Automate B2B Lead Generation Without Spamming

Three tests for "not spam"

People use "spam" loosely. For a UK business running outbound, it helps to split it into three separate tests, because each is judged by someone different.

1. • The legal test, judged by the ICO: are you allowed to send this email to this person, and can they stop it?
2. • The provider test, judged by Google, Yahoo and Microsoft's filters: is the mail authenticated, easy to unsubscribe from, and rarely marked as spam?
3. • The recipient test, judged by the reader: is this obviously for them, and worth the thirty seconds?

Automation can help with all three, or quietly fail all three at scale. The checklist below is ordered by when each check happens. It describes what to check, not legal advice; take the legal items to someone qualified if you are unsure.

Before you send: the legal checks

• • Classify every recipient's organisation. PECR's email marketing consent rule does not apply to corporate subscribers, which covers limited companies, LLPs and other bodies with their own legal status. Sole traders and some partnerships are treated as individual subscribers and need consent or the soft opt-in. A data provider's "company" field does not tell you which one you have; the legal form does.
• • Write down your lawful basis. Emailing a named person at work processes their personal data under UK GDPR. If you rely on legitimate interests, the ICO says direct marketing can qualify when it follows the electronic marketing rules; record the assessment and keep it with the campaign.
• • Tell people where you got their details. Your privacy information should cover prospects whose data came from a third party or a public source.
• • Build the opt-out before the first send. Every marketing email needs a valid way to opt out. An objection to direct marketing is absolute under UK GDPR, so it must stop all marketing to that person, across every tool and sequence.
• • Check recent changes. Legal commentary reports that the Data (Use and Access) Act 2025 raised maximum PECR fines to UK GDPR levels. Read current ICO guidance, not guidance from before 2025.

Before you send: the technical checks

• • Authenticate the sending domain with SPF, DKIM and DMARC. Google requires SPF or DKIM for every sender to Gmail accounts and all three for senders of more than 5,000 messages a day, and Yahoo requires authentication for bulk senders. Set them up regardless of volume.
• • Use a separate sending domain or subdomain for outbound, so a bad week in outbound does not affect invoices and client email. Yahoo's guidance recommends separating mail streams by function for the same reason.
• • Add one-click unsubscribe to marketing messages. Google requires it for marketing and promotional mail at bulk volume, and Yahoo expects unsubscribes to be honoured within two days.
• • Verify addresses before sending to keep bounces low, and remove role addresses that go to shared inboxes unless the message is genuinely for the team.
• • Set up monitoring: Google Postmaster Tools and Yahoo's complaint feedback loop, so you can see complaints rather than guess.

While sending: volume and content rules

• • Keep the spam rate below 0.1%, which is the level Google asks all senders to stay under, and treat 0.3% as the line never to reach. Yahoo uses the same 0.3% ceiling for bulk senders.
• • Ramp volume slowly on any new domain and hold it steady while you watch complaints and bounces.
• • Cap follow-ups. Decide the maximum number of touches per person before the campaign starts, and stop on any reply, including "not now".
• • Put a human on every claim. An AI draft that invents a detail about the recipient's company fails the recipient test instantly. Someone must approve any sentence that asserts a fact about the prospect.
• • Set pause rules. For example: if complaints or bounces double against the previous week, sending stops until someone has looked.

After sending: replies, objections and suppression

• • Answer real replies within one working day. Automation that generates interest nobody follows up is its own kind of spam.
• • Process objections everywhere at once. One suppression list, synced to the CRM, the sending tool and any enrichment tool, so a person who opted out is never re-imported next month.
• • Review weekly: complaint rate, bounce rate, unsubscribes, positive replies and meetings, per segment. The segment with the worst complaint rate is usually the one with the loosest targeting.

What to automate and what to keep human

Automation boundaries for compliant outbound

Step	Safe to automate	Keep human
List building	Pulling companies that match written rules; verifying emails; de-duplicating	Deciding the rules and the exclusions
Legal classification	Flagging legal form from company registers where available	Resolving unclear cases and signing off the lawful basis
Research	Summarising public news, hiring and posts into a brief	Choosing the angle and deleting anything unverifiable
Drafting	First drafts from approved positioning	Approving every message that makes a claim
Sending	Scheduling within set caps; pausing on thresholds	Setting caps and deciding to resume
Replies and opt-outs	Classifying replies; applying suppression instantly	Answering questions, objections and interest

The pattern is consistent: machines prepare and enforce rules, people make the judgements the rules cannot express. The same principle runs through AfM's managed service: the system prepares the work and holds the rules, Jakub reviews it, and the client approves before anything goes out. If you want the human side of this in more detail, see the AI-assisted SDR role; for where outbound sits among other channels, the B2B lead generation playbook.

FAQ

Can I email anyone at a limited company without consent?

PECR's consent rule for email marketing does not apply to corporate subscribers, but UK GDPR still applies to the named person, so you need a lawful basis, transparency and an easy opt-out. The message also has to be relevant to their role to pass the recipient test.

Why do sole traders need different treatment?

PECR treats sole traders and some partnerships as individual subscribers, the same as consumers, so unsolicited marketing email to them needs consent or the soft opt-in. Many small consultancies and trades are sole traders, so check before including them.

Is buying a list compatible with this checklist?

Only if you can confirm how the data was collected, what people were told, and which records are individual subscribers. In practice many bought lists fail those questions, and they tend to raise bounce and complaint rates too.

Do these rules apply if I send fewer than 5,000 emails a day?

The UK legal rules apply at any volume. Google's bulk sender requirements are tied to the 5,000 a day threshold, but its spam rate guidance applies to everyone, and authentication helps delivery at any size.