There is a version of this that goes badly, and it usually starts with somebody exporting every address the business has ever touched into a spreadsheet and uploading it.
What follows is predictable. Spam complaints in the first hour. The platform suspends the account, because they can see the complaint rate. The sending domain picks up a reputation that takes months to shake off. And if the domain was not separated from your normal mail, the estimate you send that afternoon lands in a junk folder.
The address list is the asset. How it was built decides whether the asset is worth anything.
Who you are allowed to email
The rules differ by jurisdiction, and this is not legal advice, but the shape is consistent enough to plan around.
People who asked. Somebody filled in a form that said what they would receive. This is the only category with no argument attached to it.
People you have done business with, sometimes. In the United States, CAN-SPAM is comparatively permissive: you may email a customer about related things provided you identify yourself, include a real postal address, and honor unsubscribes promptly. Canada’s CASL and the UK and EU regimes are stricter, and lean on consent and a narrow “existing customer, similar product” exception.
Nobody else. A list you bought. Addresses scraped from a directory. The attendee list from an event you sponsored. Someone’s business card in a bowl, unless the bowl said what you would send.
If your customers are spread across borders, the practical answer is to work to the strictest rule that applies to any of them. Running two lists under two standards is a mistake somebody will eventually make on a Friday afternoon.
Keep the record, not just the address
The thing most small businesses miss is not consent. It is proof of consent.
For every address, keep when they signed up, where, and what the form said at the time. Any decent platform records this automatically if the signup goes through it. It matters twice: when a platform reviews your account after a complaint spike, and if a regulator ever asks. “They must have signed up at some point” is not an answer either will accept.
This is also why importing a spreadsheet of unknown provenance is such a bad idea. Even where those addresses are technically emailable, you cannot show it.
Where the addresses should come from
The form on your site. Say plainly what they will get and how often. “Occasional notes on keeping a commercial kitchen out of trouble, about six times a year” outperforms “Sign up for our newsletter,” because it tells someone what they are agreeing to.
At the point of work. After a job, in the follow-up. This is the highest quality source you have, because they have just seen what you do.
On paper, transcribed carefully. A tick box on a job sheet is valid consent if it says what it is for. Note the date when you type it in.
A genuinely useful download. A checklist worth having. Not a gate on something that should have been a web page.
What all four have in common is that the person chose. That is the whole distinction, and it is also what makes the list respond.
The unsubscribe is not the enemy
Make it one click and honor it immediately. Hiding it, or requiring a login, converts an unsubscribe into a spam complaint, and complaints are what damage your ability to reach everybody else.
An unsubscribe is somebody removing themselves from a number you were reporting but not from your customer base. That is fine. They know where you are.
Prune it
A list that only grows is a list that slowly stops arriving. Mailbox providers watch engagement, so a large file of people who have not opened anything in two years actively harms delivery to the people who do read you.
Once a year, take everyone who has not opened or clicked in eighteen months, send one honest note asking whether they still want it, and remove the ones who do not answer. The list gets smaller and the results get better. That is not a paradox, it is the mechanism working.
What good looks like
Four hundred addresses that opted in, with a record of when, mailed on a schedule you keep, from a subdomain that authenticates, pruned once a year.
That list will outperform four thousand of unknown origin, it will not get your account suspended, and it is genuinely yours in a way that a social following is not.
