Cold email is legal in the United States. You can write to a stranger at a business without asking first, as long as the message follows a short list of rules. Cross a border and the answer changes. The UK, the EU and Canada each draw the line in a different place, and the inbox providers draw a line of their own that no law requires.
This guide covers what each regime asks of a sender, in plain terms, with the source for every rule. It is written for businesses that run outbound, or are about to hire someone who does. It is not legal advice, and if you send at volume into a country with strict rules, a lawyer who knows that country’s e-privacy law is worth an hour of your money.
The short answer by market
| Market | Consent needed before the first email? | The rule that bites |
|---|---|---|
| United States | No | Opt-out, honest headers and a postal address in every message |
| United Kingdom | Not for limited companies; yes for sole traders | Who counts as a business |
| European Union | Depends on the country | A lawful basis under GDPR, plus each country’s e-privacy law |
| Canada | Yes, but implied consent can count | Whether the address was published for business use |
The table is the summary. The detail that changes what you send sits underneath.
United States: CAN-SPAM
The US runs on an opt-out model. Nobody needs to agree to hear from you first. They need to be able to make you stop, easily, and you need to stop when they ask.
The FTC’s CAN-SPAM compliance guide states that the law “makes no exception for business-to-business email.” Every commercial message must carry accurate From and routing information, a subject line that matches the content, a clear disclosure that the message is an ad, a valid physical postal address, and a plain explanation of how to opt out. The opt-out has to keep working for at least 30 days after you send, and you must honor a request within 10 business days. Each email that breaks the rules can cost up to $53,088.
Three parts of that trip people up.
The postal address. A sender with no office still needs one. The FTC accepts a street address, a registered PO box, or a private mailbox at a registered commercial mail receiving agency.
The opt-out cannot cost the recipient anything. You cannot charge a fee, ask for more than an email address, or make them do more than reply or visit a single page. Once someone opts out you cannot sell or hand over their address, even as part of a list.
Hiring someone does not move the liability. The FTC says plainly that you cannot contract away your responsibility. If an agency sends on your behalf and gets it wrong, the business promoted in the email and the business that pressed send can both be held responsible. So ask any outbound partner how they handle opt-outs across every mailbox they run for you, and expect a specific answer.
United Kingdom: PECR and UK GDPR
The UK splits recipients by legal form. The ICO’s guidance on electronic mail marketing says you can send marketing emails to companies without consent, and that it is good practice to keep a do-not-email list of any company that objects.
Individuals are a different matter. You need their specific consent, or the “soft opt-in,” which only covers people who bought something similar from you and were given a chance to opt out. The ICO is explicit that the soft opt-in does not reach new contacts from bought-in lists.
The catch is who counts as an individual. Sole traders and some partnerships do, so a one-person accountancy or a family plumbing firm is treated like a consumer. Before writing into the UK, sort your recipients by legal form, and drop any you cannot place.
Separately, the person reading the email at a limited company is still a person. UK GDPR governs how you hold their name and address, which brings in the same lawful-basis question as the EU.
European Union: GDPR plus national law
GDPR does not ban cold email. It asks whether you have a lawful basis to use someone’s personal data, and a work address with a name in it is personal data. For direct marketing, the usual basis is legitimate interest. Recital 47 of the GDPR says processing for direct marketing purposes “may be regarded as carried out for a legitimate interest,” provided the interests of the person you write to do not override yours.
That “may” carries weight. Relying on legitimate interest means you have done the weighing. The message is relevant to the person’s job, they could reasonably expect it, and you tell them where you got their details and how to object. Write that reasoning down before the campaign, not after a complaint.
GDPR is only half of it. Each member state also has national e-privacy rules on unsolicited electronic messages, and they do not agree with each other about business addresses. Some treat a named address at a company like a consumer’s and want consent. Others allow B2B email on an opt-out basis. There is no single EU answer, so check the specific country before you send.
Canada: CASL
Canada is the strictest of the four on paper. Its anti-spam law requires consent before a commercial electronic message, and it does not carve out business recipients the way the UK does.
What saves B2B outreach is implied consent. Under section 10(9)(b) of CASL, consent is implied when three things hold together. The person published the address conspicuously, or had it published. The publication does not say they refuse unsolicited commercial messages. And your message is relevant to their business, role, functions or duties.
All three have to be true. An executive’s address on their company’s contact page, with no “no solicitations” note, written to about something in their remit, fits. An address obtained some other way, with no published source you can point to, does not. If you write into Canada, keep a record of where each address was published and on what date.
What Gmail and Yahoo require, which no law does
A message can satisfy every law above and still never reach the inbox. The two largest consumer mailbox providers now set their own rules, and they enforce them by filtering.
Google’s sender guidelines apply to everyone sending to Gmail accounts: authenticate with SPF or DKIM, keep the spam rate reported in Postmaster Tools below 0.3%, and format messages to the internet standard. Senders who pass 5,000 messages a day to Gmail accounts must also publish DMARC, align the From domain with SPF or DKIM, and support one-click unsubscribe on marketing messages.
Yahoo’s sender best practices set the same 0.3% ceiling on spam rate, require a working list-unsubscribe header for bulk senders, and ask that you honor unsubscribes within 2 days. The same page tells senders not to buy mailing lists.
Compare that window with CAN-SPAM’s ten business days. The law allows two working weeks. Yahoo asks for two days. If you run outbound across several mailboxes, the unsubscribe has to reach all of them the same day, which in practice means one suppression list shared by every sending account.
Authentication is also the part most likely to be quietly broken before anyone sends a thing. You can check a domain’s SPF, DKIM and DMARC records in a few seconds.
A compliant cold email, in practice
Put the rules side by side and they converge on one message shape that works in every market above where cold email is allowed at all:
- A real sender. Your name, your company, a domain you own and have authenticated.
- A subject line that describes the email. No fake “Re:” and no invented urgency.
- A reason this person. One line on why their role makes the message relevant. It is the core of a GDPR legitimate-interest case and of CASL’s implied consent, and it is also what gets replies.
- Where you got their details, for recipients in the UK and EU.
- A postal address and a one-step opt-out at the foot of every message.
- Suppression that works everywhere. An opt-out from one mailbox stops every mailbox, within the shortest deadline you are subject to.
The rules and the replies point the same way. An email written to one person about something in their job, from a sender who is easy to identify and easy to stop, is both the compliant email and the one people answer. The email that breaks the rules is usually the one that was never going to work: a bought address, a vague subject, a sender hiding behind a throwaway domain.
Where to go from here
If you run your own outbound, the six points above are the checklist. Audit your current sequence against them before the next send.
If you are deciding whether to run it yourself at all, our comparison of hiring an SDR vs. outsourcing outbound covers who should own this work. If you want it built and run for you, with these rules handled inside the system rather than remembered by a person, that is what our outbound lead generation does.
Common questions
Is cold email legal in the United States?
Yes. CAN-SPAM does not require consent before a commercial email, and it covers business-to-business email the same as consumer email. Each message needs accurate sender details, an honest subject line, a disclosure that it is an ad, a valid postal address, and a working opt-out that you honor promptly.
Can I send cold email to businesses in the UK?
To a limited company, yes, under PECR, though you should keep a list of companies that object. Sole traders and some partnerships count as individuals, so they need consent or an existing customer relationship. UK GDPR still applies to the named person you write to.
Is B2B cold email allowed under GDPR?
GDPR does not ban it. It needs a lawful basis for using the person's data, and legitimate interest is the usual one for direct marketing. Each EU country also has its own e-privacy rules on unsolicited email, and some require consent even for business addresses, so check the country you are writing into.
Does Canada allow cold email?
Only with consent, but CASL counts some consent as implied. One route is an address the person published conspicuously, with no statement refusing unsolicited messages, where your message relates to their business role. A bought address with no such link to the person's role does not qualify.
Do Gmail and Yahoo rules apply to cold email?
They are not laws, but they decide whether your email arrives. Both require authentication, a low spam complaint rate, and for larger senders, one-click unsubscribe. A message can be perfectly legal and still land in spam.
