The day you hit "send," the rules apply to you
Most small teams discover email compliance the uncomfortable way: a customer replies "take me off this list" and nothing happens, or a contact in the EU asks what data you hold and you realize you have no idea, or you read about a five-figure fine and wonder if your last campaign exposed you. The truth nobody mentions when you set up a CRM is that the instant it sends commercial email at any scale, you've taken on legal obligations — and ignorance isn't a defense. The good news: the actual rules are far simpler than the anxiety around them, and once you build them into how the CRM works, compliance stops being a thing you worry about and becomes a thing that just happens.
This isn't legal advice, and a real lawyer should bless your specifics — but you can't even ask the right questions without understanding the three regimes that catch most small teams: the US CAN-SPAM Act, the EU's GDPR, and Canada's CASL. They differ in one crucial way, and that difference drives everything else you do.
The one distinction that explains everything: consent vs. opt-out
The single idea that organizes all of email compliance is whether the law assumes you may email someone until they say stop, or assumes you may not until they say go.
The US CAN-SPAM Act is an opt-out regime. You're generally allowed to send commercial email to someone without prior permission, as long as you honor the rules: don't lie in the header or subject line, identify the message as an ad where relevant, include a real physical postal address, and give a clear, working unsubscribe that you process promptly (the law says within ten business days, but same-day is the only standard worth holding yourself to). Opt-out is permissive — but "permissive" is not "do whatever you want," and the unsubscribe obligation is absolute.
GDPR (EU) and CASL (Canada) are opt-in regimes, and they flip the default. Under them you generally need a lawful basis — usually the person's prior consent — before you send marketing email, and under GDPR that contact's data carries rights: to see what you hold, to correct it, and to have it deleted. CASL is stricter still on consent and carries genuinely steep penalties. The practical upshot for a small team selling internationally: the moment your list includes EU or Canadian contacts, the permissive US default no longer protects you, and you have to know how each contact got onto your list.
That "how did they get here" question is the one that quietly decides whether you're compliant — and it's exactly the kind of thing a CRM is built to remember.
Consent is data you should be capturing on the contact
If consent is the hinge for half the world's contacts, then consent has to be recorded data, not a vibe. For every contact you intend to market to, you want to know — and store — how they came to be on your list: did they fill in a form, check a box, buy something, hand you a card at a trade show, or did you scrape them from somewhere? That provenance is the difference between a defensible list and a liability.
This is really a data-hygiene problem wearing a legal hat. The same discipline that keeps your records clean — capturing the source of every contact, tagging where they came from — is what lets you answer a regulator's or a contact's question with a straight face. When someone who filled in your web form is tagged differently from someone you met at an event, you can segment your sends by consent status and simply not email the contacts you don't have a basis to email. Compliance becomes a segmentation decision instead of a leap of faith.
Unsubscribe is not optional, and "honored" means actually honored
Across every regime, the one rule with no exceptions is this: when someone opts out, you stop — quickly, completely, and permanently. The most common and most embarrassing violation isn't malice; it's a broken process. The unsubscribe link works, but the contact's status never actually changes, so they get the next campaign anyway and now you've turned an annoyed reader into someone with a genuine complaint.
The fix is to make unsubscribe a hard, automatic state on the contact — not a manual cleanup someone is supposed to remember after each send. When a contact opts out, that status should immediately and permanently exclude them from every future campaign and sequence, with no human in the loop to forget. This is the same relationship-respecting instinct that makes good nurturing work in the first place: emailing someone who asked you to stop doesn't just risk a fine, it incinerates trust — and it tanks your deliverability, because spam complaints are the fastest way to land your domain in the junk folder for everyone else too.
Compliance and deliverability are the same discipline
It's worth noticing that almost everything the law requires, your deliverability also rewards. Honoring unsubscribes promptly keeps complaint rates low, which keeps you out of spam folders. Only emailing people who consented means you're sending to an engaged audience, which lifts open rates, which signals to inbox providers that your mail is wanted. A clean, permission-based list is simultaneously the compliant list and the high-performing one. The teams that treat compliance as a tax to minimize tend to also have terrible deliverability; the teams that treat it as list hygiene tend to land in the inbox. Same behaviors, two payoffs.
Build the rules into the workflow, not your memory
The reason compliance feels stressful is that, done manually, it depends on a person remembering five different rules at the moment of every send — and people forget. The reason a CRM helps is that it can make the safe path the default path.
In Hitt CRM, every contact's source and tags live on the record, so you can build a segment of only the contacts you have a basis to email and send to that — instead of blasting the whole database and hoping. Unsubscribe is a built-in, one-click action that permanently suppresses a contact from campaigns and automated sequences alike, so an opt-out is honored the instant it happens without anyone remembering to clean up. And because every send and every opt-out is logged on the contact timeline, you have the audit trail that answers "did this person consent, and did we honor their choice?" — the question that turns a scary compliance request into a thirty-second lookup. Pair that with the right metrics on complaint and unsubscribe rates, and you'll see compliance problems as deliverability problems before they ever become legal ones.
The one-sentence version
The moment your CRM sends commercial email you're bound by CAN-SPAM's opt-out rules and, for any EU or Canadian contact, GDPR and CASL's stricter opt-in-and-consent rules, so the durable fix is to treat consent and contact-source as recorded data you segment by, make unsubscribe an automatic permanent suppression no human can forget, and run every send through a CRM that keeps the audit trail — which, conveniently, is the exact same discipline that keeps you out of the spam folder.