For our CAN complience, we emailed a request for permission to email (and subsequently removed all that didn't reply) with the following:
Lead.Inferred Country: CAN
OR
Lead.Country: CAN
OR
Account.Country: CAN (some leads don't have country, but are associated with an account that does)
The "inferred country" would grab any that have visited our site and we have an IP address for, the Lead.Country for any leads that we acquired through a vendor, and the Account.Country grabs any leads that sales have uploaded (since they are required to associate with an account that has an address at minimum).
There is a chance that some US employees for CAN owned companies got excluded (because of the Account.County = CAN part) but our idea was we'd rather be emailing too few than too many.
And we don't want to get slapped with a lawsuit.