Before Your Next Send: Tom Wozniak on Email Compliance, List Health, and the AI Frontier

Email reputation is not a vanity metric. It's infrastructure.

Every campaign, every domain, every send — they all build or erode the thing your entire program depends on. Lose it, and rebuilding is slow, painful, and expensive. For many programs, it's a mistake they don't come back from.

Tom Wozniak has spent nearly three decades figuring out exactly how that happens — and how to prevent it. As COO of Optismo — a recognized leader in suppression list management now in its seventeenth year — he's watched inbox providers evolve from opaque black-box algorithms to publishing explicit sender requirements. A contributing member of the Forbes Communication Council and a member of the Performance Marketing Association's Compliance Council since 2018, he has written extensively on email suppression strategy and data privacy compliance. When he talks about what kills email programs, it comes from a career spent in the middle of it.

He joined Everflow for a fireside chat on inbox integrity in 2026, covering the compliance mistakes that still end programs, the list hygiene discipline that separates senders who scale from those who stall, and what AI is about to do to the inbox experience.

Here's what he said.

The One Compliance Failure That Can End Your Program

If there is a single mistake capable of shutting down an email program immediately, it's mailing to people who have already opted out. Suppression management is, as Wozniak puts it, table stakes — but that doesn't mean it's foolproof.

For in-house lists, most sophisticated ESPs automate unsubscribe handling and the risk is relatively low. The danger spikes when you're marketing third-party offers. In those cases, you're responsible for downloading a suppression file from the advertiser and manually cleansing your list against it before every send.

"If you screw up that process somehow and mail people who've unsubscribed, yeah, the inbox providers are gonna figure it out." — Tom Wozniak

The consequences extend well beyond a deliverability hit. Mailing to opted-out addresses at scale draws FTC scrutiny and exposes your business to legal action. It's not a recoverable error for programs that depend on volume.

Beyond the federal level, Wozniak pointed to a California business code that has caught a meaningful number of mailers off guard. It flags the use of domain privacy protection on sending domains as a potential violation — something many businesses do by default, with no intent to deceive.

His guidance: review your compliance program with legal counsel at least once a year, specifically to catch new state-level requirements before they become a problem.

One Level Up: What Rigorous List Hygiene Actually Looks Like

Suppression compliance is the floor. What separates senders who scale sustainably from those who hit deliverability walls is everything above it.

The next layer is list validation: confirming that the email addresses in your database are real, correctly formatted, and routed to active inboxes. Work email addresses are especially volatile. When someone leaves a company, that inbox gets deactivated — but it often stays in your list indefinitely. Keep mailing to it, and ISPs treat it as evidence you don't know what you're doing.

"We get in a rut. We stop thinking outside the box and just sort of go through the motions." — Tom Wozniak

That comfort with routine is where list decay sets in. Wozniak advises digging into engagement data — specifically, who hasn't opened, clicked, or converted in a meaningful period of time. But he resists prescribing a universal rule.

"At a minimum, push those incredibly inactive emails off into a separate list that you maybe don't mail as often." — Tom Wozniak

The right threshold depends entirely on your business. A seasonal mailer selling holiday products shouldn't be culling non-openers in June — those people just haven't had a reason to engage yet. But a sender who hasn't segmented inactive contacts in years is almost certainly mailing dead weight — paying for it in deliverability and suppressing the performance of every send in the process.

The goal isn't to shrink your list. It's to ensure that every send is reaching someone who is, at minimum, plausibly reachable.

The Transparency Shift: How Gmail and Yahoo Changed the Rules

For most of email's history, inbox providers adjusted their filters without notice. A sender's deliverability could collapse overnight, and the only way to recover was through months of trial-and-error reverse engineering.

That changed when Gmail and Yahoo jointly published explicit bulk sender requirements — covering spam complaint thresholds (0.3%), domain authentication standards, and CAN-SPAM alignment. For the first time, mailers knew exactly what was expected.

Wozniak's reaction was uncomplicated:

"Give me rules and I'll follow those." — Tom Wozniak

He views this as a genuine shift in the sender-ISP relationship — and a welcome one. Before the published requirements, the system rewarded those most willing to experiment and absorb ambiguity. Now there's a legible baseline any mailer can follow with confidence.

He expects this trend to continue. As Gmail and Yahoo assess the impact of their current standards, they'll almost certainly revise them — and Wozniak is cautiously optimistic they'll keep announcing those changes rather than quietly updating the algorithm. Microsoft has already issued similar requirements, and his hope is that the major providers eventually converge on shared standards.

What AI Is About to Do to Your Inbox

The most forward-looking part of the conversation concerned AI — and Wozniak made clear it's not a distant concern.

Gmail has been experimenting with AI-generated email summaries: a feature that could, in practice, replace preview text as the first thing a recipient sees in the inbox. For transactional emails or straightforward promotional copy, this might work fine. For campaigns that depend on humor, creative framing, or curiosity gaps, it introduces real uncertainty.

If an AI summary misrepresents what's in an email — even without any intent to deceive — does that create a CAN-SPAM exposure? Wozniak thinks it's a question that attorneys and regulators will eventually test in court. Marketing copy that's meant to be playful could produce a summary that sounds deceptive.

And then there's the broader question he posed out loud: if marketers are using AI to write their emails, and inbox providers are using AI to moderate them, at what point is it AI marketing to AI?

"I don't even know how that works," he said.

Your 2026 Email Audit: Where to Start

Wozniak's concrete recommendation was to use the relative quiet of the holiday slowdown to conduct a full compliance and data review before Q1. Programs that skip this review tend to find out why they should have done it mid-campaign — during a high-volume send when there's no good time to fix it. Here's how he structures the priorities:

• Start with suppression. Confirm that your unsubscribe handling is genuinely automated and airtight. If you're running any third-party offer sends, map the suppression file download and cleanse process end-to-end.
• Validate your list. Remove malformed addresses, deactivated inboxes, and undeliverable domains. Run addresses through a validation service before your next high-volume campaign.
• Segment your inactives. Pull subscribers who haven't engaged in a meaningful period. Move them to a lower-frequency list and treat reactivation as its own deliberate campaign objective.
• Review your data practices. Document why you are holding PII. Data privacy frameworks now exist in more than twenty US states, and holding data without a clear business purpose creates liability.

"The more you understand your audience by the data you have, the better you can create a message that will connect with them." — Tom Wozniak

Four Actions to Take Before Your Next Campaign

• Run a suppression audit this quarter. Review your unsubscribe handling end-to-end, especially for any sends involving third-party suppression files.
• Validate your list before your next major campaign. Use an email verification service to remove dead, malformed, and undeliverable addresses from active segments.
• Create an inactive subscriber segment. Identify contacts who haven't engaged in 6–12 months, move them to a reduced-frequency list, and build a reactivation campaign.
• Audit your data privacy posture. Catalog the PII you hold, confirm you have a documented use case for each, and consult counsel on state-level privacy regulations.

Email reputation is infrastructure — and like all infrastructure, it's invisible when it's working and catastrophic when it's not. Wozniak's framework isn't about compliance theater. It's about building the foundation that gives every campaign above it a real chance of performing.

‍