said yes) or implied in limited cases, such as an existing business relationship, or when someone has published their business address without saying they do not want messages and your message is relevant to their role. Implied consent has limits and can expire.Every message must identify the sender, give contact details, and include an unsubscribe mechanism. If you email people in Canada, plan for consent first.
Europe
## What does GDPR mean for B2B outreach?
The GDPR treats a named person's work email as personal data. To use it you need a lawful basis. For B2B marketing that is often legitimate interests, which requires a real balancing test: is the outreach relevant to the person's role, would they reasonably expect it, and have you minimised what you hold?Other duties come with it. When you get someone's data from a source other than them, you generally have to tell them where it came from and how you use it, usually in your first message or within a month. People can object to direct marketing at any time, and that objection is absolute. Separate e-privacy rules in many EU countries and the UK also govern electronic marketing, and some require consent even for business addresses.
California
## What do CCPA and CPRA add, and do they cover B2B data?
California's privacy law, the CCPA as amended by the CPRA, gives residents rights to know what personal information a business holds, to delete it, to correct it, and to opt out of its sale or sharing. Since the start of 2023, the temporary exemption for business-to-business contact data has ended, so these rights cover work contact details too.If you hold or pass on California residents' data and meet the law's thresholds, you need a privacy notice, a way to take requests, and a working "do not sell or share" opt-out. Other US states have passed similar laws with their own details.
Data brokers
## What are data brokers, and what is DROP?
A data broker is a business that collects and sells or licenses personal information about people it has no direct relationship with. Several states require brokers to register. California's Delete Act created DROP, the Delete Request and Opt-out Platform, where a resident can send one deletion request that registered brokers must process.When you buy or license contact data, ask your supplier how it handles opt-outs and deletions. Ravn stores no people data of its own and resells no one's records: people and company lookups run on your own data-provider account (such as People Data Labs), and Ravn makes the call without keeping the result. It still removes opted-out people and runs an [opt-out page](https://askravn.com/privacy#optout) that stores a one-way fingerprint so that person is never returned again. Because it holds no people data of its own, Ravn isn't a data broker and has nothing to register with California's DROP. It does not scrape LinkedIn. The [data page](https://askravn.com/data) has more on the model.
Off limits
## Which uses does the FCRA prohibit?
The Fair Credit Reporting Act governs "consumer reports": information used to decide whether someone gets credit, a job, insurance or housing. Data used for those decisions must come from a consumer reporting agency that follows strict accuracy, dispute and notice rules.Marketing contact data is not built for that, and using it that way can turn you, or your supplier, into a party to a consumer report without any of the safeguards. Ravn's [terms](https://askravn.com/terms) forbid FCRA uses outright: no screening for credit, employment, insurance or housing. They also forbid contacting opted-out people and reselling the data.
In practice
## What does a sensible compliance routine look like?

- Know where each contact came from, and keep that record.
- Decide your lawful basis per region before you send, and do not mail Canada or the EU on US rules.
- Keep messages honest, relevant to the person's job, and easy to opt out of.
- Keep one suppression list and check it before every send, across every tool.
- Verify addresses before sending so you are not mailing people who have left. See the [bounce rate guide](https://askravn.com/blog/email-bounce-rate-guide).
- Never use marketing data for eligibility decisions.The [compliance page](https://askravn.com/compliance) sets out how Ravn handles these rules on its side.
FAQ
## Common questions.
[All questions →](https://askravn.com/faq)Do I need consent to send a cold B2B email in the US?CAN-SPAM does not require prior consent, but every message must be honest, include a postal address and offer an opt-out that you honour. State laws and other countries can add more.Does the GDPR ban cold B2B email?Not outright. You need a lawful basis, often legitimate interests, plus transparency and an easy way to object. Some countries' e-privacy rules add consent requirements, so check where your recipients are.Are work email addresses covered by California privacy law?Yes. Since the B2B exemption ended at the start of 2023, California residents' work contact details carry the same rights to know, delete and opt out.Can I use contact data to screen job applicants or tenants?No. Decisions about credit, employment, insurance or housing fall under the FCRA and need a consumer reporting agency. Ravn's terms forbid these uses.How do I remove myself from Ravn's data?Use the opt-out page at /privacy#optout. Ravn stores a one-way fingerprint of your details so you are never returned again.

## More in [blog](https://askravn.com/blog)
Every page uses the same account, plan and tools. [See pricing →](https://askravn.com/pricing)
- [Connect Claude to contact data with MCPMCP lets Claude call outside tools.](https://askravn.com/blog/connect-claude-to-contact-data-mcp)
- [Email bounce rate: a practical guideWhat hard and soft bounces are, why they damage sender reputation, and a simple clean-before-send routine that keeps your bounce rate down..](https://askravn.com/blog/email-bounce-rate-guide)
- [Hashed email audiences explainedHow SHA-256 hashed customer lists work for Meta and Google, the normalisation rules, why hashing is not anonymisation, and how to build one locally..](https://askravn.com/blog/hashed-email-audiences-explained)
- [How email finders workEmail finders guess addresses from a name and company using known patterns like first.last, then verify each guess.](https://askravn.com/blog/how-email-finders-work)
- [How email verification worksEmail verification checks syntax, DNS and MX records, then asks the mail server about the mailbox without sending.](https://askravn.com/blog/how-email-verification-works)
- [What is a catch-all email domain?A catch-all domain accepts mail for any address, real or not, so no verifier can prove a mailbox exists there.](https://askravn.com/blog/what-is-a-catch-all-email-domain)