A do-not-contact list for cold email is one master record of every person, address and company your team must not message. Every campaign gets screened against it before it sends.
Opt-outs and objections stay on it for good. So do people you leave alone for business reasons: current customers, open deals, partners, competitors and accounts someone has marked off limits. A stop on one channel blocks that person everywhere, the same day.
The law sets the floor, and cold email laws by country differ in the details. The UK regulator tells organizations to keep people who opt out on a do-not-contact list and screen all marketing against it. Legal deadlines for honoring a stop run to days or weeks, while a cold sequence often fires its next step much sooner. Your internal rule has to move faster than the law.
What goes on a do-not-contact list?
Split the list in two. Permanent blocks are people who must never get another marketing message from you. Holds are people you leave alone for a commercial reason that can change. Both live in the CRM, kept apart: a permanent block has no end date, and a hold carries an owner and a review date.
Permanent blocks cover:
- Anyone who opted out by any route: the unsubscribe link, an email reply, a LinkedIn message, a call to your office
- Anyone who objected to direct marketing. In the UK this right is absolute, and the ICO says an objection can be spoken or written with no legal wording, so "stop messaging me" in a LinkedIn reply counts
- Whole countries you do not cold email. Strictly this is a channel block: it covers email only. LinkedIn can still reach them, and the block lifts only if a compliant basis appears
That last one reflects how my team works. Our campaigns mostly reach the US, the UK and the rest of Europe, largely in English. In Czechia, Germany and Austria our rule is no cold email without a compliant basis. Those markets get LinkedIn outreach.
Store a rule like that as a country block, where every tool can read it. Before a list goes live we strip blocked countries and give each LinkedIn account and each rep its own territory, so nobody works the same lead twice.
Holds are where teams slip, because nobody thinks of a paying customer as someone to suppress. Take a 20-person agency whose rep cold pitches a client that pays an invoice every month: the message tells that client the sales side and the delivery side never talk. A second rep's cold intro in the middle of a negotiation does the same damage at a worse moment.
| Exclusion | Layer | Who adds it | When it lifts |
|---|---|---|---|
| Opt-out or objection, any channel | Permanent | Whoever reads the message, same day | Never |
| Country you do not cold email | Channel block (email only) | Campaign lead | When a compliant basis exists |
| Current customer (whole domain) | Hold | Account owner, synced from billing | Contract ends and the owner agrees |
| Open deal (every contact there) | Hold | Rep who owns the deal | Deal closes and the owner sets a review date |
| Partner or competitor | Hold | Founder or partnership owner | Partnership ends; for competitors, rarely |
| Named account | Hold | Founder or sales lead, with a written reason | Only the person who added it can lift it |
How fast should an opt-out take effect?
Same day, and always before the next scheduled send.
| Rule | What it requires | Deadline or consequence |
|---|---|---|
| UK GDPR right to object (ICO guidance) | Stop using the person's data for direct marketing | As fast as you reasonably can, one month at most |
| US CAN-SPAM (FTC guide) | Honor email opt-outs, B2B mail included. Keep the opt-out method working for 30 days after each send | 10 business days. The FTC guide puts the penalty at up to $53,088 per violating email, and more than one party can be held responsible |
| CAN-SPAM Rule, 16 CFR 316.5 | Opting out must be free and take only a reply or one page | Every opt-out request |
| Gmail bulk sender rules (Google's sender guidelines FAQ) | One-click unsubscribe through List-Unsubscribe headers on commercial and promotional mail | Bulk senders that miss the guidelines are not eligible for Google's mitigation of delivery problems |
| Outlook high-volume sender rules (Microsoft's announcement) | A working unsubscribe link in the email that lets recipients quickly opt out of future mail | Applies to senders of 5,000+ messages a day |
This is not legal advice.
Take a prospect who answers step 1 on Monday afternoon: "take me off your list." Step 2 sits queued for Tuesday morning in a tool nobody updated. You are inside every deadline above, and the person still gets a follow-up after saying stop. Someone who already said stop has every reason to hit the spam button.
Regulators fine this too. In January 2024 the ICO fined HelloFresh £140,000, and customers had complained about marketing that kept coming after they opted out, as Lewis Silkin reported. In 2021 the ICO fined American Express £90,000 for unlawful marketing emails, some sent to customers who had opted out (RPC's summary).
The spam button has a cost too. Gmail's sender guidelines set the limit: keep the spam rate in Postmaster Tools below 0.10% and never reach 0.30%.
The fix is an inbox manager: one named person on the replies, so nothing gets missed. That person pauses the contact in the sending tool first and updates the master record second. The pause stops tomorrow's step, and the record stops next quarter's. From our campaigns, the third follow-up is the step that usually earns the reply. A queue nobody updated can fire even that step at someone who already asked you to stop.
How do you sync one list across email, LinkedIn and agencies?
- Make the CRM the master. I don't care which CRM a client uses, as long as every lead and every block lives in it. The unsubscribe list inside each sending tool is a copy. When they disagree, pull the tool's new opt-outs up, then let the CRM win.
- Push the master to every mailbox before each launch. Sending is usually spread across many mailboxes, domains and often several tool workspaces (our deliverability FAQ covers that side). A stop logged in one workspace protects nobody in another until it is synced.
- Log LinkedIn stops by hand. LinkedIn has no unsubscribe link, so log the stop in the CRM that day with the profile URL. Screen every LinkedIn list on name, company and profile URL. A LinkedIn stop also cancels the warm-email steps, the emails we send after a LinkedIn first touch.
- Give every account one owner. Split targets by account and by rep, so two senders never work the same people.
- Write the agency rules down before kickoff.
Agencies, including a cold email agency like mine, need written rules because you cannot hand the risk away. The ICO says that when you pay someone to send your marketing, you are both responsible, and you still count as the instigator. The terms I would want in that written agreement:
- It gets your master block list before it builds a single target list
- Every opt-out it hears reaches your CRM within one working day, with channel and date
- It keeps no private copy of your contacts to reuse for other clients
- When the contract ends, it returns its block records first and then deletes your target data
Should you delete or suppress contacts after they opt out?
Suppress. Deletion feels tidy and recreates the problem. Next quarter a fresh export from a data provider puts the same person back on a list, and nothing in your system remembers they said stop.
Instead of deleting someone who opts out, the ICO says to put their details on a suppression list.
Its marketing lists guidance adds that you must not contact them later, even to ask whether they want to opt back in. If they ask you to delete their data, the ICO says you can keep a minimal record on a suppression list so they are not contacted by mistake.
After a deletion request, keep only:
- The email address, plus the company domain if the block covers the account
- Full name and LinkedIn profile URL, so LinkedIn senders can match the person
- Date, channel and reason for the block
Delete the notes, phone numbers, enrichment fields and sequence history, then tell the person what you did. Keep the suppression table apart from active lists: readable by every campaign, exportable to none, with delete rights held by one person.
How do you keep bad records off the list?
A suppression list cannot rescue bad data. If half a file is wrong titles and dead addresses, the block list fills with noise and real opt-outs get lost in it.
My team verifies every address with NeverBounce or DeBounce before a campaign uses it and keeps the bounce rate under 0.5%. That is far stricter than the vendor's own bar: NeverBounce says to aim for a bounce rate below 3% and warns that most email service providers penalize sender reputation once it goes over 5%.
An address that hard bounces anyway goes on the list as invalid, so the next import cannot bring it back. Catch-all domains hide some bounces, and whether to send to catch-all addresses comes down to a send, test or drop rule.
A purchased file knows nothing about the people who already told you to stop. Cheap lists bought from freelancers also bring low open rates and high bounces. Both are reasons I am wary of buying B2B email lists.
The last check runs right before import. Screen the new file against the master on address, domain and profile URL, and read what it removed, the way you would when you audit a lead list. If a refresh suddenly drops hundreds of rows, find out why before anyone sends.
What should the weekly routine look like?
One rule settles most arguments: if a reply could be read as stop, it is one. "Remove me" and "unsubscribe" become permanent blocks. "Try me next year" becomes a hold with a review date.
Name two people. One adds exclusions, usually whoever reads the replies. The other checks every week that each tool matches the CRM, so a holiday never leaves the gap unwatched.
- Every reply: pause the contact, update the CRM, push the block to every tool and sender that day
- Every list refresh or launch: screen the new file before import
- Weekly: compare block counts in each tool with the CRM and check territories for overlap
- Monthly: search for 20 random permanent blocks in every live campaign, decide on overdue holds, reconcile the agency's opt-out export
- Every handoff: when a rep leaves, a mailbox retires or an agency starts or stops, move block records first and contacts second. Blocks before contacts. Every time.
If you run outbound across several mailboxes, LinkedIn accounts or an agency and want a second opinion on your block list setup, describe it. Book a call.
Questions teams ask about do-not-contact lists
Should one opt-out block the whole company?
Usually it blocks only the person who sent it, on every channel and sender. Block the whole domain when that person speaks for the company, for example a head of procurement writing that nobody there wants vendor outreach. Log it as a company block with that reply attached, so the next rep sees exactly where it came from.
How long should a suppression record stay on the list?
A permanent block never expires. Removing it lets the next fresh list re-add the person. Holds get a review date, so none of them lives forever by accident.
Can you share or sell your do-not-contact list?
Only for compliance work. The FTC says an address that opted out may not be sold or transferred, apart from a company you hired to help you comply with CAN-SPAM. Giving your block list to an agency so it can screen your campaigns fits that exception. Renting it to a partner or a sister brand for outreach does not.
Do you need consent to keep someone on a suppression list?
The ICO says keeping a suppression list is not itself direct marketing, so you do not need fresh consent to record that someone said stop. The record exists to protect them. Keep it to the minimum fields and use it only to screen outgoing campaigns, never as a pool of new targets.
Do auto-replies and soft bounces belong on the list?
Mostly they stay off it. An out-of-office or a soft bounce is not a request to stop, so the contact stays live and the sequence resumes later. The exception is an auto-reply saying the person has left the company: mark that address invalid the same day. The person may still be a fair target at a new employer, as a new record.