The complete guide to outbound in 2026

This guide is for founders, sales leaders and RevOps people building or rebuilding outbound at a B2B company. It assumes you sell to businesses, your deal is large enough to justify one-to-one prospecting, and you are deciding what to buy, who to hire and how much to send.

After reading it you should be able to decide which accounts deserve outreach, how to set up sending so email reaches the inbox, which channels and tools to combine, and which numbers tell you it is working. It also compares the US, UK, EU and Canadian rules for cold B2B messages. That part explains the rules. It is not legal advice.

It is not for teams selling low-priced products to consumers, or for anyone hoping to buy a list of a million contacts and blast it. The rules described below were written to stop exactly that.

Summary

• Mailbox providers now enforce authentication (SPF, DKIM, DMARC), one-click unsubscribe and spam-rate limits. Deliverability is the first constraint, not the last.
• A narrow ICP and a short list of accounts with a reason to buy outperform a broad list with clever copy.
• No single data vendor covers everyone. Waterfall enrichment plus verification is the practical default.
• Mixing email, LinkedIn and phone helps, but each channel has its own rules and risks.
• AI is good at research and first drafts. It scales mistakes as fast as it scales output.
• CAN-SPAM is opt-out based, Canada’s CASL is consent-based, and the UK and EU sit in between.
• Measure positive replies and meetings, not opens.

1. What outbound means in 2026

Outbound is any sales motion where you contact a prospect before they have raised their hand. Inbound is the reverse: the prospect fills in a form or signs up for a trial. Outbound matters most when your market is small and well defined, your deal size is large, or buyers do not yet search for your category.

The work splits into five jobs: targeting (which companies and people), data (accurate contact details and context), infrastructure (domains, inboxes, authentication), sequencing (the touches across channels and the words in them) and measurement. The first three have become technical enough that many teams now split them from the selling work, which chapter 7 covers.

The biggest change is at the infrastructure layer. In February 2024, Google and Yahoo began enforcing new requirements for bulk senders, and Google says it is ramping up enforcement on non-compliant traffic from November 2025, including temporary and permanent rejections.¹1 Source: Google Workspace Admin Help, “Email sender guidelines”, accessed Oct 2026. ²2 Source: Google Workspace Admin Help, “Email sender guidelines FAQ”, accessed Oct 2026. Microsoft announced similar requirements for Outlook consumer addresses in 2025.³3 Source: Microsoft Tech Community, “Strengthening Email Security: Outlook’s New Requirements for High-Volume Senders”, accessed Oct 2026. Microsoft later updated the action taken on non-compliant mail; check the post for current status. Practices that used to cost you some replies can now cost you the domain.

At 0.3%, three spam complaints per thousand emails puts you over the line. That fact should shape every decision that follows: who you email, how many, and what you say.

Inbound is changing too: more buyers start with an AI assistant, which our guide to AI search visibility covers.

2. ICP and account selection

Define the ICP in filterable terms

An ICP (ideal customer profile) describes the type of company most likely to buy, succeed and stay. A useful one is written in terms a database can filter on. “Innovative mid-market companies” is not filterable. “US and Canadian B2B software companies with 50 to 500 employees, using Salesforce, with an open RevOps role” is.

Build it from firmographics (industry, headcount, location, funding stage), technographics (the tools a company uses), situation (hiring, new leadership, expansion) and exclusions (customers, open deals, competitors, partners, and anyone who has opted out). Start from your best closed-won deals rather than a whiteboard.

Tier the accounts

Not every account deserves the same effort. Tier 1 is a short list of high-value accounts that get manual research and several contacts per company. Tier 2 fits well and shows a signal, so it gets templated research. Tier 3 fits on paper with no current signal, and it should be monitored, not emailed, until a signal appears. Tier 3 is where most wasted volume and most spam complaints come from.

Signals and intent data

A signal is an observable event that suggests an account may be ready to talk. First-party signals come from your own systems: website visits, sign-ups, past opportunities. Third-party signals include job changes, funding rounds, hiring patterns and topic research.

Intent data is the topic-research category. Bombora says its Company Surge product “continuously monitors company research activity against 25,300+ topics” and compares the last three weeks with a 12-week baseline.⁵5 Source: Bombora, “Intent”, accessed Oct 2026. Topic count as stated by the company. It is useful for ranking accounts you already want. It cannot tell you which person to email, and a surge can come from a consultant or a competitor.

A practical rule: use the ICP to decide whether to contact an account, and signals to decide when and what to open with.

3. Data sources, enrichment and verification

Where contact data comes from

Contact data comes from large B2B databases such as ZoomInfo and Apollo, from specialist providers (mobile numbers, a region, a niche), and from professional networks, mainly LinkedIn Sales Navigator, which you can search but not scrape.

Pricing models differ. ZoomInfo does not publish list prices; its pricing page says packages depend on the number of licenses and level of data access, with each profile export costing one credit.⁶6 Source: ZoomInfo, “Pricing”, accessed Oct 2026. Apollo’s pricing page did not show per-seat prices in October 2026 and says team credits are pooled and expire if unused.⁷7 Source: Apollo.io, “Pricing”, accessed Oct 2026. LinkedIn lists Sales Navigator Core at US$119.99 per license per month on monthly billing, as of October 2026.⁸8 Source: LinkedIn Sales Solutions, “Compare plans”, accessed Oct 2026. List prices as of October 2026, may exclude taxes.

Waterfall enrichment

Enrichment adds missing fields (email, phone, title, company data) to a record. Waterfall enrichment queries several providers in sequence: if the first cannot find a verified email, the record goes to the second, and so on. Coverage rises because each vendor has different gaps.

Clay is the best-known tool built around this pattern. Its pricing page lists multi-provider waterfalls on every plan, including Free, and says it draws on more than 150 providers.⁹9 Source: Clay, “Pricing”, accessed Oct 2026. List prices as of October 2026. The trade-off is cost. Order providers by cost and hit rate for your segment, and stop as soon as a verified result comes back.

Verification

Verify every address before it enters a sequence. Verification services check whether a mailbox exists without sending a message. ZeroBounce, for example, returns statuses including valid, invalid, catch-all, unknown, spamtrap, abuse and do-not-mail.¹⁰10 Source: ZeroBounce, “Status Codes (v2)”, accessed Oct 2026. Two need care. Catch-all domains accept mail for any address, so ZeroBounce calls them “impossible to validate without sending a real email” and suggests segmenting them. Unknowns are checks that could not complete, and ZeroBounce says about 80% of them turn out to be invalid.¹⁰

Send to valid addresses, send catch-alls in small separate batches if at all, and drop unknowns and traps. Bounces hurt sender reputation, and a high bounce rate usually means the rest of the record is stale too.

Enrichment only pays off if the CRM it lands in has clear field ownership. The complete guide to building a B2B revenue stack covers sync rules and data hygiene.

4. Deliverability: the rules mailbox providers enforce

Deliverability is the share of your email that reaches the inbox rather than spam or a rejection. It depends on authentication, reputation and recipient behavior.

Authentication: SPF, DKIM and DMARC

• SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send for your domain.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature proving the message came from your domain unaltered.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when checks fail, and requires the visible From: domain to align with the authenticated one.

Google requires senders of 5,000 or more messages a day to use SPF, DKIM and DMARC. A DMARC policy of none is acceptable, DKIM keys must be at least 1024 bits (2048 recommended), and the From: domain must align with the SPF or DKIM domain. Google also requires valid forward and reverse DNS for sending IPs, TLS, and RFC 5322 formatting.¹ Yahoo requires bulk senders to use both SPF and DKIM and a passing DMARC policy of at least p=none.⁴ Microsoft announced in 2025 that domains sending more than 5,000 emails a day to Outlook consumer addresses must pass SPF and DKIM and publish DMARC of at least p=none, starting May 5, 2025.³

Who counts as a bulk sender

Google defines a bulk sender as one sending close to 5,000 or more messages to personal Gmail accounts within 24 hours, counting all mail from the same primary domain, and the status never expires.² Most cold B2B email goes to company domains, so many outbound teams never formally cross that line. Treat the bulk rules as the minimum anyway. They describe what providers consider trustworthy mail.

Unsubscribe and spam rate

Google requires bulk senders’ marketing messages to support one-click unsubscribe through the List-Unsubscribe and List-Unsubscribe-Post headers, plus a visible link in the body.¹ The mechanism is defined in RFC 8058.¹¹11 Source: RFC Editor, “RFC 8058: Signaling One-Click Functionality for List Email Headers”, accessed Oct 2026. Google says to honor requests within 48 hours; Yahoo says within 2 days.²⁴ Whether a one-to-one sales email counts as marketing is not spelled out, and Google says recipients determine the nature of the messages they receive.² A clear opt-out line in every cold email costs nothing and lowers complaints.

Google says senders above a 0.3% spam rate are ineligible for mitigation until they stay below it for 7 consecutive days.²

Domains, inboxes and warm-up

Most outbound teams do not send cold email from their primary domain. They register secondary domains that resemble the main one, set up a few authenticated inboxes on each, and keep daily volume per inbox low. If one domain’s reputation suffers, the domain that carries invoices and employee email is protected. This is common practice, not a provider requirement, and it has limits: spreading a high-complaint campaign across 50 inboxes only delays the moment you notice.

Warm-up means starting a new inbox at low volume and increasing slowly, often with automated networks that exchange mail between inboxes. Sending tools such as Smartlead list a warm-up pool as a feature.¹²12 Source: Smartlead, “Pricing”, accessed Oct 2026. List prices as of October 2026. Gradual ramp-up is sound. Using artificial engagement to mask a bad list does nothing for the real recipients who will complain.

Requirement	Google (bulk senders)	Yahoo (bulk senders)	Microsoft Outlook (high-volume)
Volume threshold	~5,000/day to personal Gmail2	No number on best-practices page	More than 5,000/day to consumer addresses3
SPF and DKIM	Both required	Both required	Both must pass
DMARC	Required, p=none acceptable	Required, at least p=none	Required, at least p=none
One-click unsubscribe	Required for marketing messages	Required for marketing messages	Not covered in sources reviewed
Unsubscribe timing	Within 48 hours	Within 2 days	Not covered in sources reviewed
Spam-rate ceiling	Below 0.3%, target below 0.1%	Below 0.3%	Not covered in sources reviewed
Enforcement start	February 2024, stepped up from November 2025	February 2024	May 5, 2025

5. Sequencing across email, LinkedIn and phone

A sequence (or cadence) is the planned series of touches a prospect receives, such as an email, a LinkedIn connection request, a follow-up email and a call over two to three weeks. Sales engagement tools schedule the steps and stop when the person replies.

Email

Keep cold emails short, plain and specific, with one link or none. The opener should say why you are writing to this person now, which is where the signal from chapter 2 earns its keep. The ask should be small.

Follow-ups matter. Instantly, a sending platform, says in its 2026 benchmark report that step 1 generates about 58% of replies and follow-ups the remaining 42%.¹³13 Source: Instantly, “How to Calculate Cold Email Reply Rates”, accessed Oct 2026, citing Instantly’s “Cold Email Benchmark Report 2026”. The 58%/42% step split was reported in Instantly search results describing the same report. That is one vendor’s dataset, but the direction is clear: a single email leaves replies on the table.

LinkedIn

LinkedIn works as a second channel because the prospect can see who you are before your next email arrives. Sales Navigator adds search filters, account lists and InMail; LinkedIn’s comparison page lists 50 InMail credits a month.⁸

Be careful with automation. LinkedIn says it does not permit third-party software or browser extensions that scrape or automate activity on its site, and that it may restrict or shut down accounts that use them.¹⁴14 Source: LinkedIn Help, “Prohibited software and extensions”, accessed Oct 2026. Some engagement tools sell LinkedIn automation anyway; lemlist, for example, lists LinkedIn invites and messages in its Multichannel plan.¹⁵15 Source: lemlist, “Pricing”, accessed Oct 2026. List prices as of October 2026; the page says pricing is based on the number of users. That is your risk decision. Losing a founder’s LinkedIn account is an expensive way to save a few hours a week.

Phone

Phone is the fastest way to get a real answer and reaches people whose inboxes are well filtered. It needs good direct-dial data, usually the most expensive field to enrich, and reps comfortable with rejection. UK calls have their own screening rules (chapter 6).

AI personalization and its limits

AI tools can research an account, summarize a filing or a podcast, and draft a first line that references something specific. The limits are practical. Models sometimes invent the “recent achievement” they were asked to find, so every personalized fact needs a source field you can check. When every sender uses similar models and prompts, the output reads as automation. And a bad prompt applied to 5,000 records sends 5,000 bad emails before anyone reads one.

Personalization works when it explains why you are writing now. That reason comes from a real signal attached to the record, and better prose will not rescue a list without one. Let AI do research and drafts, keep the variable part short and tied to a structured field, and have a human review a sample of every batch.

6. Compliance: US, UK and EU, Canada

This section compares the three regimes. Rules vary by country, change, and depend on facts, so take advice from a qualified lawyer for your situation.

United States: CAN-SPAM

The FTC says CAN-SPAM makes no exception for business-to-business email.¹⁶16 Source: Federal Trade Commission, “CAN-SPAM Act: A Compliance Guide for Business”, accessed Oct 2026. Its requirements include accurate header information, non-deceptive subject lines, identifying the message as an advertisement, a valid physical postal address, and a clear opt-out honored within 10 business days that keeps working for at least 30 days after sending. Each separate email in violation can cost up to $53,088.¹⁶

UK: PECR and UK GDPR

The ICO says you can email any corporate body, such as a company, LLP or government body, without the specific consent needed for individuals; sole traders and some partnerships are treated as individuals.¹⁷17 Source: ICO, “Electronic mail marketing”, accessed Oct 2026. You must not disguise your identity, must give a valid opt-out address, and the ICO recommends keeping a “do not email” list even for corporate contacts. It also notes that emailing named employees can bring data protection law into play.¹⁷ That usually means relying on legitimate interests, which requires the ICO’s three-part test (purpose, necessity, balancing). People have an absolute right to object to direct marketing.¹⁸18 Source: ICO, “When can we rely on legitimate interests?”, accessed Oct 2026.

For calls, the ICO says B2B rules match those for individuals: without consent, screen against both the TPS (Telephone Preference Service) and the CTPS (Corporate TPS) and your own opt-out list. It notes the guidance is under review following the Data (Use and Access) Act.¹⁹19 Source: ICO, “Telephone marketing”, accessed Oct 2026.

EU: GDPR plus national ePrivacy rules

GDPR’s Recital 47 says direct marketing “may be regarded as carried out for a legitimate interest.”²⁰20 Source: GDPR text, “Recital 47: Overriding Legitimate Interest”, accessed Oct 2026. When data did not come from the person, Article 14 requires you to tell them its source and other details, at the latest at the first communication.²¹21 Source: GDPR text, “Art. 14 GDPR: Information to be provided where personal data have not been obtained from the data subject”, accessed Oct 2026. Whether B2B email needs prior consent depends on national ePrivacy laws, which differ between member states.

Canada: CASL

CASL prohibits sending a commercial electronic message without consent, and requires it to identify the sender, give contact information and include an unsubscribe mechanism.²²22 Source: Justice Laws Website, “Canada’s Anti-Spam Legislation (S.C. 2010, c. 23), sections 6–11”, accessed Oct 2026; implied consent (s. 10(9)) and the 10-business-day unsubscribe rule (s. 11(3)) are on page 2. Consent can be implied in limited cases, including where the recipient conspicuously published their address without refusing unsolicited messages and the message relates to their business role. Unsubscribes must take effect within 10 business days.²² Maximum penalties are $1 million per violation for individuals and $10 million for any other person.²³23 Source: Justice Laws Website, “Canada’s Anti-Spam Legislation, section 20”, accessed Oct 2026.

Regime	Default for cold B2B email	Opt-out deadline	Maximum penalty (as published)
US: CAN-SPAM	Allowed with accurate headers, postal address and opt-out16	10 business days	Up to $53,088 per email16
UK: PECR + UK GDPR	Allowed to corporate bodies; individual rules for sole traders and some partnerships17	Act promptly	Not covered in sources reviewed
EU: GDPR + national law	Varies by member state; Article 14 notice at first contact21	Right to object applies	Not covered in sources reviewed
Canada: CASL	Consent required; implied consent in limited cases22	10 business days	$10 million per violation for organizations23

7. Team roles, tool categories and costs

SDR versus GTM engineer

The SDR (sales development representative) researches accounts, runs sequences, makes calls and books meetings for account executives. SDRs are measured on meetings held or pipeline created.

The GTM (go-to-market) engineer is newer. Clay, the vendor most associated with the term, defines it as someone who builds “revenue engines using AI and automation.”²⁴24 Source: Clay, “GTM Engineering: What It Is and How to Hire”, accessed Oct 2026. In practice the role builds the enrichment waterfalls, signal triggers and CRM syncs that SDRs used to assemble by hand. Clay has an interest in the role’s growth, so treat that framing as the vendor’s view.

The roles are complements. A GTM engineer without SDRs produces enriched lists nobody calls. SDRs without one spend half their week in spreadsheets. A team with one rep and a few hundred target accounts does not need a GTM engineer yet; it needs more conversations. Hire one when list building takes more time than selling.

Tool categories

Category	What it does	Typical pricing model	Examples and list prices (as of October 2026)
Contact databases	Company and contact records, search, exports	Seat plus credits, often quote-based	ZoomInfo: quote-based, credits per export6; Apollo: plan-based, pooled credits that expire7
Enrichment and orchestration	Waterfalls, signals, AI research, CRM sync	Platform fee plus usage credits	Clay: Free plan; Launch from $185/month billed monthly9
Cold email sending	Inbox rotation, warm-up, sequences	Flat tiers by contacts or emails per month	Instantly Growth: $47/month, 5,000 emails2525 Source: Instantly, “Pricing”, accessed Oct 2026. List prices as of October 2026; the page showed one conflicting figure for a higher tier, so only the entry tier is cited. ; Smartlead Base: $39/month, 6,000 emails12
Multichannel engagement	Email, LinkedIn, calls in one sequence	Per user per month	lemlist: $69 Email, $109 Multichannel per month on monthly billing15
Professional network	Search, lead lists, InMail	Per license	Sales Navigator Core: US$119.99/month on monthly billing8
Intent data	Account-level topic research signals	Quote-based	Bombora (25,300+ topics, per the company)5

Two observations. The cheap line items are rarely the real cost: domains, inboxes, verification and data credits add up, and credit-based tools make spend hard to predict. And sending tools priced by email or contact volume reward you for sending more, which is the opposite of what deliverability rewards.

At the list prices above, a one-person setup with a sending tool, an enrichment tool and Sales Navigator runs to a few hundred dollars a month in software before data credits and inboxes. The person running it costs far more. Budget for them first.

How outbound tools sit next to the CRM, marketing automation and billing is covered in the B2B revenue stack guide.

8. Metrics and common mistakes

What to measure

• Delivered. Sent minus hard bounces. If it is far below sent, fix the data first.
• Reply rate. Unique human replies divided by delivered. Instantly reports a 3.43% average across its platform for 2026 using this definition.¹³ It is one vendor’s dataset and counts all replies.
• Positive reply rate. Interested replies divided by delivered. This predicts pipeline. Definitions vary, so write yours down and keep it stable.
• Meetings booked and held, with no-shows tracked separately.
• Pipeline and revenue by campaign, the only way to know whether a segment is worth repeating.
• Spam complaints and unsubscribes, the leading indicators of reputation damage.

Treat open rates as noise. Open tracking depends on whether a mail client loads a hidden image, which makes the number unreliable, and many teams turn it off.

Common mistakes

1. Volume before fit. Emailing every account because the credits are paid for.
2. Sending from the primary domain. One bad campaign then affects invoices and every employee’s email.
3. Skipping verification. Bounces damage reputation.
4. No opt-out. It raises complaints and, depending on the regime, breaks the law.¹⁶²²
5. Treating AI output as finished. Unreviewed personalization produces errors at scale.
6. Automating LinkedIn with tools LinkedIn prohibits.¹⁴
7. Applying one country’s rules everywhere. A US-compliant campaign can breach CASL or PECR.
8. Changing everything at once. Test one variable at a time or you will not know what worked.

9. The verdict

Outbound still works in 2026, but the economics have flipped. Providers now set hard complaint limits and require authentication, so a bad list costs you a domain, not just a few replies. The teams that do well send less, to better-chosen accounts, with a reason to write now, from authenticated domains, and they judge results by positive replies and meetings.

Spend effort in this order: ICP and exclusions, data and verification, sending infrastructure, then copy and channels. AI and GTM engineering make each step cheaper. They do not change the order.

Frequently asked questions

Is cold email still legal in 2026?

In the US, CAN-SPAM allows commercial email, including B2B, if you meet its header, identification, address and opt-out rules.¹⁶ The UK allows email to corporate bodies but treats sole traders and some partnerships as individuals.¹⁷ Canada’s CASL requires express or implied consent.²² This is a summary, not legal advice.

Do Google’s and Yahoo’s bulk-sender rules apply to small outbound teams?

Google’s bulk-sender status starts at close to 5,000 messages a day to personal Gmail accounts, which many B2B teams never reach.² The requirements still describe what providers treat as trustworthy mail. Authenticate and keep complaints low at any volume.

How many emails can one inbox send per day?

No provider publishes a safe number for cold email; figures you see are vendor rules of thumb. What providers do publish are spam-rate limits: below 0.3%, with Google recommending below 0.1%.²⁴ Whether recipients want the email matters more than volume per inbox.

Should I automate LinkedIn outreach?

LinkedIn says it does not permit third-party software that scrapes or automates activity, and may restrict accounts that use it.¹⁴ Manual LinkedIn steps inside a sequence are slower but carry no account risk.

What is a good reply rate?

Instantly reports a 3.43% average across its platform for 2026, counting unique human replies over delivered emails.¹³ Positive reply rate is the better target but has no reliable public benchmark. Compare your own segments over time.

What is waterfall enrichment?

Querying several data providers in sequence until one returns a verified result. Clay offers multi-provider waterfalls on all plans.⁹ It improves coverage, but costs rise quickly unless you stop at the first verified result.

Sources and notes

1. Source: Google Workspace Admin Help, “Email sender guidelines”, accessed Oct 2026. ↩ ↩² ↩³

2. Source: Google Workspace Admin Help, “Email sender guidelines FAQ”, accessed Oct 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹

3. Source: Microsoft Tech Community, “Strengthening Email Security: Outlook’s New Requirements for High-Volume Senders”, accessed Oct 2026. Microsoft later updated the action taken on non-compliant mail; check the post for current status. ↩ ↩² ↩³

4. Source: Yahoo Sender Hub, “Sender Best Practices”, accessed Oct 2026. ↩ ↩² ↩³ ↩⁴

5. Source: Bombora, “Intent”, accessed Oct 2026. Topic count as stated by the company. ↩ ↩²

6. Source: ZoomInfo, “Pricing”, accessed Oct 2026. ↩ ↩²

7. Source: Apollo.io, “Pricing”, accessed Oct 2026. ↩ ↩²

8. Source: LinkedIn Sales Solutions, “Compare plans”, accessed Oct 2026. List prices as of October 2026, may exclude taxes. ↩ ↩² ↩³

9. Source: Clay, “Pricing”, accessed Oct 2026. List prices as of October 2026. ↩ ↩² ↩³

10. Source: ZeroBounce, “Status Codes (v2)”, accessed Oct 2026. ↩ ↩² ↩³

11. Source: RFC Editor, “RFC 8058: Signaling One-Click Functionality for List Email Headers”, accessed Oct 2026. ↩

12. Source: Smartlead, “Pricing”, accessed Oct 2026. List prices as of October 2026. ↩ ↩²

13. Source: Instantly, “How to Calculate Cold Email Reply Rates”, accessed Oct 2026, citing Instantly’s “Cold Email Benchmark Report 2026”. The 58%/42% step split was reported in Instantly search results describing the same report. ↩ ↩² ↩³

14. Source: LinkedIn Help, “Prohibited software and extensions”, accessed Oct 2026. ↩ ↩² ↩³

15. Source: lemlist, “Pricing”, accessed Oct 2026. List prices as of October 2026; the page says pricing is based on the number of users. ↩ ↩²

16. Source: Federal Trade Commission, “CAN-SPAM Act: A Compliance Guide for Business”, accessed Oct 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

17. Source: ICO, “Electronic mail marketing”, accessed Oct 2026. ↩ ↩² ↩³ ↩⁴

18. Source: ICO, “When can we rely on legitimate interests?”, accessed Oct 2026. ↩

19. Source: ICO, “Telephone marketing”, accessed Oct 2026. ↩

20. Source: GDPR text, “Recital 47: Overriding Legitimate Interest”, accessed Oct 2026. ↩

21. Source: GDPR text, “Art. 14 GDPR: Information to be provided where personal data have not been obtained from the data subject”, accessed Oct 2026. ↩ ↩²

22. Source: Justice Laws Website, “Canada’s Anti-Spam Legislation (S.C. 2010, c. 23), sections 6–11”, accessed Oct 2026; implied consent (s. 10(9)) and the 10-business-day unsubscribe rule (s. 11(3)) are on page 2. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

23. Source: Justice Laws Website, “Canada’s Anti-Spam Legislation, section 20”, accessed Oct 2026. ↩ ↩²

24. Source: Clay, “GTM Engineering: What It Is and How to Hire”, accessed Oct 2026. ↩

25. Source: Instantly, “Pricing”, accessed Oct 2026. List prices as of October 2026; the page showed one conflicting figure for a higher tier, so only the entry tier is cited. ↩