A Lead from Social starts with public activity, but public does not mean anything goes. The people behind every profile have rights, and the rules protecting them are getting stricter. Teams that treat privacy as part of the playbook, not an obstacle to it, build channels that last.
This article is general information, not legal advice. Check the rules for your markets with a qualified adviser.
Six principles
- Have a lawful basis. Know why you are allowed to use each piece of data, for each purpose, in each country.
- Use data for a clear purpose. Data collected to understand an audience should not quietly become a cold calling list.
- Use only what you need. Most campaigns need far fewer fields than a full profile.
- Make opting out easy. One click, honored quickly, in every message.
- Keep data for a limited time. Delete or refresh lists you no longer use.
- Follow platform terms. Ad platforms set their own rules for uploading customer lists.
The main rules by market
| Market | Main rules | What it means for outreach |
|---|---|---|
| Vietnam | Decree 13/2023/ND-CP on personal data protection; the Personal Data Protection Law passed in 2025 | Consent is central; tell people how their data is used and let them withdraw |
| European Union | GDPR | A lawful basis for every use, strong rights for individuals, strict rules for direct marketing |
| Canada | CASL and PIPEDA | Commercial email needs consent, plus identification and an unsubscribe option |
| United States | Federal commercial email law and a growing set of state privacy laws | Honest headers and subject lines, a working opt-out, and state-specific rights |
What this looks like in practice
- Lead with ads, not cold messages. Paid social targeting lets people discover you and opt in on their own terms. See From List to Ad Set.
- Collect consent on your own form. Then build your email program on that consent. See The First 30 Days.
- Respect community rules. If a group forbids advertising, do not post offers in it.
- Never imply a relationship. Do not use a community's or a brand's name in your ads to suggest you are connected to it.
Privacy-first and performance are not opposites: people who choose to hear from you convert better and complain less. Explore audiences and plan your campaign on that basis.
