I feel naked. Exposed.
Maybe its been over a decade! But, I can’t remember when I shaved my beard last. This week I did just that to kick off Movember and raise money for mens health. If you haven’t heard of the cause, the idea is simple:
Shave
Grow a stache
Raise awareness
Raise money for the cause
My wife, Tori, who’s in social impact, gave me the idea to do it this month. Prostate cancer and suicide prevention are close topics. My father-in-law is a survivor of prostate cancer (he caught it early thankfully) and I have an Uncle that tragically took his life due to deep depression. This was a long time ago, but it’s something that’s always stuck with me. I’ve also struggled with mental health (anxiety & depression) through the years. Always happy to talk to anyone if you need help.
I’m doing this for them and all men who struggle with mental health & to raise awareness so more men can catch prostate cancer earlier.
Prostate stats you should know:
Prostate cancer is the most diagnosed cancer in the world for men
1.4M men are diagnosed with it each year
One of the first ways to spot it is through a quick, simple blood test for PSA (prostate specific antigen)
My goal is to raise $10,000.
For every company that donates, I will include your logo in a section of this newsletter until the end of the year as a thank you. There’s close to 10,000 subscribers and almost 1,000 subscribe every month now (and that number is growing). I publish 2-3 times a week, so this should be good exposure.
The top company donation gets:
The largest spotlight in the section
A brief blurb on the company so people can learn more
Shout outs on LinkedIn
I’ll do the same thing for individuals.
Hope to see you get involved or share resources with someone you know.
Now back to regularly scheduled programming…
The prospecting playbook for EMEA expansion
Google was fined 325M Euros in Sept 2025 in France.
It wasn’t because they sent cold emails - at least not by the definition you know. They got fined because:
They showed ads formatted as emails in Gmail inboxes
Set ad cookies during account creation without valid consent
The regulator treated an ad in the inbox as direct-marketing email under CPCE L.34-5, so consent applied. 'Email-like' formats count as email.
Honestly, never heard of that until I started researching the topic.
A more applicable case for this discussion is with Lusha Systems. Italy fined Lusha 2M Euros and ordered record deletions. Lusha claim they build and sellcontact cards on a legitimate-interest LIA. Regulators said this was missing. The case is currently suspended as a challenge is pending. In no way is this to put Lusha in a bad light, its just the most applicable fine I could find for the topic of cold email.
This is what all of my customers are worried about. They’d frequently ask:
Is data from Clay GDPR compliant?
How do companies do prospect in GDPR-strict countries?
I struggled to answer the last one. My response has typically been:
Clay cannot make you GDPR compliant. That’s within your control, not ours.
We can help setup guardrails in Clay to help you reduce risk.
There’s no data provider that can give you double-opted in contacts (they’d have to do this for every company). Or, the company is lieing to you.
The risk reward calculation of whether to break the law is up to you.
Then I met Nicolas Schell, founder of Scalantec, a boutique GTM agency out of Berline, Germany. They outbound prospecting in Germany. So, I had to learn more and invite him to do Reddit GTM Builder AMAs (hosted about a month ago). Btw, they also won Clay Partner of the Year award at Sculpt.
In this post, I cover:
My agent newsletter experiment
The basics of GDPR
Recent fines in the news
The GTM Engineer check list for GDPR
The GDPR prospecting playbook from Nicolas
GDPR takeaways
Partner of the week with 3 plays: Definitive Healthcare
This post summarizes the key takeaways from that r/gtmengineering AMA: Prospecting in Europe / GDPR-strict countries. How Nicolas Schell sends millions of cold emails in Germany. Important note: I am not a lawyer. This is not legal advice and in no way represents any opinions or guidance from Clay.
Otto & autonomous
I’m running an experiment - can a Grok Bot agent write, grow, and monetize a newsletter? Tune in as Otto shares everything that’s working & failing while getting tips on how to use agents to save money & be more productive.
The basics of GDPR and recent fines
What is GDPR?
GDPR stands for General Data Protection Regulation. It is a comprehensive data privacy and security law passed by the European Union. GDPR became effective May 25, 2018 and applies to all organizations in the EU and EEA, and any company outside of the region that collects or processes personal data belonging to EU residents. The core purpose is to provide individuals with control over their data.
GDPR.eu outlines the following rights for individuals:
The right to be informed about how data is collected and used.
The right of access to see what personal data an organization holds.
The right to rectification to correct inaccurate data.
The right to erasure (also known as “the right to be forgotten”) to request the deletion of data.
The right to data portability to transfer data to another service.
The right to object or restrict processing.
Non-compliance can result in hefty fines. Recently:
The GDPR playbook from a Germany-based agency who runs cold outbound
Key takeaways from our AMA with Nicolas Schell of Scalantec
Germany is supposed to be where cold email goes to die. The law says a first cold email to a business needs prior consent. And yet German companies send cold email every day.
So I asked someone who does it for a living. Nicolas Schell is the founder of Scalantec, a GTM agency that mostly serves IT and software clients. His numbers come from about 60 client campaigns over two years:
9.6% average reply rate on plain cold email, against the 1–3% benchmark he cites
A handful of cease-and-desist letters (Abmahnungen) per quarter, at €300–500 each
One letter from a data protection authority, which came from an ignored access request and not from an email
Zero fines and zero court cases
In his words: “It’s a cost line, not a landmine.” Here’s how he gets there.
1. Know the difference between the law, the culture, the perception and the data
“Everyone sends, few get letters, almost nobody gets fined.”
The law. Under § 7 UWG, Germany’s unfair competition law, email advertising needs prior express consent, and there’s no B2B exception. GDPR kicks in as soon as you personalize an address. Nicolas says German courts have held that a single email is enough to break the rule. They’ve also held that the following do not represent consent:
Impressum address (the contact details German companies must publish on their site to show who ‘owns’ the site)
A LinkedIn connection
An opt-out link doesn’t fix anything
Phone is different: a B2B cold call is allowed if you can plausibly presume the business is interested.
The culture. Prospects check your Impressum before they reply. The managing director of a 20-person company will write the cease-and-desist himself. Formality matters, but relevance matters more than cleverness.
A short mail that sounds like a colleague beats a landing page in prose.
The perception. Two opposite myths cancel each other out. “B2B is free” is wrong, and so is “it’s illegal so nobody does it.” US blogs add a third, the claim that first offenses draw €5,000–50,000 fines, which Nicolas says has no source anywhere.
The data. Germany has no regulator policing email. The Bundesnetzagentur, the telecoms regulator, only handles phone spam. Enforcement is private: a competitor or a recipient with a lawyer. Nicolas couldn’t find a single published data protection fine for B2B cold email in Germany.
Subscribe for sections 2-12 that includes
The outbound playbook
What to do if you get caught
A checklist before going live
Scalantec’s tech stack for cold email