TL;DR
Sequences that continue emailing after a clear opt-out signal are a common source of spam complaints and compliance risk, with CASL penalties reaching up to CAD 10 million per violation. Treating "not now" replies as an automatic stop signal can also cost conversions that would have closed later with a longer follow-up cadence.
The article provides a reply-state decision tree mapping eight common responses—including hard bounces, wrong person, and legal threats—to specific actions like stop, continue, or escalate. Use body-text scanning for phrases like "remove me" and "stop emailing" to catch opt-outs beyond the literal word "unsubscribe," and escalate any reply containing "complaint" or "cease and desist" to a compliance review immediately.
Most cold email campaigns fail not because of poor open rates, but because senders don't know when to stop. One of the highest-leverage changes a team can make is implementing a reply-state decision tree that maps every possible recipient response to a specific action: stop, continue, or escalate. Without this, sequences bleed into dead leads, burn sender reputation, and risk regulatory penalties.
This article provides a complete, compliance-aware decision framework for each reply state, grounded in CAN-SPAM, GDPR, and CASL requirements.
The Core Problem: Indiscriminate Persistence
Direct answer: The default behavior in most sales engagement platforms is to keep sending until a sequence's maximum touch count is reached. Sequences that continue emailing after a clear opt-out signal are a common source of spam complaints and unsubscribe-related friction. That is not just annoying—it is legally risky.
Under Canada's Anti-Spam Legislation (CASL), sending a commercial electronic message after receiving an unsubscribe request carries penalties of up to CAD 10 million per violation. Under GDPR, Article 17 gives data subjects the right to erasure, and continued contact after an objection can be treated as a supervisory authority complaint trigger.
The decision tree solves this by treating every reply as a state machine transition. Once you classify the reply, you execute a deterministic action.
The Reply-State Decision Tree
Direct answer: The eight most common reply states fall into three action categories: Stop, Continue, and Escalate. Each state includes the trigger phrase or signal, the recommended action, and the compliance implication.
Stop States (Immediate Sequence Termination)
These replies indicate the recipient has affirmatively opted out, is the wrong person, or is unreachable. Continuing past any of these is a compliance violation or a waste of resources.
| Reply State | Typical Signals | Action | Compliance Note |
|---|---|---|---|
| Hard Bounce | SMTP 550, 551, 552, 553, 554; "address rejected" | Remove immediately; suppress permanently | GDPR Art. 5(1)(d) requires accurate data; bounces indicate invalid data |
| Unsubscribe | "unsubscribe", "remove me", "stop emailing me", "opt out" | Remove from all sequences; add to suppression list | CAN-SPAM mandates 10-business-day opt-out processing; CASL requires immediate |
| Wrong Person | "I'm not the right contact", "wrong person", "I don't handle this" | Remove from sequence; optionally log for re-routing | No compliance risk, but continuing wastes sender reputation |
| Out of Office | Auto-reply with dates; "I'm out of the office until [date]" | Pause sequence until return date; do not delete | No legal requirement, but sending during OOO hurts deliverability |
Detecting unsubscribe intent by matching only the literal word "unsubscribe" in a subject line misses a large share of opt-out signals — phrases like "remove me" or "stop emailing" appear in the body far more often. Scanning body text, not just subject lines, for these variants materially reduces continued sends to contacts who have already opted out.
Continue States (Sequence Proceeds as Planned)
These replies indicate the recipient is engaged but has not yet converted. The sequence should continue, possibly with a modified cadence or content.
| Reply State | Typical Signals | Action | Compliance Note |
|---|---|---|---|
| Not Now | "not interested right now", "too busy", "reach out in Q3" | Continue sequence but extend delay; add to nurture track | No compliance issue; treat as positive engagement |
| Positive Interest | "tell me more", "let's set up a call", "send me pricing" | Escalate to sales; stop the sequence immediately | No compliance issue; transition to human touch |
| Referral | "talk to [name] at [company]", "you should contact [person]" | Stop sequence for original contact; start new sequence for referral | Requires consent for new contact under GDPR Art. 7 |
Important nuance: "Not now" is the trickiest state. Treating it as a hard stop signal is a common mistake that can cost eventual conversions that would have closed later. The correct action is to extend the interval—move from a 3-day cadence to a 21-day cadence—and change the messaging from "why us" to "when you're ready."
Escalate States (Human Intervention Required)
These replies require a person to read, interpret, and respond. Automation should not handle them.
| Reply State | Typical Signals | Action | Compliance Note |
|---|---|---|---|
| Objection | "your price is too high", "we already use [competitor]", "security concerns" | Flag for sales; stop automated sequence; send personalized reply | No compliance issue, but canned responses to objections damage trust |
| Compliance/Legal Threat | "cease and desist", "I will report you", "this is spam" | Immediately stop all contact; suppress permanently; notify legal team | GDPR Art. 21 gives right to object; CASL requires immediate cessation |
For example, a reply containing a phrase like "I am filing a complaint with the [regulator]" should immediately trigger escalation to a compliance review and full suppression of the contact — waiting for the next scheduled send to go out before a human reviews the thread turns a resolvable complaint into a much bigger problem.
How to Implement a Reply-State Decision Tree in Your CRM
Direct answer: Follow these seven steps to build and deploy your own decision tree. This approach applies to most sales engagement and CRM platforms, including HubSpot, Salesforce, and Outreach.
Step 1: Audit Your Current Reply Data
Export the last 6 months of replies from your cold email sequences. Classify each reply into one of the eight states above. Count how many replies fell into each category. This gives you your baseline.
Metric to track: What percentage of replies were "stop" states that your system ignored? If it is above 2%, you have a compliance exposure.
Step 2: Define Trigger Patterns for Each State
Create a regex or keyword list for each state. For example:
- Unsubscribe:
\b(unsubscribe|opt.out|remove.me|stop.emailing|take me off)\b - Out of Office:
\b(out of office|ooo|vacation|on leave|return.*[date])\b - Objection:
\b(too expensive|competitor|not a fit|security concern)\b
Pro tip: Use negative lookaheads to avoid false positives. For example, "not interested right now" should match "not now" but not "I am not the right person."
Step 3: Configure Your CRM's Automation Rules
In most platforms, you can create a workflow that triggers on email reply. Map each trigger pattern to an action:
- Stop: Change contact status to "Suppressed" or "Unsubscribed." Remove from all active sequences.
- Continue: Add a delay of 14-21 days before the next touch. Optionally change the email template to a "checking in" variant.
- Escalate: Assign the contact to a sales rep or compliance queue. Send an internal notification.
Step 4: Add a Human Review Queue for Escalated States
Do not let automation handle objections or legal threats. Create a shared inbox or CRM view where escalated replies appear. Set a service-level agreement: legal threats within 4 hours, objections within 24 hours.
Step 5: Test with a Small Segment
Run the decision tree on a small segment of contacts for two weeks. Manually audit every reply to check for misclassifications. Watch in particular for "not now" being misclassified as "unsubscribe" because of the word "stop" appearing in phrases like "stop contacting me for now" — require "stop" to appear within a few words of "emailing" or "contacting" to avoid this kind of false positive.
Step 6: Roll Out with Compliance Documentation
Document every trigger pattern, action, and escalation path. Under GDPR Article 30, you must maintain records of processing activities. Your decision tree logic is part of that record. Store it in your data processing register.
Step 7: Monitor and Iterate Monthly
Language evolves. "Not interested" might become "not a priority" or "not in scope." Review your trigger patterns monthly against new reply data. Add new patterns, remove false positives, and re-test.
Frequently Asked Questions
What if a recipient replies with both an objection and an unsubscribe request?
The unsubscribe request takes priority. Under CAN-SPAM, any message that contains an opt-out request must be honored regardless of other content. Process the unsubscribe first, then log the objection for internal analysis. Do not send a follow-up asking for clarification.
Can I continue sending to someone who says "not now" after 90 days?
Yes, but only if you have a legitimate interest under GDPR Article 6(1)(f) and the recipient has not unsubscribed. Some "not now" replies do convert months later if re-engaged with relevant new content. However, you must re-verify consent or legitimate interest before re-contacting after a long pause.
How do I handle auto-replies that are not out-of-office?
Auto-replies like "I will respond as soon as possible" or "thank you for your email" are not out-of-office signals. Do not pause the sequence for these. They are typically server-generated or generic and do not indicate recipient unavailability.
What if the recipient replies in a language I do not support?
If your sequence is in English and the reply is in Spanish, French, or German, treat it as an escalation. A human who speaks the language should classify the reply. Do not rely on machine translation for compliance-critical states like unsubscribe or legal threat.
Does the decision tree apply to SMS or LinkedIn sequences?
The same logic applies, but the compliance frameworks differ. SMS is governed by the Telephone Consumer Protection Act (TCPA) in the US, which requires prior express written consent. LinkedIn InMail is governed by LinkedIn's User Agreement, which prohibits automated messaging. Adapt the tree to each channel's specific rules.
How do I handle replies that do not match any state?
Default to escalation. If you cannot classify a reply, a human should read it. Do not let the sequence continue automatically on an unclassified reply. Unclassified replies often contain nuanced objections or complex questions that automation cannot safely interpret.
Sources
- Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business
- European Data Protection Board, Guidelines on Consent under Regulation 2016/679 (Article 7)
- Government of Canada, Canada's Anti-Spam Legislation (CASL) Compliance and Enforcement
- HubSpot, Sales Engagement Platform Documentation: Workflow Triggers for Email Replies
- Salesforce, Email Studio: Automated Reply Handling Best Practices
- Outreach, Sequence Rules and Reply Detection Configuration
Final Takeaway
Direct answer: A cold email sequence should stop the moment the recipient signals they are done—whether through an unsubscribe, a hard bounce, a "not now," or a legal threat. The decision tree is not a nice-to-have optimization; it is a compliance necessity and a sender reputation safeguard. Implement the eight-state classification, map each to stop/continue/escalate, and audit your results monthly. Stop guessing when to stop. Let the recipient tell you.
