Direct mail compliance: privacy laws, suppression, and do-not-mail basics

Direct mail compliance in the US starts with a simple fact: there is no postal version of CAN-SPAM that gives every B2B recipient a federal right to unsubscribe from marketing mail. In ordinary practice, a company can send a truthful business offer to a valid business address without getting consent first. I would never mistake that permission for a free pass.

The nasty compliance problem is usually in the data: a broker supplied the name, the address is a home, or nobody considered privacy rules before production. Consumer mail preferences and your own do-not-mail requests go into suppression. Advertising claims must be honest. Put a gift in the package and I care much more about the recipient's policy plus anti-bribery law than postal rules (as I should). This is a practical operating guide, not legal advice.

What direct mail compliance actually covers

People ask me, "Is direct mail legal?" I push back on the question. Tell me what is being sent and who will receive it; then tell me how the name was found. What the page promises can change my answer all by itself.

CAN-SPAM governs commercial email, not letters or postcards. The national Do Not Call Registry is about calls. Neither creates a blanket do-not-mail list for B2B postal outreach. Deceptive or unfair advertising rules still apply across channels; a postcard cannot rescue a bad claim. Regulated products can add requirements. So can sweepstakes, or material designed to look like an official notice.

This is the working split on my review sheet:

Legal permission is only the floor. Mailing a prospect who asked you to stop is poor practice and an efficient way to earn a complaint. I suppress them.

State privacy laws can reach mailing data

A name attached to a postal address is personal information. Calling the file "B2B data" changes nothing, however comforting that label may sound in a campaign meeting. State privacy statutes do vary, and they do not treat workplace contacts uniformly.

I make teams understand California first. For a business that meets the law's scope tests, the CCPA can apply to personal information about California residents, including information collected in a business context. Covered people receive rights involving access, correction, deletion, and certain sales or sharing of data. This is not merely a website-cookie issue: the California Attorney General's CCPA guide makes clear that the law reaches offline data practices and data brokers.

Other states may exclude people acting in a commercial or employment context, or they may define covered activity differently. I do not copy California's answer across a national list.

Purchased data gets my hardest questions. Before anyone uploads a broker file, I want the origin of the name and address in plain language. "Public sources" is not an answer.

Then the address. Office, registered agent, branch, or residence? I ask what evidence supports the label. I also want to know when the employment relationship was last checked and exactly which field was verified (vendors sometimes blur those checks).

Show me the vendor's notices and explain how privacy requests are handled. Vague answers are not answers.

The contract deserves a slower read. Restrictions on reuse, resale, enrichment, or storage are easy to lose between procurement and sales, where a one-campaign license can quietly become a permanent CRM asset. That is a control failure. I also want the post-delivery route for corrections, deletions, and opt-outs before the first record moves.

When practical, I keep the contract version, acquisition date, permitted use, and source at record level. That belongs inside building a B2B direct mail list, where the decision is made. Reconstructing it after a complaint is miserable.

Home addresses deserve tighter handling. Collect them from the recipient when possible, explain why you need them, limit who can export them, and set a retention period. A platform that lets the recipient provide an address after accepting a send can reduce exposure. It doesn't transfer your compliance duty to the platform.

Build one suppression process that survives every campaign

A suppression list is a control file of people or addresses that shouldn't enter a send. It is not the same thing as deleting a contact. If you erase all identifying fields after a do-not-mail request, the same person may arrive next month through a fresh vendor file.

Keep the minimum data needed to recognize and block the record, subject to counsel's guidance and the applicable privacy request. In many systems that means a normalized name, address hash or standardized address, company, request scope, reason, source, and effective date. Restrict access. The file exists to prevent contact, not to create a shadow prospect database.

Assemble the audience, standardize it, deduplicate it, then suppress against every relevant source. Run suppression again after late additions. A rep's last-minute CSV is where old opt-outs sneak back in.

The sources usually include your company-wide do-not-mail file, privacy requests, deceased and caretaker records where relevant, customer exclusions, sensitive accounts, campaign frequency limits, and any contracted or industry preference files. Also remove bad delivery points. NCOA processing can update many moves, but it doesn't prove that a named employee still works at the destination. Postal address verification solves another piece of that problem.

Record requests from any channel. If someone writes "please don't mail me" in an email reply, don't make them find a web form. Give support, sales, privacy, and marketing one route into the same control. Store whether the request blocks one campaign, one brand, or all promotional mail.

Don't bury suppression inside a single printer account. A switch from Lob to a local mail house, for example, shouldn't revive old records. Your company owns the master control; each production partner gets the portion needed for that job, under suitable data terms.

Where DMAchoice fits, and where it doesn't

DMAchoice, operated by the Association of National Advertisers, is a preference service for consumer prospect mail. Participating organizations use its suppression data to remove registered consumers from covered acquisition mailings. It isn't a federal do-not-mail registry, and it isn't a substitute for your internal list.

The distinction matters for B2B teams. A letter to "VP Operations" at a company office isn't the usual DMAchoice case. A named solicitation sent to a person's home may overlap with consumer data and consumer-mail practices, even if your offer is for business software. Check your ANA commitments, vendor contracts, campaign type, and counsel's direction rather than guessing from the envelope copy.

DMAchoice doesn't stop every piece of mail. It generally focuses on prospect promotional mail from participating organizations, not transactional notices or every customer relationship. It also can't solve company-specific opt-outs for you. Maintain those yourself.

Refresh consumer preference files on schedule. Keep the file date, match rules, suppressed count, operator, and release approval. That small trail answers most questions later.

Gifts need a separate compliance gate

A handwritten note and a coffee mug aren't automatically treated alike. Once you include something of value, check the recipient's rules before you think about clever packaging.

Many companies cap gifts, forbid cash equivalents, or ban vendor gifts during procurement. Public institutions tend to have stricter ethics rules. A recipient at a state-owned foreign company may count as a foreign official for FCPA analysis. Domestic bribery and state ethics rules can also apply.

The FCPA isn't a universal dollar-limit law. Intent, recipient, purpose, timing, and surrounding conduct matter. The joint DOJ and SEC FCPA Resource Guide explains that modest promotional items are less likely to raise enforcement concern, while extravagant or repeated gifts tied to winning business are much riskier. There is no magic swag amount that makes corrupt intent disappear.

Put a hold on gifts when the recipient works in government, public healthcare, education, a sovereign wealth fund, or an enterprise that may be state controlled. Do the same during an active RFP, tender, audit, licensing decision, or contract negotiation. Legal or compliance can clear the recipient and the item before money moves.

For ordinary commercial accounts, write a policy that states allowed categories, value bands, frequency, excluded roles, and approval owners. Gifting platforms such as Sendoso can enforce limits and approval steps, but configuration matters. The software won't know that a prospect changed employers unless your data does.

Keep an item description, fair value, recipient, employer, business reason, sender, approval, and delivery result. That record also helps finance. Gift-policy compliance and tax deductibility are different questions, as the business gift deduction rules make painfully clear.

When legal review is worth the time

Routine office-address letters for a familiar B2B audience may fit an approved playbook. Get counsel involved when the facts leave that lane.

I would request review for a new purchased-data source, residential addresses collected without direct confirmation, sensitive personal data, campaigns across several states, regulated products, consumer credit or insurance offers, sweepstakes, aggressive comparative claims, or mail that resembles an invoice or official notice. High-value gifts and any government connection go on the list too.

Bring counsel the mail piece, audience, states, data lineage, vendor contract, suppression method, gift value, and timing. "Can we send this?" invites a long discovery call. A one-page fact sheet gets a usable answer.

Revisit the playbook when the law, source, offer, recipient type, or fulfillment flow changes. Approval from last year's office postcard doesn't automatically cover this year's home-delivered bottle of wine.

Frequently asked questions

Is B2B direct mail legal in the US?

Usually, yes. An ordinary, truthful offer sent to a business address does not default to prior consent because there is no general federal CAN-SPAM equivalent for physical B2B mail.

That is the easy part. "It's mail" does not exempt the campaign from privacy, advertising, sector, or postal law, and I care about the data source as much as the offer. Regulated industry or government recipient? Stop and check.

Do I have to honor a direct mail opt-out?

Yes, honor it. A statute or contract may require that result, but I would do it even when no specific postal unsubscribe law applies because ignoring a clear request buys nothing except complaint risk.

The practical answer is suppression, not a ceremonial delete. Keep enough information in a durable internal suppression file to prevent reimport. Erased contacts have a habit of walking back in with the next purchased list.

Does CCPA apply to B2B mailing lists?

Yes, it can. A business contact's name and address can be personal information, and California's old broad exemption for B2B contact data is not the simple escape hatch some teams remember.

Depends on the business, the person, the use, and current law. For example, another state may exclude commercial-context data. My honest opinion: a national campaign needs a data map, not a slogan about "public business information."

Can I send gifts to prospects as part of direct mail?

Sometimes. Before sending, check the recipient's employer policy and your own limits; then find out whether the person works for a government or state-controlled entity.

Depends. A small branded item sent to a commercial prospect is not the same fact pattern as an expensive gift during procurement (timing can wreck an otherwise ordinary send). Foreign or public official involved? Get compliance review first.