Why I refused to build a form-spam tool (and what I built instead)

I'm going to name names, because pretending these companies don't exist is exactly what lets them keep operating: InsaneLeads, OpenIntel, and roughly a dozen knock-offs ship the same product. You pay them $200-$500/month, they crawl the internet for contact forms, and they auto-submit a template message into every one. Volumes of 10,000-50,000 per month are normal. The pitch is that it's "AI-personalized" — it isn't, the personalization is a merge tag — and that it's "compliant" — it isn't, that part I want to walk through.

When I started Outreach in February of this year, my v1 spec literally included form-auto-submit. The reasoning was lazy: the competitors do it, customers ask for it, the tech is trivial (Playwright + a form-field classifier). Then I spent a weekend reading the actual law and the actual enforcement record, and I deleted the feature.

The legal exposure is not theoretical

Three regimes matter for B2B cold outbound: CAN-SPAM in the US, CASL in Canada, and GDPR (plus the ePrivacy Directive) in the EU and UK. Form-submission tools blow through at least one of them on every send.

• CAN-SPAM (US): requires a valid postal address, accurate sender info, and a working opt-out mechanism in every commercial email. Submitting a form on a website with a templated pitch isn't an email — but the website owner's auto-responder to the form often is, and now you're the cause of a commercial message they're sending on your behalf without compliance. The FTC has fined under this exact theory.
• CASL (Canada): requires express or implied consent before sending a commercial electronic message. Form submission counts. Penalties are up to $10M per violation. Compu-Finder paid $1.1M in 2015 for a small fraction of what these tools do daily.
• GDPR + ePrivacy (EU/UK): requires a lawful basis for processing personal data, and contact form submissions to identifiable individuals are personal data processing. "Legitimate interest" is the usual defense for B2B outbound, and it requires (a) a balancing test, (b) data minimization, and (c) an easy opt-out. Templated form-spam fails the balancing test on its face.

Right now, enforcement is rare because nobody has bothered. But the legal architecture is loaded. The first time a Fortune 500 GC's contact form gets hit by 200 form-spam submissions in a quarter — and they pull the receipts on who originated them — somebody is getting sued. Probably the SaaS, not the user. But possibly both.

Building a tool that's technically legal in 2026 but obviously illegal in 2028 is a great way to have a great year and a terrible year three.

The reputation damage is immediate

Even if you're never sued, every form-spam send burns three things: the recipient's tolerance for your brand, the sender's domain reputation (because the auto-responder bounces, complaints, and "WTF is this" replies all hit your sending domain), and the broader B2B outbound ecosystem's tolerance. Every form-spammer makes Gmail's filter slightly more aggressive about everyone else's cold email.

I've watched two friends' startups blocklist their entire sending domain within 90 days of starting on one of these tools. The recovery process is six months and a new domain. Sometimes it's the same domain their actual customer-facing email runs on. That's a real cost that doesn't show up in the demo.

The ethics question — and yes, I'm going to talk about it

The hand-wave defense of these tools is that "businesses publish contact forms because they want to be contacted." That's true for one prospective customer at a time. It's not true for a sales tool that scrapes 50,000 forms and submits a template. A contact form is a door, not an open warehouse. The fact that you can open the door doesn't mean you should send 10,000 people through it.

I'm a founder. I do cold outbound. I'm not pretending this is a moral high ground. But there is a difference between "I emailed 200 carefully-selected people about a thing I think they'd want" and "I had a bot fill out 50,000 contact forms with a templated pitch." One of those is sales. The other is the email equivalent of robocalling, and we already passed federal laws against robocalling for a reason.

What an ethical alternative actually looks like

After I deleted the form-submit feature, I rebuilt around the constraint. The result was Outreach: prospects come from public business data (Google Maps, public company info), enrichment uses only their own published website, personalization uses Claude to read each prospect's homepage and write a unique two-sentence opener (no merge tags), and the send mechanism is plain email via Resend with proper SPF/DKIM, throttled volumes, and List-Unsubscribe headers.

The result is slower — you can't send 50,000 messages in a day — but it works better. Reply rates run 4-7% instead of the sub-1% you see on form-spam. Domain reputation stays healthy. Nobody sues you. Customers come back and renew.

• Search prospects from Google Maps public data (no ToS violations)
• AI personalization that reads the prospect's actual homepage (not merge tags)
• Plain email via Resend with SPF/DKIM and List-Unsubscribe configured by default
• Throttled to 500/day max on Pro, with a built-in warm-up curve
• Per-workspace unsubscribe list honored across all sequences
• No form auto-submit. No captcha bypass. No LinkedIn scraping.

If you're using one of these tools

I'm not here to lecture you. The tools exist because there's real demand for the outcome — booked meetings. If you're using one, three things worth doing today: send from a domain you don't care about (not your main brand domain), keep volumes low enough that you'd be embarrassed but not litigated, and read the actual ToS of one of the sites you submit forms to. The wording will surprise you.

And when you decide you want the booked meetings without the legal exposure, Outreach is here. Read about what real open rates look like in 2026 and the 1-line opener that gets a 40% reply rate — both work without a bot.