Cold email laws: is cold email legal where you sell?

Cold email is legal in many countries if you follow their rules, but the rules differ a lot. In the US, the CAN-SPAM Act lets you email businesses without prior consent, provided you don’t deceive, include a postal address and honor opt-outs within 10 business days. The UK allows B2B email to companies without consent under PECR, while the EU leaves the question to each country. Canada and Australia require consent, but both can infer it from a business address someone has published, if your message is relevant to their role.

Cold email laws compared

United States: CAN-SPAM

The CAN-SPAM Act covers any email whose primary purpose is commercial, and the FTC’s compliance guide for business is explicit that “the law makes no exception for business-to-business email”. It doesn’t require consent before the first email. It requires honesty and an exit:

1. Accurate header information. Your From, To, Reply-To and routing information must identify who sent the message.
2. No deceptive subject lines. The subject must reflect what the email is about.
3. Identify the message as an ad. The FTC gives you leeway on how, but the disclosure must be clear and conspicuous.
4. Include a valid physical postal address: a street address, a PO box registered with the US Postal Service, or a registered private mailbox.
5. Explain how to opt out, clearly, with a mechanism that keeps working for at least 30 days after you send.
6. Honor opt-outs within 10 business days. You can’t charge a fee or ask for more than an email address, and you can’t sell or transfer the addresses of people who opted out.
7. Watch anyone who sends for you. Both the company being promoted and the company that sends can be held responsible.

Each separate email in violation can cost up to $53,088. That is the 2025 figure, which the FTC has said it will keep applying through 2026 in a Federal Register notice. Using addresses that were harvested or generated automatically “by combining names, letters, or numbers” turns other violations into aggravated ones, and some conduct, such as materially falsifying header information across multiple messages, can be criminal.

European Union and EEA: GDPR plus national ePrivacy rules

In the EU, two layers apply at once.

The GDPR: a lawful basis and the right to object

A business email address that identifies a person, such as priya.shah@clinic.example, is personal data, so the GDPR applies to collecting and using it. For cold outreach, the usual lawful basis is legitimate interests under Article 6(1)(f). Recital 47 says that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest” — but the European Data Protection Board, in its guidelines on legitimate interest (version 1.0, October 2024), stresses that this doesn’t make direct marketing automatically lawful. You must show a legitimate interest, that the processing is necessary for it, and that the person’s interests and reasonable expectations don’t override yours. A relevant message to someone in their professional role is far easier to justify than a generic blast. Write the assessment down.

Two duties apply from the very first email:

• Transparency. When you didn’t get the data from the person, Article 14 requires you to tell them who you are, why you’re using their data, where it came from and what their rights are — at the latest in your first communication, if you use the data to contact them. In practice: a line in the email and a link to a privacy notice.
• The right to object. Under Article 21, people can object to direct marketing at any time, and once they do, their data “shall no longer be processed for such purposes”. You must bring this right to their attention clearly, and separately from other information, at the latest in the first communication.

Serious breaches can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher.

ePrivacy: the email rule is national

The second layer is Article 13 of the ePrivacy Directive, which each country writes into its own law. It requires prior consent for marketing email to private individuals, apart from your existing customers, and the EDPB notes that legitimate interest can’t replace that consent. For businesses, the Directive leaves each member state to protect “the legitimate interests of subscribers other than natural persons”, so the rules differ:

• Germany: section 7 of the Act against Unfair Competition (UWG) treats advertising by email without the addressee’s prior express consent as an unacceptable nuisance, and that includes business addressees.
• France: the CNIL says B2B email prospecting can rest on legitimate interest when the subject relates to the recipient’s profession, provided they’re informed and can object simply and free of charge. Generic company addresses such as info@ fall outside those rules.

Check the rule in each country before you email there. Tracking needs a separate look: the EDPB’s guidelines on Article 5(3) of the ePrivacy Directive treat tracking pixels and tracked links in emails as accessing the recipient’s device, which generally requires consent.

United Kingdom: PECR and UK GDPR

The UK splits recipients in two. Under the Privacy and Electronic Communications Regulations (PECR), the ICO explains that the consent rule for marketing email doesn’t apply to corporate subscribers — companies, limited liability partnerships, Scottish partnerships and some government bodies — so you can email their staff at work without consent. You must not disguise or conceal your identity, you must give a valid address for opting out, and the ICO says you should honor those opt-outs.

Sole traders and some other partnerships count as individual subscribers: you need their consent, or the soft opt-in for your own customers. If you can’t tell which a contact is, the ICO’s advice is to treat them as an individual.

UK GDPR applies whenever you hold a named person’s details, even in a business context: you need a lawful basis (usually legitimate interests), you must be open about where you got their data, and they have an absolute right to stop direct marketing. PECR’s cookie rules also cover tracking pixels in marketing emails. Since February 5, 2026, under the Data (Use and Access) Act 2025, the ICO can fine up to £17.5 million or 4% of global turnover for PECR breaches. The ICO notes that its B2B guidance is under review following that Act.

Canada: CASL

Canada’s Anti-Spam Legislation is stricter. You may not send a commercial electronic message without the recipient’s consent, express or implied, and that includes business recipients. It applies when a computer system in Canada is used to send or access the message. Implied consent is what makes B2B cold email possible, mainly in three cases:

• Conspicuous publication: the person has conspicuously published the address — on their company’s website, say — without a statement that they don’t want unsolicited commercial messages, and your message is relevant to their business, role, functions or duties.
• Disclosure: they gave you the address, on a business card at an event for example, without saying they didn’t want such messages, and your message is relevant to their role.
• An existing business relationship: a purchase or contract within the past two years, or an inquiry within the past six months.

Every message must identify you and anyone you send on behalf of, include contact information that stays valid for at least 60 days, and carry an unsubscribe mechanism that costs nothing to use; unsubscribes must take effect within 10 business days. If you rely on consent, the burden of proving it is yours, so record where and when you found each address. Penalties reach C$1 million per violation for an individual and C$10 million for any other person. The Government of Canada’s CASL site has guidance for businesses.

Australia: the Spam Act 2003

Australia’s Spam Act 2003 applies to commercial electronic messages with an “Australian link” — including messages sent from Australia or accessed there — and requires consent, express or inferred. The Act says consent can’t be inferred from the mere fact that an address was published. It can be inferred from conspicuous publication when all of these are true:

• the address reaches a particular employee, officer, office-holder or self-employed person, or a role within an organization;
• it has been conspicuously published, and it’s reasonable to assume that happened with their agreement;
• the publication isn’t accompanied by a statement that they don’t want unsolicited commercial messages; and
• your message is relevant to their work-related business, functions or duties.

Every message must identify who authorized it, say how to contact them, and contain a clear unsubscribe facility that works for at least 30 days after sending; an unsubscribe takes effect within five business days. The Act also prohibits sending commercial messages to addresses you had no reason to believe existed, and using address-harvesting software or harvested lists. The ACMA enforces it with infringement notices and court proceedings; civil penalties are set in penalty units and rise with the number of contraventions and any prior record.

India: the DPDP Act 2023

India has no law aimed specifically at commercial email in the way CAN-SPAM, CASL or the Spam Act are. The law that will matter is the Digital Personal Data Protection Act, 2023, enacted on August 11, 2023. The government notified the DPDP Rules in November 2025 with an 18-month phased compliance timeline, so most obligations for businesses apply from around May 2027.

Once they do, you may process someone’s digital personal data only with their consent or for one of the Act’s “certain legitimate uses”, which are narrow and don’t include marketing to people who haven’t given you their details. Consent notices must explain the specific purpose. The Act doesn’t apply to personal data that people have made publicly available themselves — its own example is someone sharing their views on social media — but how far that reaches in B2B prospecting isn’t settled. The heaviest penalties, up to ₹250 crore, are for the most serious breaches, decided by the Data Protection Board of India. If you also call Indian prospects, TRAI’s rules on unsolicited commercial communication cover calls and SMS, not email.

A compliance checklist for B2B cold email

1. Know where each recipient is. Their country decides which rules apply.
2. Target roles, not lists. Email people whose job makes your message relevant. Relevance is a legal condition in Canada and Australia, and the heart of a legitimate-interest assessment in the EU and UK.
3. Record your source. Note where and when you found each address, especially a published business address you rely on for implied or inferred consent.
4. Identify yourself. Your real name, company and postal address in every email, with an honest From line and subject.
5. Say where you got their data, and link to a privacy notice, in the first email to anyone in the EU or UK.
6. Make opting out easy. A plain opt-out line, plus one-click unsubscribe headers, in every email.
7. Honor opt-outs at once and everywhere: every mailbox, every sequence, every future import. The shortest deadline above is five business days.
8. Treat personal addresses differently. Consumer addresses and sole traders usually need consent in the EU, UK, Canada and Australia.
9. Think twice about tracking for recipients in the EU and UK.
10. Write it down. A short legitimate-interest assessment and a record of opt-outs are your evidence if anyone asks.

How SalesScope handles this

SalesScope can’t decide your legal basis or know where your contacts are — that judgment is yours. It makes the mechanics of careful outreach the default:

• Every campaign email carries a visible unsubscribe link and one-click List-Unsubscribe headers (RFC 8058).
• An unsubscribe click or a reply asking to be removed stops the person at every address and in every sequence, and unclear replies are held as a “possible opt-out” for someone to review.
• A workspace-wide suppression list keeps addresses that unsubscribed, bounced or complained from being emailed again from any mailbox; an admin can allow an address again, with a note.
• Open and click tracking can be switched off for each campaign or sequence.
• Per-mailbox signatures are added to every email automatically, which makes them the natural place for your company name and postal address.

What you may send through SalesScope is set out in our Acceptable Use Policy. See also cold email campaigns and sequences and our Privacy Policy.