US market-entry GTM stack guide for EU companies

In the United States, CAN-SPAM defines commercial email by its primary promotional purpose, without a corporate-recipient exemption. A B2B SaaS pitch is not transactional merely because it comes from an account executive. Federal CAN-SPAM does not impose a general prior-opt-in requirement for ordinary commercial email, but requires truthful headers and subjects, advertisement identification unless its narrow affirmative-consent exception applies, a valid physical postal address and a functioning opt-out. Keep that mechanism working for at least 30 days and honor requests within 10 business days. EU processing and applicable sender-country channel rules still need separate review.[1][2][8]

For US phone outreach, TCPA restrictions distinguish the technology and line type. Calls to wireless numbers using a covered automatic telephone dialing system or artificial/prerecorded voice are restricted. Telemarketing calls within those categories generally need prior express written consent; prerecorded telemarketing to residential lines also has that gate. SMS is not an email workaround. A genuinely manually dialed call with a live speaker does not trigger that automated/prerecorded restriction merely because the number is mobile. It is not blanket permission to call. Have counsel classify the actual dialer, not its 'manual' marketing label.[3][4]

The FTC TSR exemption concerns calls inducing a purchase by a business, not any call to someone employed by a business. Its 2024 final amendment preserved the qualified B2B exemption while applying prohibitions on material misrepresentations and false or misleading statements. Ordinary software B2B calls are therefore distinct from consumer calls subject to TSR National DNC restrictions. Selling personal-use goods to an employee is not the business-purchase category. FCC protections remain separate, including residential DNC protections and the presumption for wireless subscribers who register. Never treat a purchased mobile number as consent or a job title as proof of business-line status.[5][4]

State overlays need their own scope assessment. Florida's section 501.059 defines telephonic sales calls around consumer goods or services normally used for personal, family or household purposes. Its automated-selection-and-dialing or recorded-message rule requires prior express written consent for unsolicited calls within that scope. Separately, subsection 5 prohibits outbound calls, texts and voicemail to a consumer, business or donor who has told the caller to stop. Do not universalize Florida's consumer automation provision to all B2B software, or universalize the federal B2B exemption to every state. Our assessment is a state-by-state launch gate that also reviews recording, calling hours and registration before dialing.[6][5]

LinkedIn is a separate workflow. Its User Agreement prohibits scraping profiles and using bots or unauthorized automated methods to add contacts or send messages. GDPR consent requires an affirmative, informed act; profile visibility or accepting a connection is not that act for an unrelated campaign. Our assessment is human account research and relevant, individually reviewed messages through permitted features, with objections recorded in the CRM. Neither CAN-SPAM compliance nor a LinkedIn seat authorizes a scraping-and-DM sequence.[7][8]

An EU-established controller does not shed GDPR duties by targeting US buyers. Article 3 covers processing in the context of its EU establishment even outside the EU. Identify an Article 6 basis for named-contact enrichment; legitimate interests requires the necessity and rights-balancing conditions and is not marketing consent. For indirectly sourced records, Article 14 generally requires transparency within one month, or by the first communication or disclosure if earlier, subject to its exceptions. Article 21 requires direct-marketing processing to stop on objection. Article 28 requires contracts and sufficient guarantees for processors. Classify each vendor's role instead of assuming every data seller is your processor.[8]

For GDPR-covered exports to the US, DPF adequacy applies to certified recipients. The decision requires annual recertification and entry on the DPF list; certification submissions identify the covered personal data and purposes. Verify the contracting entity and covered transfer, not only a parent brand's badge. DPF does not replace lawful basis, transparency or processor contracts. The Commission also publishes SCCs for appropriate transfers outside the EU/EEA. Our assessment is to document the chosen mechanism, applicable SCC module and transfer-risk review where needed, plus subprocessors and onward access. EU hosting alone should not close that review.[8][9][10]

US state privacy scope is not one nationwide threshold. California's CPPA business factsheet identifies for-profit entities doing business in California that determine processing purposes and means, subject to exemptions and other entity rules. Its listed alternative thresholds are previous-year gross revenue over $26,625,000; buying, selling or sharing information of 100,000 consumers or households; or at least 50% of annual revenue from selling or sharing personal information. Virginia instead uses 100,000 consumers, or 25,000 plus over 50% of gross revenue from personal-data sales, and excludes people acting in a commercial or employment context from its consumer definition. Do not transplant that Virginia exclusion into another state's analysis.[11][12][13]

Apollo documents person-location filters across US states, cities and ZIP codes, separately from employer-headquarters filters. Its People API Search does not return email addresses or phone numbers; those require enrichment. A headquartered-in-US filter therefore does not establish that the contact lives in an approved state, and a search result is not a usable direct dial. The checked documentation establishes these filtering and workflow distinctions, not audited US ICP recall, accuracy or compliant sourcing for your campaign.[14]

Our assessment is a small permissioned sample stratified by target state, company size and buying role before an annual data contract. Measure current employer, role fit, person location, validated work email and independently classified phone type. Keep unavailable data distinct from incorrect data and report the denominator for every result. Compare cost per accepted contact after suppression, not raw search counts. Evaluate another provider only against the same sample and rules; the checked Apollo docs do not prove superiority over alternatives.[14]

Our assessment is to localize the commercial handoff, not merely translate the EU deck into US English. Assign an AE and a CS owner for each accepted account. Publish actual availability for Eastern and Pacific customers, with a separate escalation path when EU engineering is offline. Use explicit dates and named time zones in invitations and order forms. Write discovery around the buyer's operating cost and approval process; prepare a US-English security packet and implementation plan rather than promising unsupported local references.

Our assessment is to route by buyer location and service need, while retaining the global account hierarchy for EU-parent companies with US subsidiaries. The AE handoff should name the purchasing entity, economic buyer, security reviewer, implementation owner, agreed success measure and unresolved contractual exceptions. CS should receive the same record before signature. Pilot one segment and review accepted meetings, opportunities and onboarding failures before adding states or hiring another SDR team. A meeting booked outside staffed hours is not a successful localization outcome.

Stripe ACH Direct Debit accepts US bank accounts in USD and supports recurring payments and cross-border use for listed eligible merchant locations, including EU countries. Eligibility is not automatic; Stripe lists restrictions, including EU digital-goods businesses. Confirm your own product and account before promising ACH. Stripe requires customer authorization and bank-account verification; a merchant of record outside the US must supply the customer's complete billing address. Standard settlement is four business days and acknowledgement can be delayed. Our assessment is to reconcile asynchronous failures and disputes rather than mark an invoice paid when bank details arrive.[15]

Washington illustrates why foreign SaaS exporters need state-specific tax review. Its remote-seller guidance requires registration to report B&O tax and collect applicable sales tax when combined Washington gross receipts exceed $100,000 in the current or prior year, or the seller is organized or commercially domiciled there. The receipts calculation includes exempt sales. For a seller newly crossing the threshold without meeting it in the previous year, collection begins on the first day of the month starting at least 30 days later. Washington treats remote access software as a retail sale subject to sales or use tax, with scoped exemptions. These are Washington rules, not a universal SaaS tax rate or national threshold.[16][17]

Our assessment is to reconcile sales across Stripe, annual invoices and any reseller channel before each state exposure review. Have tax counsel resolve physical presence, product classification, sourcing, registration and exemptions before configuring collection. Use an invoice template with the correct seller and buyer entities, currency, service period, purchase-order reference, due date and any applicable tax. This is an operating recommendation, not a universal US statutory invoice format or a claim that every EU exporter must form a US company.[16][15]