Running cold email for a client doesn't put the compliance burden entirely on the client's shoulders — most of the laws in this cluster were written with the assumption that a message can have more than one responsible party, and an agency sending on someone else's behalf is exactly that situation.
When you send on your own behalf, there's one party to hold accountable. When an agency sends for a client, most cold email laws recognize that both the agency (which controls the sending infrastructure and often the list) and the client (whose product is being promoted) have a hand in whether the message is compliant — and several of these laws hold both responsible rather than picking one.
Our CAN-SPAM guide covers this in detail, but the core point for agencies: CAN-SPAM can hold both the business whose product or service is being advertised and the party who initiated the message responsible for a violation. An agency running outreach for a client doesn't step outside that liability just because the product being promoted belongs to someone else. The statute's "designated sender" provision allows one party to be identified as primarily responsible under specific conditions, but that arrangement needs to be documented correctly — it isn't automatic just because an agency is doing the sending.
Canada's CASL is explicit on this point: if you're sending on behalf of another company, the message has to identify both the sender and the company you're acting for. See our CASL guide for the full identification requirements — for an agency, this means the email can't just carry the agency's branding or just the client's; both need to be clear to the recipient.
Under GDPR, an agency running campaigns using a client's contact data — or sourcing and managing contact data for the client — typically sits in the role of data processor, while the client is the data controller who determines why and how the data is used. That relationship isn't informal; GDPR requires a Data Processing Agreement (DPA) between the two, covering what the agency is authorized to do with the data, the security measures in place, how a data breach gets reported, and whether the agency can bring in sub-processors (a separate email-warming vendor, for instance) and under what terms.
A missing DPA is itself a compliance gap — independent of whether the underlying campaign was well-targeted and properly justified under legitimate interest. See our GDPR guide for how the legitimate interest basis itself works; the DPA governs the agency-client relationship on top of that.
Don't treat a client's assurance that "we're compliant" as sufficient on its own — several of the laws in this cluster hold the agency independently responsible regardless of what the client claims. Building your own compliance layer, documented separately from the client relationship, is what protects the agency specifically. See our guide to building a cold email agency for how this fits into the broader infrastructure and client-onboarding picture.
It can be. CAN-SPAM can hold both the business whose product is advertised and the party who initiated the message responsible. Running the campaign on a client's behalf doesn't automatically remove the agency's own obligations under the statute.
Yes. CASL requires that a message sent on behalf of another company identify both the sender and the company being represented — an agency can't rely on only the client's branding or only its own.
A Data Processing Agreement (DPA) is a GDPR-required contract between a data controller (typically the client) and a data processor (typically the agency), covering what the agency can do with the data, security obligations, and breach notification. It's needed whenever an agency processes EU/UK contact data on a client's behalf.
Not safely. Several laws in this cluster, including CAN-SPAM and CASL, hold the agency independently responsible regardless of client assurances — the agency's own documented compliance is what protects it specifically.
Related guides
Written by
Scott Holmes
AI systems consultant based in Barrie, Ontario. Founder of Pinnacle Tech Projects. Has built compliance-ready outbound infrastructure for agencies sending on behalf of B2B clients.
Answer four quick questions and get a tool recommendation for your setup.