Acquisition outreach: compliance, deliverability, and approvals

Contacting an owner who has not asked to hear from you is governed by two entirely separate systems. One is law, and it differs by the recipient’s country in ways that are not intuitive. The other is the set of technical and behavioural requirements imposed by the companies that run the world’s inboxes, which affect whether a message reaches the recipient. Legal compliance does not by itself establish successful delivery. This is a working map of both. It is not legal advice; your counsel’s view governs.

Two systems, both binding

When a campaign receives few replies, examine delivery evidence as well as the message and target selection. Low engagement alone does not establish which part of the process needs attention.

United States: CAN-SPAM

The federal statute governing commercial email is, contrary to its reputation, permissive about sending and strict about conduct [2]. There is no requirement of prior consent. There are requirements that apply to every commercial message, and the regulator states them in plain language [1]:

1. Header information must not be false or misleading. The from, reply-to and routing information must identify the sender accurately.
2. Subject lines must not deceive about the contents of the message.
3. The message must be identifiable as an advertisement, though the law allows latitude in how.
4. It must include a valid physical postal address.
5. It must offer a clear way to opt out of future messages.
6. Opt-outs must be honoured promptly, within the statutory window.
7. You are responsible for what is sent on your behalf. Hiring an agency does not transfer liability.

Two points that matter more than the list. First, the “primary purpose” test determines whether a message is commercial at all, and a genuine one-to-one business enquiry sits in a different place from a bulk marketing blast — but the safe assumption for an acquisition approach sent at scale is that the rules apply. Second, the seventh item is the one that catches funds: an outsourced origination provider sending under your name does not insulate you, which is an argument for knowing exactly what goes out.

Canada: consent, not opt-out

Canada’s regime inverts the American default: commercial electronic messages generally require consent before sending, either express or implied [3]. Implied consent categories exist and matter for business prospecting — notably where the recipient has conspicuously published a business address without a statement refusing unsolicited messages, and the message is relevant to their role.

Two practical consequences. The implied-consent route is real but narrow, and it depends on facts you have to record at the time: where the address was published, whether a refusal was stated alongside it, and why the message is relevant to that person’s business. Keeping that record is the difference between a defensible position and an assertion. And the identification and unsubscribe requirements apply regardless of which consent basis you rely on.

Europe and the UK

Europe layers two instruments, and confusing them is the most common error.

• The GDPRgoverns processing personal data at all, including holding a named person’s business email in your CRM. Most B2B prospecting relies on legitimate interests as the lawful basis [4], which is not a free pass: it requires a documented balancing test weighing your interest against the individual’s rights, and it fails where a person would not reasonably expect the processing.
• The ePrivacy Directive governs the act of sending the message [6]. It is a directive, not a regulation, so it is transposed separately in each member state and the rules genuinely differ — some states extend consent requirements to corporate subscribers, some do not.

The UK regulator’s guidance is the clearest English-language explanation of how the two interact, and in particular of the distinction between an individual subscriber and a corporate subscriber [7]. It is worth reading even if you never contact anyone in the UK, because it articulates the reasoning other regulators apply less legibly. The European Data Protection Board is the source for the interpretation that binds in practice across member states [5].

California and the state layer

US state privacy law now attaches rights to business contact data about residents, including rights of access and deletion [8]. For an origination process this mostly means three unglamorous capabilities: knowing what you hold about a person, being able to produce it, and being able to delete it without breaking the rest of your records.

The third is the one that bites a research system. If a person’s name is embedded in a hundred retained pages and a dozen claims, “delete this person” is a real engineering problem. Designing so that person-level records are separable from company-level records — rather than scattered through free text — is much cheaper before you have a hundred thousand records than after.

Phone, which is stricter than email

Telephone contact is governed more tightly than email, with a consent regime and statutory damages that make it worth getting right in writing rather than by habit [15]. The national registry is oriented to consumers [16], and business-to-business calling is treated differently — but the boundary between a business line and a personal mobile that a founder uses for business is exactly where that distinction stops being comfortable.

The practical rule we use: a phone number obtained from a public business listing, called during business hours, for a business purpose, with an immediate identification of who is calling and why, and an absolute stop on request recorded centrally. Anything automated, anything to a mobile obtained from a data vendor, and anything at all involving a text message goes to counsel first.

The other system: getting delivered

None of the above determines whether a message arrives. That is decided by the receiving provider, against published requirements that have tightened considerably for anyone sending in volume [12] [13].

The requirements fall into three groups:

1. Authentication. Prove the mail is from who it says it is from. Non-negotiable, and purely technical.
2. Behaviour. Low complaint rates, low bounce rates, consistent volume, honest list hygiene. Reputational, and slow to build.
3. Mechanics. One-click unsubscribe, valid reverse DNS, TLS, correctly formed messages. Cheap to satisfy and often skipped.

Authentication, concretely

The concept that trips people is alignment. DMARC does not merely ask whether SPF or DKIM passed; it asks whether the domain that passed matches the domain the recipient sees in the from field. A sending platform whose bounce address is its own domain will pass SPF and fail alignment, and mail that passes every individual check can still fail the policy.

DMARC aggregate reports help identify services sending on behalf of your domain and the authentication results receivers observe. Assign responsibility for reviewing those reports.

Reputation is behavioural

Authentication is a gate. Reputation is the score, it is earned over weeks, and it is domain-specific — a new domain has no reputation, which is not neutral but suspicious. The operator community has published best practice on this for years and it is unglamorous [14]:

• Ramp volume gradually on a new domain or IP rather than starting at full rate.
• Keep bounce rates low, which means verifying addresses before sending rather than discovering they are dead by sending to them.
• Keep complaint rates below the published thresholds, which for prospecting means relevance and low frequency, not cleverness.
• Send consistently. Bursts look like a compromised account.
• Segregate streams. Do not send prospecting from the domain that carries your transactional and portfolio-company mail. One bad campaign should not take your fund’s email with it.

Warm-up, volume and the domain you are risking

The mechanics of starting to send are where most origination programmes quietly fail, because the failure is invisible: mail is accepted, nothing bounces, and it lands in a folder nobody opens.

A separate domain, always

Prospecting mail should not leave the domain that carries your fund’s transactional mail, your LP correspondence and your portfolio companies’ communications. A single badly targeted campaign can damage a sending reputation for months, and you do not want that blast radius to include the address your investors write to. A dedicated sending domain, authenticated properly, is the standard arrangement and it costs almost nothing.

Ramping

A domain with no sending history has no reputation, which receiving systems treat as suspicious rather than neutral. Volume has to build gradually over weeks, with engagement — opens, replies, mail moved out of spam — accumulating alongside it. Industry best practice on this is published and unexciting [14]; the mistake is treating it as optional because the first hundred messages were accepted.

The volume ceiling is contacts, not ambition

The real constraint on a campaign is how many verified contacts you have. Padding a list with guessed addresses to hit a target produces bounces, and bounce rate is one of the strongest negative signals a receiving system uses. Sending to a hundred verified addresses beats sending to four hundred of which three hundred are pattern guesses, and it is not close.

What the message has to do

Compliance and deliverability get a message into an inbox. Whether it is read and answered is a separate problem, and it is the one the research is really for.

The single biggest determinant of a reply to a cold acquisition approach is whether the first two sentences demonstrate that you know something specific and true about that company. Not the sector. The company. This is not a copywriting trick; it is the output of the research pipeline being visible in the first line.

• Lead with the specific fact, not the fund.“You own the building outright, which is rarer than it should be in this market” is a sentence only somebody who did the work can write. “We are a private equity firm focused on the sector” is a sentence anyone can write, and everyone does.
• Never lead with an inference about the person. Anything implying the recipient is old, tired or ready to retire is both offensive and unnecessary. The research exists so you can talk about the business.
• Make the ask small and the exit easy. The realistic best outcome of a first message is a short reply, and the second-best outcome is a clean no that leaves the relationship intact for two years from now.
• Send from a person, with a real signature and a real address. Both because the law requires accurate identification and so recipients can identify and reply to the sender.
• Stop when they reply. An automated sequence that continues after a human has answered is an avoidable source of confusion for the recipient.

The approval discipline

Approval controls establish which companies may be contacted, by whom, and with which message. They should remain effective from initial review through dispatch.

Docket applies the following controls:

1. The client approves the target and the messaging before anything is sent. Not the campaign in the abstract: the company and the words.
2. Approval binds to the exact draft.If a sentence changes after approval, the approval is void and the draft returns to the queue. Otherwise “approved” means “approved something like this,” which is not a control.
3. Every gate is re-checked at the moment of sending, inside the transaction that sends, not when the message was queued. Facts change between scheduling and dispatch: a reply arrives, a company goes on the do-not-contact list, an exclusion is added.
4. Do-not-contact is enforced by the database, not by the application. A rule that lives in code is one refactor from being bypassed. A constraint that refuses the write cannot be forgotten.
5. Held messages require client approval. Preparing or queuing a draft does not authorise its release. The review step must be completed before the message becomes eligible to send.
6. A scheduled message is not a held message. An unapproved item with a send time on it will send itself when the clock reaches it. Only an explicit hold holds.
7. Everything sent is logged immutably, with the recipient, the wording, the approver and the time. This is what lets you answer “did we contact them, and what did we say” a year later, which is a question that gets asked.

The other channels

Email is the governed, measurable channel, which is why most of this page is about it. The others have their own rules and their own failure modes, and they are worth stating because the mistakes are different.

Professional networks

Messaging through a professional network sits under platform terms rather than under email law, and those terms are enforced by the platform rather than a regulator. The penalties are account restrictions and connection limits, which sounds mild until the restricted account belongs to the partner whose name opens doors. Two rules follow: keep the volume within what a person could plausibly send by hand, and never automate from an account whose loss would hurt. Under most engagements it is also worth capping outreach to a small number of named profiles rather than treating the channel as scalable, because the reputational exposure is personal in a way email is not.

Telephone

Covered above, and worth repeating in one line: the consent regime is stricter than email, the statutory damages are real [15], and the boundary between a business line and a founder’s mobile is exactly where comfort ends [16]. A call from a person, to a published business number, in business hours, identifying themselves immediately, is a different activity from dialling a list.

Physical mail

Largely ungoverned by the regimes above, almost entirely unread, and occasionally extremely effective for exactly that reason. Its real advantage is that it cannot be filtered by an algorithm, so a letter to a named owner at a small company has a delivery rate email cannot match. It does not scale, which is a feature when the target list is forty companies and a defect when it is four thousand.

Conferences and intermediaries

Not governed by any of this, and complementary rather than competing. The useful observation is that the research work is the same: showing up at a trade association event knowing which forty of the four hundred attendees are in your mandate, and why, is an information advantage that has nothing to do with email at all.

Docket’s outreach process

Concretely, for clients who take outreach as part of the service:

• Outreach represents the client. Messages use approved sender identities and dedicated sending domains, with clear identification of the firm represented.
• Campaign volume reflects verified contact coverage. The ceiling on a campaign is how many reachable, verified people you have, and inflating that number with guessed addresses is how a domain reputation is destroyed.
• Every target passes the disqualifier, the client’s exclusion list and the approval gate before it is eligible, not just the do-not-contact check. A list that passes only the last one will eventually contact a company the client already owns a relationship with.
• A reply stops the sequence immediately and cancels everything pending for that company. The team can then review the reply before deciding on any further contact.
• What outreach teaches is recorded separately from what research establishes. An owner saying they are not selling is a fact about a conversation, not a researched claim about the company, and should be retained with its date and conversational context.

Acquisition outreach represents the client in a potentially sensitive conversation. Clear sender identification, relevant research, client approvals, and respect for the recipient’s preferences should guide the process across channels.

Sources

References for the research and standards discussed in this guide. Some publications require a subscription or institutional access.

1. [1]
   CAN-SPAM Act: A Compliance Guide for Business

   U.S. Federal Trade Commission

   The seven rules, in plain language, from the regulator that enforces them.

2. [2]
   15 U.S.C. Chapter 103 — Controlling the Assault of Non-Solicited Pornography and Marketing

   Legal Information Institute, Cornell Law School

   The statute itself, including the definition of a commercial electronic mail message.

3. [3]
   Canada's Anti-Spam Legislation

   Government of Canada

   Consent-based rather than opt-out, with implied consent categories that matter for B2B prospecting.

4. [4]
   GDPR Article 6 — Lawfulness of processing

   EUR-Lex / Regulation (EU) 2016/679

   Including legitimate interests, the basis most B2B outreach in Europe relies on, and the balancing test it requires.

5. [5]
   European Data Protection Board guidelines

   EDPB

   The binding-in-practice interpretation of the GDPR across member states.

6. [6]
   Directive 2002/58/EC (ePrivacy Directive)

   EUR-Lex

   Article 13 governs unsolicited communications and is transposed differently in each member state.

7. [7]
   Direct marketing and privacy and electronic communications

   UK Information Commissioner's Office

   The clearest regulator guidance in English on when a corporate subscriber may be emailed without prior consent.

8. [8]
   California Consumer Privacy Act (CCPA)

   California Office of the Attorney General

   Rights of access and deletion that attach to business contact data held about Californians.

9. [9]
   RFC 7208 — Sender Policy Framework (SPF)

   IETF

   Which hosts may send for a domain, published in DNS.

10. [10]
    RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures

    IETF

    Cryptographic signing of a message by the sending domain.

11. [11]
    RFC 7489 — Domain-based Message Authentication, Reporting, and Conformance (DMARC)

    IETF

    Alignment, policy and the aggregate reports that tell you who is sending as you.

12. [12]
    Email sender guidelines

    Google Workspace Admin Help

    The receiving side's published requirements, including authentication and the spam-rate threshold for bulk senders.

13. [13]
    Outlook.com sender requirements and troubleshooting

    Microsoft

    The equivalent rules for the other half of corporate inboxes.

14. [14]
    Published documents and best common practices

    M3AAWG

    Industry best practice on sending reputation, list hygiene and abuse handling, written by the operators.

15. [15]
    Telemarketing, robocalls and the TCPA

    U.S. Federal Communications Commission

    The consent regime for calls and texts, and the penalties that make it worth reading before dialling.

16. [16]
    National Do Not Call Registry

    U.S. Federal Trade Commission

    Applies to telemarketing; business-to-business calling is treated differently, which is a distinction worth getting right in writing.

Keep reading